tacctl 0.2.23

tacctl 0.2.23

0.2.23 lets a user have an email address, gives each SNMPv3 level a pool of
users with one default, registers a copy of a device at a bench address
(device clone) and moves it into place (device rename --replace), extends
emergency lockdown to the enrolled Linux hosts, and checks the source
addresses a device uses to reach this server. The numbered list in
CHANGELOG.md (0.2.23) is everything that differs from 0.2.22.

Devices

• tacctl device clone <name> <new> --staging <bench-ip> registers a copy of
  a device's intent (the registry settings, the SNMP settings and
  credentials, the NETCONF settings, the timing scale, the configuration
  blocks) at a bench address. It does not copy the address, the name, the
  host keys, the acknowledged notices, the break-glass hold or the pull
  record. Engineers may clone within their own scopes.
• tacctl device rename <replacement> <name> --replace removes the original
  with its files after a snapshot and one confirmation, moves the replacement
  to the original's address, which ends the bench address, and clears the
  original's hold. An original with a hold needs a superuser.
• device rename and host rename carry the bench address that was staged
  under the old name.
• The settings a device keeps for its own AAA server (a source address, a
  timeout, a retry, a routing instance) are no longer listed as differences.
• The source address of the AAA client must be an address of the device; a
  source that no interface holds is an irregularity in the plan, the diff and
  the lists. device check --sources and device scan --sources connect to
  such a source address and warn when it is unreachable or presents another
  host key.

SNMPv3

• The version, the port, the timeout and the two protocols stay one setting
  per level (the config, a scope, a device). The v3 users are a pool of
  names with their passphrases and one default: v3-user add|remove|default| list. A device uses its own default, else its scope's, else the config's,
  or any user of the pools it can see.
• A version 1 credential file reads as a pool of one user, nothing rewrites
  it at the upgrade, and a command saves version 1 again whenever the
  content fits it.

Users and hosts

• user add --email <address> and user email <name> [<address>|clear] set
  an optional email address; the superuser sets it, user show and
  store show --json carry it, an audit line never does, and no mail is
  sent.
• A user change that touches an account on this server (add, remove, rename,
  group, scope, enable, disable, require-password-change) syncs this
  server's own accounts at once, so a new user can log in to change the
  password. The other enrolled hosts it reaches are named in one notice and,
  on a terminal, offered a sync.
• emergency lockdown enable|disable also closes SSH key logins and
  forwarding on the enrolled hosts of the scope, through host sync (a
  static sshd drop-in, script protocol 7). A host that is unreachable stays
  on a pending list that status shows; a host enrolled or synced during a
  lockdown gets the drop-in; enable ends the live sessions of the accounts
  the drop-in matches.

Backups

• tacctl backup keep and backup unkeep persist a snapshot beyond the
  retention. backup recover <snapshot> [--only email,snmp-users] puts back
  only what a rollback dropped.

Rollback

tacctl rollback 0.2.22 is new. 0.2.22 reads every file this release writes
but the users' email addresses and the SNMP credential files in version 2, so
the target removes the email addresses and writes the credential files in
version 1 again, after a snapshot that it keeps, and needs --yes when it
drops anything. It also puts back 0.2.22's per-tier sudoers drop-in. The
older targets do the same. backup recover returns what was dropped.

Upgrading

No file is rewritten at the upgrade. The per-tier sudoers drop-in gains the
engineers' rule for device clone. After a rollback, the older release
reports the rendered config as out of date until its first render.

tacctl 0.2.22

tacctl 0.2.22

0.2.22 fixes what a live network showed (a host key that could not be read,
a Junos virtual chassis that could not be applied to), cleans up the lists,
the --yes flag and the answer to an unknown word, adds host sync|check --concurrency, gathers the settings of this server under tacctl server,
and adds a timing scale and --timing for slow or distant devices. The
numbered list in CHANGELOG.md (0.2.22) is everything that differs from
0.2.21.

Devices

• A device that ssh-keyscan reads nothing from, but plain ssh reaches
  (a device slow to start its ssh service), gets its host key read by the
  built-in client, one connection at a time.
• A Junos virtual chassis whose master answers without a label is applied
  to: the check, the confirmed commit and the commit.
• device list shows network devices only; the enrolled Linux hosts,
  this server included, are in host list, which takes the columns and
  filters of device list. device list --differs keeps the devices whose
  last pull differs from what tacctl renders now.
• tacctl device timeout-scale, scope timeout-scale and config devices timeout-scale set a scale from 1 to 10 for the network timings
  used to reach a device (the host-key scan, the ssh and NETCONF connect,
  SNMP, the per-device time of a pull). 1 changes nothing.
• --timing on device config pull, diff --pull, plan --pull and
  apply shows where the time of each device went.

Users and hosts

• User names are letters, digits, _ and -. A user stored with a period
  stays readable so that user rename can fix it; config validate reports
  it and tacctl upgrade refuses until it is renamed.
• host sync|check --concurrency <n> runs several hosts side by side. The
  default, 1, is as before.

The command line

• -y is gone; --yes stays.
• An unknown sub-command is one short answer with a suggestion, and below
  the first word it is given before sudo asks for the password.
• Command names in the lists are teal like the sub-commands.

The server

• tacctl server show shows this server at a glance; server listen and
  server metrics are config listen and config metrics moved whole;
  server name sets the name the console shows.
• The generated tacquito drop-in and the shipped unit comments name the
  current commands.

Rollback

tacctl rollback 0.2.21 is new. It removes server.name and the timing
scale keys, which 0.2.21 cannot read, converts nothing else and needs no
--yes.

Upgrading

The first render after the upgrade rewrites the tacquito drop-in (its
comment changed) and restarts tacquito once. A user name with a period
stored: tacctl upgrade replaces the binary and the tacquito build, then
refuses; rename the user and run it again. After a rollback, the older
release reports the rendered config as out of date until its first render.

tacctl 0.2.21

tacctl 0.2.21

0.2.21 lets every user log in to the tacctl server and its console, sets up
the machine's own login during install and upgrade, records the server
address as a setting of its own, and makes ssh ask for the password once,
before it connects. The numbered list in CHANGELOG.md (0.2.21) is
everything that differs from 0.2.20.

The server login

• Every user can log in to the tacctl server and its console, whatever
  their scopes, unless disabled or in a group of tier none. The login is a
  scope called tacctl that tacctl manages: it is reserved, hidden from
  every listing and completion, and no command edits it. Device logins keep
  the user's own scopes.
• tacctl install and tacctl upgrade set this machine's own login up
  (install -y agrees, an upgrade asks on a terminal only, and nothing is
  half applied when a step is refused). tacctl host enroll --local stays
  the way to rebuild, move or repair a server.
• The address devices and hosts reach the server at is the new setting
  server.addresses (a list that holds one address for now), shown and
  changed by tacctl server addresses [list]|add|remove|replace <ip>. With
  no setting, the address of the interface with the default route is used
  and said. The device walkthroughs, config linux script and host
  enrolment default to it, and follow the listener ports you configured.

Devices and ssh

• A Junos virtual chassis of one member is applied to like a single device.
• With the password cache on, ssh and device ssh ask for the password
  themselves the first time, before they connect, and store it; the next
  ssh to any device asks nothing.
• user rename to a name with a period names the ways forward.

Rollback

tacctl rollback 0.2.20 is new. Every target adds the tacctl scope to the
scopes of each user who logs in to the server, since the older releases need
it there; it warns, and --apply needs --yes.

Upgrading

A scope that you created and called tacctl is never taken over. While it
exists, host enroll --local, the sync of the server and config validate
stop with one line; rename it first (scope rename tacctl <new-name>).
After tacctl upgrade, check that the new line about the machine's own
login is as you expect, and run tacctl host sync <server> as before.

tacctl 0.2.20

tacctl 0.2.20

0.2.20 adds a required password change, makes the console the login shell of
every managed user, adds a strict mode for the Junos management filter, makes
root a break-glass account of a scope's Junos devices, reads more devices
and chassis correctly, and adds tacctl man. The numbered list in
CHANGELOG.md (0.2.20) is everything that differs from 0.2.19.

A required password change

A user can be required to change the password before logging in to anything
but the tacctl server. tacctl user add and an administrator's
tacctl user passwd <name> require it by default (--no-change-required
skips it); tacctl user require-password-change <name>|--all [on|off] sets
it for existing users, and no existing user is flagged by the upgrade.
Superusers are never held. While the change is required, no device accepts
the user over TACACS+ or RADIUS and no enrolled Linux host answers the
account; on the server the console shows a notice and the password change
dialog, and nothing else runs until the password is changed. Read
docs/security/login-console.md before turning it on for everyone.

Console

• The console is the login shell of every managed user at the next
  host sync of the server; there is no switch for it any more. The system
  shell is an opt-in, set by superusers per tier or per user
  (console system-shell), and the password cache is each user's own choice
  within the tier's permission (console password-cache).
• console color and console list-max set the colours and the length of
  the console's lists; -h and --help print the help that ? prints;
  Tab lists the words alone and bash can bind a help key.
• tacctl man [topic] opens the manual page, in the shell and in the
  console, for every tier.

Junos

• scope mgmt-acl <scope> mode strict renders the management filter
  deny-by-default; read the walkthrough conditions before using it.
• root is a break-glass account of a scope's Junos devices
  (scope breakglass <scope> add root): the walkthrough renders the root
  password and root-login allow as comments to fill in, and
  device config pull|diff checks them by presence.
• device config apply reads every spelling of a commit command, answers
  from a virtual chassis or cluster must name their members, and the end of
  a pending commit is the device's own wall clock.
• A device's own SNMP, system and NETCONF statements are no irregularity in
  device config plan; the report lists them on a Kept: line.
• A device that does not answer the combined host key scan is asked one key
  type at a time, and the built-in ssh client reads the keys of any device.

Rollback

tacctl rollback 0.2.19 is new and takes the release before this one. Every
target now warns, until --yes, of users who would gain a system shell or
the password cache and of scopes that record root, and removes the
required password change from the store. docs/install/upgrading.md lists
what each target does.

Upgrading

After tacctl upgrade, run tacctl host sync <server> for the server's own
host entry: the console becomes the login shell of every managed user then,
and not before. Nothing else changes a default; existing users are not
required to change their password until you say so.

tacctl 0.2.19

tacctl 0.2.19

0.2.19 widens what the device configuration blocks can state, lets
engineers do the device work of their own scopes, adds an emergency
lockdown and fixes several device reads. The numbered list in
CHANGELOG.md (0.2.19, items 1 to 18) is everything that differs from
0.2.18.

Emergency lockdown

tacctl emergency lockdown <scope> enable|disable|status is the
superuser's. It refuses the logins of the groups named (default every
group that is not a superuser's, or the groups of one --tier) on a scope
or on every scope, at render time: the server keeps answering and says no, and the groups of the
superuser tier are never locked. There is no timer; disable renders the
files back as they were. Every command that names a locked scope prints a
red notice, and status, config validate and backup restore show a
lockdown that stands. Read docs/cli/emergency.md before using it.

Blocks

• The Junos and IOS system blocks are closed tables of statements:
  syslog, the login announcement, login retry and password policy, ip ssh
  settings, clock summer-time, timestamps and the IOS banner motd and
  banner exec beside banner login. They are compared, planned in place,
  adopted from a device and admitted by the apply allow-list.
• An absent line (absent system services telnet, absent ip http server) states a service the scope requires to be off; the plan deletes
  it once, and the apply admits exactly that delete.
• A plan and a walkthrough say which block each statement comes from. A
  scope's block states only what is the same for every device (the
  statements that name the device itself belong to the device's block), and
  block show prints the login message as it is.
• ? describes the vendors, the verbs and the block names of scope block
  and device block.

Devices

• Engineers enroll, collect, onboard, sync and apply for the devices of
  their own scopes; device config forget and shapes stay the
  superuser's. tacctl upgrade rewrites the tiers sudoers drop-in.
• device support-bundle collects a scrubbed, read-only bundle of what a
  developer needs of a device.
• A mixed Junos virtual chassis and an older Junos release pass the
  pre-flight, and a login's permissions are read from the name of each row.

Hosts and commands

• A host name may hold dots (host rename web1 web1.example.net); the
  target, address and scope of the host stay as they are.
• An unknown command is answered before sudo asks for a password.

Rollback

tacctl rollback 0.2.18 is new and takes the release before this one: its
--apply puts back the tiers drop-in 0.2.18 writes. Every rollback target
now refuses while an emergency lockdown locks a group (an older release
would render every locked user back into the scope), removes a partial
lockdown record, and warns, until --yes, of the system blocks that use
statements this release added; an older release lints those as errors, so
take the statements out before the upgrade. The block files are not
rewritten.

No setting changes its default and no exit status changes. The new
emergency.lockdown.<scope>.* keys of tacctl.yaml exist only while a
lockdown stands.

tacctl 0.2.18

tacctl 0.2.18

0.2.18 makes the command names complete with Tab and cleans up what Tab
and ? show. A verb that was a complete word and also the start of a
sibling (device config and device config-syntax) could not be
completed with a space; the siblings are renamed. The numbered list in
CHANGELOG.md (0.2.18, items 1 to 7) is everything that differs from
0.2.17.

Renamed verbs, flag and setting

The old names are gone, not aliased: each is an unknown subcommand or
option, so a script that uses one must change.

0.2.17	0.2.18
device config-syntax <name> [auto|ios12|modern]	device ios-syntax <name> [auto|ios12|modern]
device add --config-syntax <syntax>	device add --ios-syntax <syntax>
device notices [<name>] [--all]	device notice list [<name>] [--all]
device ssh-config	device client-config

• The stored setting. The key in devices.yaml, in device export
  and in the --json output of device list and device show is
  ios_syntax (it was config_syntax); the audit line of a change says
  field=ios-syntax. A registry, a snapshot or an imported file that
  holds the old key is read as before, and the next change of the
  registry writes the new one. A script that reads config_syntax from
  the JSON must change.
• Sudoers. tacctl upgrade rewrites the tiers drop-in: the engineer
  tier gets device ios-syntax *, every tier device notice list and
  device client-config.
• Rollback. tacctl rollback 0.2.17 is new and takes the release
  before this one: its --apply takes a snapshot, writes the setting
  back under config_syntax and puts back the tiers drop-in 0.2.17
  writes. 0.2.16 and 0.2.9 write the setting back too, and 0.2.3
  removes it under either key.

Completion and ?

• device ios-syntax completes the Cisco devices and device netconf
  the Junos devices; hosts and other vendors are not offered.
• An unknown command prints one error line, a Did you mean line for a
  verb of that name or a close spelling, and a pointer to tacctl, and
  exits 1 as before (tacctl enroll suggests device enroll and host enroll).
• ? and Tab describe every command, flag and fixed word from the lines
  of its own verb. Flags that showed another verb's text, descriptions cut
  short and verbs with no usage in ? are fixed. The usage text writes
  placeholders, ranges (<10-14>) and choices one way, and a verb whose
  forms take different arguments has a row for each. The manual page
  follows the usage.

No setting is new and no exit status changes.

tacctl 0.2.17

tacctl 0.2.17

0.2.17 is the audit release. Every line tacctl writes to syslog goes through
one writer and carries a session id, every state-changing command writes a
start and an end line, every change writes a line saying what it changed,
and a setting can refuse a command or a secret reveal whose line cannot be
written. The release also reads the vendor from the device by SNMP, adds
selectors and a pull step to the device configuration verbs, asks for each
device of an apply by its name, and adds device enroll, one attended
command from a new address to its plan, with an SSH host key accepted per
device in enroll, collect and onboard. The only new setting is
audit.strict, off by default. The numbered list in CHANGELOG.md (0.2.17,
items 1 to 14) is everything that differs from 0.2.16.

The audit log

docs/security/audit.md and the AUDIT LOG section of the manual page
describe the lines, their keys and forwarding.

• One writer, a session id. Each line of a run ends in the same
  sid=<id> (8 characters of a-z0-9, made for each run; the tier gate's
  DENY lines and the login console's tacctl-console lines included), so
  grep sid=<id> finds every line of one command. The words and keys of the
  lines that existed are unchanged and sid= is the last key. A line is no
  longer dropped while Ctrl-C, SIGTERM or a hangup is ending the command:
  ssh end and console end were lost on a hangup. When logger cannot be
  started or exits non-zero, the command prints once on standard error that
  the audit line was not written and goes on with its own status; before,
  every such line was lost silently. tacctl install and tacctl upgrade
  warn when logger (package util-linux) is not installed.
• cmd start, cmd end, cmd DENY. A command that changes state or
  logs in somewhere every time it runs writes cmd start before it does
  anything and cmd end where its exit status is decided. result is ok,
  failed, denied, interrupted or aborted, and snapshot names the
  snapshot the command took. A command that is a read or a write by its
  later arguments (scope secret, device port <name> [<n>], config loglevel [<level>]) writes the pair only when it writes. The commands that
  only read write none. A refusal inside a verb (an engineer naming a
  scope's secret to change, or another scope's device; the superuser's
  verbs) writes cmd DENY with reason=superuser|scope; its message and
  exit status are unchanged. A start line with no end line means the command
  did not finish. A person who runs tacctl as root with no SUDO_USER is
  user=root origin=root.
• Detail lines. A command that changes something writes a line of its
  own beside the pair, saying what it changed and, for a setting, the value
  before and after (config loglevel from=info to=debug by=<user>). A list
  is one word (scopes=core,lab). The lines that existed keep their words
  and gain result=ok; a failed change is written too, at auth.warning,
  as result=failed reason=<word>, never the text of an error. A value is a
  name or a count, never a secret, a hash or a password.
• Secret reads. Every show that prints a secret writes secret-read kind= name= for every caller (before, only for the restricted tiers), and
  so do store show, config dump and backup diff. config linux script
  writes secret-export.
• Redaction. args= shows <redacted> for the value of --hash, of
  scope add --secret and of scope secret <scope> set, for every word of
  hash and passwd, and for a word typed in the place of a prompt (user passwd bob <password>, scope snmp <scope> community <value>). The login
  console's refusal of a -c string names its first word only when it is a
  verb of tacctl or one of the console's own words; any other word reads
  first=- len=<n>. Free text such as breakglass hold --reason is logged
  as typed. The test suite fails when a marker typed in any of these places
  reaches a logger argument.
• Snapshot manifest. The manifest of a snapshot gains sid, user
  and command, so the snapshot= id of a cmd end line and the snapshot
  lead to each other. Snapshots of earlier releases have none of them.
• Priorities. auth.info for an action, auth.notice for the weighty
  ones (install, upgrade, uninstall, rollback, log clear, the
  whole-state replacements, group edit <group> tier|priv-lvl, config sudoers, config audit-strict), auth.warning for a refusal and for an
  end line whose result is not ok.

audit.strict

audit: {strict: false} in tacctl.yaml is the new key (true or false;
anything else is a config validate error). With strict: true, a command
that changes state whose cmd start line logger did not write is refused
before it changes anything (status 1, no snapshot taken); a command that
only reads runs. An end line that cannot be written is still the warning.

tacctl config audit-strict [on|off] (superuser) shows the value and where
it comes from; on writes the key and off removes it. The command is
never refused by the setting, so off works while logger is down.

With the setting on, a command that shows a secret (scope secret <scope> show, config cisco|juniper|wti, device config show, device config plan
unless --no-secrets, the --reveal forms of the SNMP and block verbs,
store show, config dump, backup diff, the diffs of backup restore
and config restore) is refused for every tier when its secret-read line
cannot be written, before any secret is printed (nothing was shown.,
status 1). config linux script writes its secret-export line before the
script and is refused the same way before the file is written. Without the
setting a line that cannot be written is the warning, and the secret is
shown.

Secrets off the command line

tacctl scope secret <scope> set with no value asks twice at a terminal
without echo; set --stdin reads one line of standard input. tacctl user add and tacctl user passwd take --hash - to read the hash from standard
input. The forms with the value on the command line work as before; sudo's
log records the whole line and ps shows it while the command runs, which
the new forms avoid.

Vendor detection

tacctl device add reads the device's sysObjectID.0 and sysDescr.0 by
SNMP and says which vendor they name: cisco for an enterprise 9 answer
whose sysDescr starts Cisco IOS Software or Cisco IOS XE Software,
juniper for an enterprise 2636 answer whose sysDescr names Junos, and
wti for an enterprise 2634 answer. Any other answer names none. A
--vendor that disagrees is a warning; without --vendor a terminal is
asked one y/N to register with the vendor named, and --pull without
--vendor uses it.

device check has a Vendor row (vendor_detected in --json) and
--all ends with the devices registered as other that name a vendor.
device vendor <name> --from-device [-y] sets the vendor from the device.
device discover --snmp puts each address's sysName and vendor in its
device add line. A vendor read that is not the registered one is the
notice vendor-differs (not acknowledgeable). A vendor change marks the
last pull needs pull (vendor changed), so device config diff, plan
and sync no longer read a record in the other vendor's shape. Nothing is
written to a device.

Selecting devices

device config pull, diff, plan and apply take three new selectors
beside names, --all, --scope, --vendor and --stale:

• --differs keeps the devices whose last pull differs from what tacctl
  renders now (decided from the records, with no login). A device that
  needs a pull, was never read or failed is --stale, not --differs.
• --name <text> keeps the devices whose name contains the text.
• --ip <addr|cidr|text> keeps those whose address equals the address, lies
  in the prefix or contains the text.

--name and --ip take comma lists, as in device list, and device config list takes them too. The filters combine; --stale and --differs together
are an AND on pull, diff, plan and apply. --name and --ip match
text, so select the devices of an apply by exact names, a full address or
a CIDR. A selector given with no value (--scope=, --name "") is refused
with exit 2 instead of selecting every device.

device config apply --pull first reads the selected Junos devices as
device config pull does, with the one password of the run asked once for
the pull, the check and the apply. A device whose pull fails is a failed row
and is not checked; a pull that stops ends the run with nothing checked.
--stale and --differs are applied to the fresh records, so apply --pull --differs reviews the devices that differ now. The summary names a device
that no longer differs, and one that cannot be compared, and neither is
checked. The review, --check, --confirmed -y, --hold and every refusal
are unchanged. The pull only reads.

The apply review

The review shows the devices grouped by shape, then asks for each device in
turn: Type the device name to apply to <name>:. The name typed back
approves that device (spaces and tabs around it are ignored). Anything else
declines it with no second try, and the end of input declines it and every
device after it. The single answer for several devices, the number of
devices, is gone, and there is no default. All the questions are answered
before the first commit, so the canary, --pause, --concurrency and
--hold are unchanged.

A declined device is a skipped row and nothing is sent to it; the approved
ones are applied and the run exits 1 (--json: "stop":"not-approved"). A
Ctrl-C at a question, or after the last answer and before the first commit,
applies nothing and exits 130. The audit lines say how the review was
answered: a `device confi...

tacctl 0.2.16

tacctl 0.2.16

0.2.16 closes what 0.2.15 left open on the host side. The UID ledger gets a
lock, host enroll checks names again after its script has run, a held host
is worded as a host in the rendered backend files, and config validate
refuses a stray argument. There is no new setting and no new way of writing
to a device. The numbered list in CHANGELOG.md (0.2.16, items 1 to 6) is
everything that differs from 0.2.15.

The UID ledger has a lock

linux-uids was read and written by several commands with nothing between
them. Two host sync runs that met a new user each took the same next
number, so the user got two lines or two users shared a number. Every
command that writes the ledger or decides from it now holds
/etc/tacctl/.linux-uids.lock for its read-and-write window and nothing
longer: host enroll, host sync and config linux script while they work
out the users (never while the script runs on a host), config linux uid,
config linux uid-range, the move of user rename, and the put of
backup restore. Every snapshot copies the ledger under it. A command that
finds the lock held waits up to 30 seconds, then stops with nothing changed.
Commands that only show the ledger take no lock. --keep-uids takes none.
No file format changes.

Host names

host enroll repeats its check of the new name against the device registry
after the client script has run, under the device registry's lock. A host and
a device can no longer end up with one name because a device add finished
while the script ran. A conflict takes the registry line back, exits 1, and
warns of what the command did before the script (the host's own scope opened
to both protocols, a --staging bench address) with the command that undoes
it. host enroll also refuses a new name that a break-glass hold is recorded
under, as host rename already did.

The comment block of tacquito.yaml and the RADIUS clients.conf reads
(host <name>) for a hold on an enrolled host and (device <name>) for a
held device. backup restore words a hold by the registry it puts back,
rendering the files again after the host files are in place.

config validate

config validate extra refuses the word (Unknown argument: 'extra', exit
status 1, no report). --fix-names counts a host renamed whose own scope is
refused as renamed, prints one line for the scope with the command to retry
it, and no longer offers the scope a second time in the same run; the run
exits 1 because a name was not offered.

Upgrading from 0.2.15

Upgrade with sudo tacctl upgrade as always; a second run changes nothing.
Nothing is written to a device and no file is converted. The ledger lock
file is created by the first command that needs it. The pinned
actions/upload-artifact of the reproducible-build workflow moves to 7.0.2.

Known limits

• A host sync that gives a number out in the few seconds between the
  snapshot a backup restore takes and the put of the ledger is in neither
  the note nor the undo.
• config linux uid-range writes tacctl.yaml between its two ledger
  windows; a config linux uid <user> <uid> that runs between them sees the
  new range.
• Most verbs that change users, groups, scopes or the device registry write
  no audit line to syslog yet. The audit lines are planned for 0.2.17
  (docs/plans/0.2.17-plan.md).
• The configuration the backends render for an orphan hold (a hold with no
  device or host) still reads (device <name>).

Rolling back

No state format changed. tacctl upgrade --branch 0.2.15 installs 0.2.15
over it; 0.2.15 ignores the lock file, and the two releases do not take each
other's locks, so do not run commands of both at once. The ledger itself is
the same file.

tacctl 0.2.15

tacctl 0.2.15

0.2.15 finishes the host work of 0.2.14. A restore no longer runs beside a
rotation, a sync no longer uses up a snapshot, several hosts can be synced
or checked in one command, config validate gains a JSON form and can
rename the names it flags, and a restore can leave the UID ledger alone.
There is no new setting and no new way of writing to a device. The numbered
list in CHANGELOG.md (0.2.15, items 1 to 9) is everything that differs from
0.2.14.

Restores and snapshots

backup restore (and config restore) now tries the per-host lock that
host provisioner rotate, host rename and host forget hold, for every
host in the live registry and in the snapshot's, without waiting. If another
command holds one it stops before the snapshot of the current state, changes
nothing and names the host; run it again when that command has finished. The
restore can no longer interleave with a running rotation. The three
refusals for a busy host lock read the same way.

--keep-uids restores a snapshot's registry, host records and staging but
not the UID ledger. Use it when the snapshot is wanted for its users,
groups, scopes or devices and the hosts have synced since: the live ledger
is the one the hosts agree with. A restored user with no line gets one at
the next host sync.

A host sync or host enroll writes last_sync and facts into each
host record on every run. The comparison that decides whether the state
equals the newest snapshot now ignores both and compares the provisioner
entry only, so a sync no longer makes the next command take a snapshot.
The snapshot that a restore takes first still compares everything, so its
undo puts the records back as they were.

Several hosts at once

tacctl host sync <name>... syncs the hosts named, in the order typed, as
--all would. Every name is checked before the first host is touched: an
unknown name or a host with a break-glass hold among them refuses the whole
run, and names together with --all are a usage error. A host that fails
does not stop the others and the exit status is 1.

tacctl host check <name>... | --all [--json] is the read-only comparison
of host show <name> --check for several hosts: one result each (as tacctl would make it, its differences with the command that fixes each,
skipped for a held host, or could not be checked), a count by state, and
exit status 1 when a host differs or could not be checked. --json prints
an array. It is the superuser's and changes nothing here or on any host.

config validate

config validate --json prints one object: valid, errors, warnings,
mode, counts, backends and findings, each finding with a section,
a level, its text, the fix that puts it right and, where they apply,
backend or hosts. Nothing else goes to standard output and the exit
status is the text report's. The verb stays the operator's: the sudoers rule
gains the exact config validate --json row. An option other than --json
is now a usage error.

config validate --fix-names [-y] follows the report with one question for
each device, host, user and scope that has upper case in its name
(Rename user 'Alice' to 'alice'? [y/N]:). Each rename is the existing verb
with its own snapshot, so each can be undone separately. A name whose
lower-case spelling is taken is not offered and its line names the verb that
picks another name. It is the superuser's and needs the store.

Smaller changes

• The client script's UID check no longer says Nothing was changed. when
  an account was renamed earlier in the same run, and the line for a renamed
  account shows the account's own UID.
• host list counts the Names: findings about hosts in its footer, and
  host list --json lists them under findings.
• device config apply --hold takes an answer typed before the first
  question as that device's answer, and an answer after a device's window
  is dropped instead of given to the next device. This also closes an
  occasional wrong rollback when the review's answer and the hold's were
  typed together.

Upgrading from 0.2.14

Upgrade with sudo tacctl upgrade as always; a second run changes nothing.
The upgrade rewrites the operator sudoers drop-in for config validate --json. Nothing is written to a device and no file is converted. The
client script is the one host sync sends, so each host has the new wording
from its next sync.

Known limits

• host enroll checks the device name before its script runs on the host,
  which can take minutes, and does not check again: a host and a device can
  still end up with one name that way. config validate reports it.
• The configuration the backends render still reads (device <name>) in a
  comment for a held host.
• Until every host has synced a user rename, do not give the old name to a
  new user: that host's UID check refuses the sync.
• The ledger has no lock of its own: a host sync that reads it at the
  moment of a rename sees the file before or after it.

Rolling back

No state format changed. tacctl upgrade --branch 0.2.14 installs 0.2.14 over it; the operator sudoers drop-in keeps
its extra config validate --json row, which sudo accepts, until the next
tacctl upgrade rewrites it. tacctl rollback to 0.2.3 recognises the
0.2.15 and 0.2.14 texts of the drop-in as tacctl's own.

tacctl 0.2.14

tacctl 0.2.14

0.2.14 is about enrolled Linux hosts and the names things are given. A
break-glass hold follows its device when the address changes and can be put
on a host; a host can be renamed and forgotten without ssh; a snapshot holds
the host state; new names are lower case; and user rename keeps the user's
Linux UID. There is no new setting and no new way of writing to a device.
The numbered list in CHANGELOG.md (0.2.14, items 1 to 10) is everything
that differs from 0.2.13.

Break-glass holds

device address on a held device used to be refused until the hold was
released, and releasing answered the old address again. It now moves the
hold. The new address must pass what a new hold passes (not a loopback
address, not one a listener binds, not an enrolled host's address, not held
by another record, covered by a scope), and one line names both addresses
and asks to confirm (-y skips it). The registry and the record are
written together, rendered once, and each backend whose file changed is
restarted once. A refused address changes nothing; a restart that fails is
reported as NOT restarted and the verb exits 1, with both on the new
address.

tacctl breakglass hold|release|list now name hosts and devices alike, with
the same record and the same carve-out: the server answers no login and no
sudo check for the host's address, while the host's local administrator and
its console keep working. A host is held by its name. The verbs that log in
to the host (host sync, host show --check, host target, host provisioner rotate, host unenroll, and enrolling a registered host) refuse
for a held host and attempt nothing; host sync --all skips it. host list
and host show mark a held host, and engineers see the holds of the hosts in
their own scopes. A name that is both a host and a device is refused as
ambiguous.

Host names, host rename and host forget

A new host name follows the device rules: no tacctl word (all, scope,
local), no generic name, and no name equal to an enrolled host or a
registered device in any case. A refusal changes nothing and attempts
nothing over ssh. A missing option value in host enroll is a usage error
that names the option instead of a silent exit 1. Two enrolments of one name
started together can no longer both be written.

tacctl host rename <old> <new> is the superuser's and local: nothing is
sent to the host, so a held host may be renamed. After a snapshot it renames
the registry line, the pinned keys, address and history, the record, the
staging addresses, the hold and the host-key scan result. What an earlier
host of the new name left behind is listed and replaced after a confirmation.
When the host's scope is linux-<old> and no other host uses it, the command
offers to rename the scope too; --yes answers both questions.

tacctl host forget <name> drops this server's record of a host (registry
line, pins, record, staging addresses, scan result) after a snapshot, with no
ssh; the host itself is not touched. host unenroll now drops the staging
addresses too. config validate and host list report two names equal
ignoring case, a host named like a device, two hosts at one address and
port, and a pin, record or staging entry no registry line has, each with the
verb that repairs it.

host list --json prints the hosts as an array (name, target, port, scope,
server, method, address, users, drift, hold, findings), the table has an
ADDRESS column, and host show says no record under this name for a host
with no record. The engineer sudoers rule gains host list --json.

Snapshots hold the host state

A snapshot now also holds linux-hosts, hosts/, staging and
linux-uids. linux-hosts is in every snapshot, empty when there is no
registry, so the first snapshot after the upgrade is taken once even when
nothing else changed. host enroll, host move (one snapshot for --all)
and host unenroll take a snapshot just before the registry changes.

backup restore of a snapshot that knows the hosts puts the four back under
the apply lock; the snapshot it takes first holds the live files, so the
restore can be undone. No host is touched. Before the question and after the
restore a note names the hosts that come back, go or are registered
differently, and every user whose UID the restored ledger drops or changes,
since a host may already hold that number. A snapshot of 0.2.13 or older
leaves the host files alone, and backup diff says so.

Lower-case names

device add|rename, host enroll|rename, user add|rename and scope add|rename refuse a name with an upper-case letter. Names that exist with
upper case keep working as they are: nothing is migrated, and a rename to the
lower-case spelling is how one is fixed. config validate lists each in a
Names: warning with the verb that renames it. device import, a CSV and
store import load such names as they are and say how many. The name
derived from a target's host name is lowercased silently.

user rename keeps the UID

The ledger line of the old name becomes the new name's, in place, inside the
apply lock after the snapshot. At the next host sync the client script
renames the account on each host (usermod -l: the login name only, the home
keeps its path) instead of removing it and creating another. This holds for
a host that was offline or a user renamed twice, for a host on an earlier UID
range, and for a disabled user or one kept without a login. A user who is
logged in defers the rename to the next sync. A new name that already has a
UID keeps it and a warning says the old account is removed. The script
protocol stays 6; a script written by an earlier release with config linux script has no rename and stops at the UID check until it is written again.

Host verbs

host enroll, host move, host rename and host forget take -y as well
as --yes, and their questions have the shape of the device questions.

Upgrading from 0.2.13

Upgrade with sudo tacctl upgrade as always; a second run changes nothing.
The upgrade rewrites the engineer sudoers drop-in for host list --json.
Nothing is written to a device and no file is converted. The client script
that renames accounts is the one host sync sends, so each host has it from
its next sync.

Known limits

• host enroll checks the device name before its script runs on the host,
  which can take minutes, and does not check again: a host and a device can
  still end up with one name that way. config validate reports it.
• backup restore does not wait for a running host provisioner rotate.
• The configuration the backends render still reads (device <name>) in a
  comment for a held host.
• Until every host has synced a user rename, do not give the old name to a
  new user: that host's UID check refuses the sync.
• The ledger has no lock of its own: a host sync that reads it at the
  moment of a rename sees the file before or after it.

Rolling back

No state format changed: 0.2.13 ignores the new snapshot entries.
tacctl upgrade --branch 0.2.13 installs 0.2.13 over it and recognises the
new sudoers drop-in as tacctl's own. Release any hold on a host first (tacctl breakglass release <host>); 0.2.13 treats such a record as an orphan.