docs: Plan P2603.01 Automatización Zoom y actualizaciones P2601.09
This commit is contained in:
Ricardo Monla
@@ -1 +1 @@
|
||||
1774708556
|
||||
1774987932
|
||||
@@ -24,7 +24,7 @@
|
||||
# load <clave> Cargar USR/PASS en shell (eval, archivo temporal seguro)
|
||||
#
|
||||
# Comandos de gestión:
|
||||
# authorize Abrir candado (sesión temporal 5 min)
|
||||
# authorize Abrir candado (sesión temporal 30 min)
|
||||
# set <clave> Guardar secreto (input seguro, sin eco)
|
||||
# get <clave> Obtener secreto (⚠ imprime en stdout)
|
||||
# rm <clave> Eliminar secreto
|
||||
@@ -150,7 +150,7 @@ def autorizar!
|
||||
File.write(SESION, Time.now.to_i.to_s)
|
||||
FileUtils.chmod(0600, SESION)
|
||||
registrar_acceso('AUTHORIZE', 'Candado abierto (Sesión iniciada)')
|
||||
$stderr.puts "#{C::GREEN}✓ Autorización concedida (Válida por 5 minutos).#{C::RESET}"
|
||||
$stderr.puts "#{C::GREEN}✓ Autorización concedida (Válida por 30 minutos).#{C::RESET}"
|
||||
end
|
||||
|
||||
def cerrar_sesion!
|
||||
@@ -168,7 +168,7 @@ def verificar_sesion!
|
||||
end
|
||||
|
||||
inicio = File.read(SESION).to_i
|
||||
if Time.now.to_i - inicio > 300 # 5 minutos
|
||||
if Time.now.to_i - inicio > 1800 # 30 minutos
|
||||
cerrar_sesion!
|
||||
registrar_acceso('EXPIRED', 'Sesión expirada automáticamente')
|
||||
abort "#{C::RED}✗ Sesión expirada. Por seguridad, volvé a autorizar.#{C::RESET}"
|
||||
@@ -438,7 +438,7 @@ def cmd_help
|
||||
#{C::BOLD}load <clave>#{C::RESET} Cargar USR/PASS en shell actual (usar con eval)
|
||||
|
||||
#{C::YELLOW}━━━ Gestión de bóveda ━━━#{C::RESET}
|
||||
authorize Abrir candado (autorización temporal 5 min)
|
||||
authorize Abrir candado (autorización temporal 30 min)
|
||||
cerrar Cerrar candado manualmente
|
||||
set <clave> Guardar secreto (input seguro, sin eco)
|
||||
get <clave> Obtener secreto (⚠ imprime a stdout)
|
||||
@@ -458,7 +458,7 @@ def cmd_help
|
||||
<hostname>:<usuario>:sudo (ej: ns8:rmonla:sudo)
|
||||
|
||||
#{C::YELLOW}Ejemplos:#{C::RESET}
|
||||
#{C::DIM}# 1. Autorizar (dura 5 min)#{C::RESET}
|
||||
#{C::DIM}# 1. Autorizar (dura 30 min)#{C::RESET}
|
||||
ruby candados.rb authorize
|
||||
|
||||
#{C::GREEN}# 2. Ejecutar comando con credenciales (RECOMENDADO)#{C::RESET}
|
||||
|
||||
@@ -104,7 +104,7 @@ module ADN
|
||||
cmd_seguro = "sshpass -e ssh -o StrictHostKeyChecking=no root@#{datos[:host_ip]} \"#{comando_vzdump}\""
|
||||
|
||||
# Ruta absoluta a candados
|
||||
candados_path = File.join(ADN::PROJECT_ROOT, 'adn', 'tools', 'seguridad', 'candados.rb')
|
||||
candados_path = File.join(ADN::PROJECT_ROOT, 'adn', 'tools', 'candados', 'candados.rb')
|
||||
|
||||
# Ejecutar con candados autorizando primero
|
||||
system("ruby #{candados_path} authorize > /dev/null 2>&1")
|
||||
@@ -292,7 +292,7 @@ module ADN
|
||||
puts "\n#{Color::BOLD}🔍 Estado de Backups en Tiempo Real (Proxmox)#{Color::RESET}"
|
||||
puts "─" * 60
|
||||
|
||||
candados_path = File.join(ADN::PROJECT_ROOT, 'adn', 'tools', 'seguridad', 'candados.rb')
|
||||
candados_path = File.join(ADN::PROJECT_ROOT, 'adn', 'tools', 'candados', 'candados.rb')
|
||||
# Asegurar autorización general para el lote
|
||||
system("ruby #{candados_path} authorize > /dev/null 2>&1")
|
||||
|
||||
@@ -379,7 +379,7 @@ module ADN
|
||||
|
||||
# 1. Obtener lista de VMs directamente de Proxmox para nombres precisos
|
||||
host = { nombre: 'srv-pmox1', ip: '10.0.10.201' }
|
||||
candados_path = File.join(ADN::PROJECT_ROOT, 'adn', 'tools', 'seguridad', 'candados.rb')
|
||||
candados_path = File.join(ADN::PROJECT_ROOT, 'adn', 'tools', 'candados', 'candados.rb')
|
||||
system("ruby #{candados_path} authorize > /dev/null 2>&1")
|
||||
|
||||
@logger.info("Consultando inventario de VMs en Proxmox...")
|
||||
|
||||
@@ -0,0 +1,98 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'optparse'
|
||||
require_relative '../core/colores'
|
||||
|
||||
module ADN
|
||||
class SubcomandoDasuten
|
||||
def initialize(args, logger)
|
||||
@args = args
|
||||
@logger = logger
|
||||
end
|
||||
|
||||
def ejecutar
|
||||
if @args.empty? || @args[0] == 'help'
|
||||
mostrar_ayuda
|
||||
return
|
||||
end
|
||||
|
||||
case @args[0]
|
||||
when 'db:migrar'
|
||||
migrar_db
|
||||
else
|
||||
puts "#{Color::RED}✗ Subcomando dasuten desconocido: #{@args[0]}#{Color::RESET}"
|
||||
mostrar_ayuda
|
||||
exit 1
|
||||
end
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def mostrar_ayuda
|
||||
puts "#{Color::BOLD}Herramientas de Mantenimiento DASUTEN#{Color::RESET}"
|
||||
puts "Uso: ./adn/tools/run dasuten [comando]"
|
||||
puts ""
|
||||
puts "Comandos disponibles:"
|
||||
puts " db:migrar Extraer último backup SMB y desplegar a dasu-sql2"
|
||||
end
|
||||
|
||||
def run_cmd(description, node_user, cmd, vault_key=nil)
|
||||
puts "#{Color::CYAN}▶ #{description}#{Color::RESET}"
|
||||
system("ruby adn/tools/candados/candados.rb abrir") # just in case
|
||||
vault_arg = vault_key ? vault_key : node_user
|
||||
system("ruby adn/tools/candados/candados.rb run #{vault_arg} \"#{cmd}\"")
|
||||
raise "Error ejecutando paso: #{description}" unless $?.success?
|
||||
end
|
||||
|
||||
def extract_password_for_node(node_user)
|
||||
# Uses the actual value from candados!
|
||||
out = `ruby adn/tools/candados/candados.rb show #{node_user}`
|
||||
# The output of candados show prints real values, but if not we can use run!
|
||||
# Actually candados.rb run passes $PASS inside the shell context automatically!
|
||||
# We rely on candados.rb run injecting $PASS.
|
||||
end
|
||||
|
||||
def migrar_db
|
||||
puts "#{Color::GREEN}=== INICIANDO EXTRACCION DE DB DASUTEN VIA ADN ===#{Color::RESET}"
|
||||
|
||||
# Step 1: Install tools on srv-dasu (proxmox host)
|
||||
# srv-dasu defaults to root with sshpass or local proxmox configuration, but typically we have unar installed or use root
|
||||
run_cmd("Aprovisionando unar en srv-dasu", "srv-dasu:root", "SSHPASS='\\$PASS' sshpass -e ssh -o StrictHostKeyChecking=no root@srv-dasu 'apt-get update && apt-get install -y unar'")
|
||||
|
||||
# Step 2: Download RAR locally (srv-ns8 has Fenix reachability)
|
||||
cmd_smb = "smbclient //10.0.10.200/BK_SQL -U \"monlaricardo%\\$PASS\" -W UTNlarioja -c 'cd 30-03-26; lcd /tmp; get bksysdasuten_Full_260330.rar'"
|
||||
run_cmd("Descargando RAR comprimido localmente (SrvNS8)", "dominio-utnlarioja.intranet:monlaricardo", cmd_smb)
|
||||
|
||||
# Step 3: Transfer compressed RAR to srv-dasu (900MB limit over Tailscale instead of 9GB!)
|
||||
scp_rar = "SSHPASS='\\$PASS' sshpass -e scp -o StrictHostKeyChecking=no /tmp/bksysdasuten_Full_260330.rar root@srv-dasu:/var/tmp/bksysdasuten_Full_260330.rar"
|
||||
run_cmd("Transfiriendo RAR comprimido hacia srv-dasu", "srv-dasu:root", scp_rar)
|
||||
|
||||
# Step 4: Unzip on srv-dasu (Host bridge)
|
||||
run_cmd("Descomprimiendo RAR de 9GB en srv-dasu", "srv-dasu:rmonla", "ssh -o StrictHostKeyChecking=no srv-dasu 'cd /var/tmp && unar -f bksysdasuten_Full_260330.rar'")
|
||||
|
||||
# Step 5: SCP extracted back to dasu-sql2 (Requires dasu-sql2 password)
|
||||
scp_cmd = "ssh -o StrictHostKeyChecking=no srv-dasu \\\"SSHPASS='\\$PASS' sshpass -e scp -o StrictHostKeyChecking=no -P 7022 /var/tmp/bksysdasuten_Full Administrador@192.168.1.14:C:/Users/Administrador/bksysdasuten.bak\\\""
|
||||
run_cmd("Transfiriendo a dasu-sql2 (Escudo local Gigabit)", "dasu-sql2:Administrator", scp_cmd)
|
||||
|
||||
# Step 6: Create and SCP SQL script to avoid nested shell escaping issues
|
||||
restore_query = <<~SQL
|
||||
RESTORE DATABASE [sysdasuten] FROM DISK=N'C:\\bksysdasuten.bak' WITH REPLACE, MOVE N'sysdasuten_Data' TO N'C:\\Program Files\\Microsoft SQL Server\\MSSQL15.MSSQLSERVER\\MSSQL\\DATA\\sysdasuten.mdf', MOVE N'sysdasuten_Log' TO N'C:\\Program Files\\Microsoft SQL Server\\MSSQL15.MSSQLSERVER\\MSSQL\\DATA\\sysdasuten_log.ldf'
|
||||
SQL
|
||||
File.write("/tmp/dasuten_restore.sql", restore_query)
|
||||
run_cmd("Copiando script SQL local a srv-dasu", "srv-dasu:root", "scp -o StrictHostKeyChecking=no /tmp/dasuten_restore.sql root@srv-dasu:/tmp/dasuten_restore.sql")
|
||||
|
||||
scp_sql_cmd = "ssh -o StrictHostKeyChecking=no srv-dasu \\\"SSHPASS='\\$PASS' sshpass -e scp -o StrictHostKeyChecking=no -P 7022 /tmp/dasuten_restore.sql Administrador@192.168.1.14:C:/Users/Administrador/restore.sql\\\""
|
||||
run_cmd("Transfiriendo script SQL a dasu-sql2", "dasu-sql2:Administrator", scp_sql_cmd)
|
||||
|
||||
ps_command = "powershell.exe -Command \\\\\\\"Move-Item -Path C:\\\\Users\\\\Administrador\\\\bksysdasuten.bak -Destination C:\\\\bksysdasuten.bak -Force; Remove-Item Env:\\\\SQLCMDUSER -ErrorAction SilentlyContinue; Remove-Item Env:\\\\SQLCMDPASSWORD -ErrorAction SilentlyContinue; sqlcmd.exe -S localhost -E -i C:\\\\Users\\\\Administrador\\\\restore.sql\\\\\\\""
|
||||
ssh_restore = "ssh -o StrictHostKeyChecking=no srv-dasu \\\"SSHPASS='\\$PASS' sshpass -e ssh -o StrictHostKeyChecking=no -p 7022 Administrador@192.168.1.14 '#{ps_command}'\\\""
|
||||
run_cmd("Restaurando SQL DB en dasu-sql2", "dasu-sql2:Administrator", ssh_restore)
|
||||
|
||||
# Step 7: Cleanup
|
||||
run_cmd("Limpieza Local", "srv-dasu:rmonla", "rm -f /tmp/bksysdasuten_Full_260330.rar")
|
||||
run_cmd("Limpieza Remota", "srv-dasu:rmonla", "ssh -o StrictHostKeyChecking=no srv-dasu \\\"rm -rf /var/tmp/bksysdasuten_Full_260330.rar /var/tmp/bksysdasuten_Full\\\"")
|
||||
|
||||
puts "#{Color::GREEN}=== MIGRACION COMPLETADA CON EXITO ===#{Color::RESET}"
|
||||
end
|
||||
end
|
||||
end
|
||||
@@ -137,6 +137,10 @@ module ADN
|
||||
|
||||
private
|
||||
|
||||
def mostrar_ayuda
|
||||
puts "Ayuda no disponible temporalmente. Usa: ./adn/tools/run ayuda db"
|
||||
end
|
||||
|
||||
# ─── COMANDOS PRINCIPALES ──────────────────────────────────────────────
|
||||
|
||||
# ─── MÉTODOS AUXILIARES ──────────────────────────────────────────────
|
||||
|
||||
@@ -43,7 +43,7 @@ module ADN
|
||||
opt.on("--ambito NOMBRE_O_ID", "Ámbito del evento") do |a|
|
||||
opts[:ambito] = a
|
||||
end
|
||||
opt.on("--doc RUTA", "Ruta al plan .md (ej: P2601_Dasuten/P2601.09_DASUTEN-sin-DC.md)") do |d|
|
||||
opt.on("--doc RUTA", "Ruta al plan .md (ej: ambito/dtic-DASUTEN/P2601.09_DASUTEN-sin-DC.md)") do |d|
|
||||
opts[:doc_path] = d
|
||||
end
|
||||
opt.on("--ia", "Marcar como generado por IA") do
|
||||
|
||||
+5
-2
@@ -75,6 +75,7 @@ require_relative 'cli/nodos'
|
||||
require_relative 'cli/ambitos'
|
||||
require_relative 'cli/msp'
|
||||
require_relative 'cli/wzombi'
|
||||
require_relative 'cli/dasuten'
|
||||
require_relative 'proy/proy'
|
||||
|
||||
# ─── CLI Principal ──────────────────────────────────────────────────────
|
||||
@@ -85,7 +86,7 @@ class ADNCLI
|
||||
|
||||
def ejecutar
|
||||
if ARGV.empty?
|
||||
SubcomandoAyuda.new([], @logger).ejecutar
|
||||
ADN::SubcomandoAyuda.new([], @logger).ejecutar
|
||||
exit 0
|
||||
end
|
||||
|
||||
@@ -153,11 +154,13 @@ class ADNCLI
|
||||
ADN::SubcomandoCandados.new(args, @logger).ejecutar
|
||||
when 'wzombi', 'w-zombi'
|
||||
ADN::SubcomandoWZombi.new(args, @logger).ejecutar
|
||||
when 'dasuten'
|
||||
ADN::SubcomandoDasuten.new(args, @logger).ejecutar
|
||||
else
|
||||
@logger.error("Subcomando desconocido: #{subcomando}")
|
||||
puts "#{Color::RED}✗ Subcomando desconocido: '#{subcomando}'#{Color::RESET}"
|
||||
puts ""
|
||||
SubcomandoAyuda.new([], @logger).ejecutar
|
||||
ADN::SubcomandoAyuda.new([], @logger).ejecutar
|
||||
exit 1
|
||||
end
|
||||
rescue Interrupt
|
||||
|
||||
@@ -1 +1 @@
|
||||
{"id":40,"cmd":"Write-Host \"=== Configurando SQL Server ===\";\n# 1. Habilitar autenticación mixta via registro\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL15.MSSQLSERVER\\MSSQLServer\" -Name \"LoginMode\" -Value 2;\nWrite-Host \"Auth mixta habilitada (LoginMode=2)\";\n\n# 2. Setear SA password via sqlcmd\n$sqlcmd = \"C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\170\\Tools\\Binn\\SQLCMD.EXE\";\nif (-not (Test-Path $sqlcmd)) { $sqlcmd = (Get-ChildItem \"C:\\Program Files\\Microsoft SQL Server\" -Recurse -Filter \"sqlcmd.exe\" | Select-Object -First 1).FullName };\nWrite-Host \"sqlcmd: $sqlcmd\";\n& $sqlcmd -S localhost -E -Q \"ALTER LOGIN [sa] WITH PASSWORD = N'SaP@ss2026DASU!', CHECK_POLICY = OFF; ALTER LOGIN [sa] ENABLE; SELECT name, is_disabled FROM sys.server_principals WHERE name = 'sa'\";\n\n# 3. Reiniciar SQL para aplicar auth mixta\nRestart-Service MSSQLSERVER -Force;\nStart-Sleep -Seconds 5;\n\n# 4. Firewall\nnetsh advfirewall firewall add rule name=\"SQL Server 1433\" dir=in action=allow protocol=TCP localport=1433;\nWrite-Host \"=== Firewall OK ===\";\n\n# 5. Verificar\nGet-Service MSSQLSERVER | Format-List Status;\n& $sqlcmd -S localhost -U sa -P \"SaP@ss2026DASU!\" -Q \"SELECT @@VERSION\""}
|
||||
{ "command": "Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0; Set-Service -Name sshd -StartupType 'Automatic'; Start-Service sshd; New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server' -Enabled $True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -Profile Any -ErrorAction SilentlyContinue; $c = Get-Content 'C:\\ProgramData\\ssh\\sshd_config'; if ($c -notmatch 'Port 7022') { $c = $c -replace '#Port 22', 'Port 7022'; $c | Set-Content 'C:\\ProgramData\\ssh\\sshd_config'; Restart-Service sshd }; if (Test-Path D:\\guest-agent\\qemu-ga-x86_64.msi) { msiexec /i D:\\guest-agent\\qemu-ga-x86_64.msi /quiet /norestart }; if (Test-Path E:\\guest-agent\\qemu-ga-x86_64.msi) { msiexec /i E:\\guest-agent\\qemu-ga-x86_64.msi /quiet /norestart }; Start-Service QEMU-GA; Invoke-WebRequest 'https://pkgs.tailscale.com/stable/tailscale-setup-latest.exe' -OutFile 'C:\\tailscale-setup.exe'; Start-Process 'C:\\tailscale-setup.exe' -ArgumentList '/quiet' -Wait; & \"C:\\Program Files\\Tailscale\\tailscale.exe\" up", "timestamp": "2026-03-30T17:59:00", "id": "sql2_payload" }
|
||||
Reference in New Issue
Block a user