Privatae
113 lines
6.5 KiB
Markdown
113 lines
6.5 KiB
Markdown
# M0 gate, Linux: the bastion on its own, on a fresh machine
|
|
|
|
Run 2026-10-31 on a fresh Ubuntu 24.04.5 virtual machine (qemu, user-mode
|
|
networking), with no Host anywhere. Two invented accounts: `tester`, who may
|
|
use sudo without a password, and `other`, who may not use sudo. The binary was
|
|
built from branch `m0/install-cli-docs` and served, with a manifest and a copy
|
|
of `deploy/install.sh` whose two download addresses point at that server, from
|
|
the machine running the VM. Nothing else in the installer was changed.
|
|
|
|
macOS and Windows have not been run yet.
|
|
|
|
| Gate step | Result |
|
|
|---|---|
|
|
| Install as a person, `curl … \| sh`, no sudo typed | Installed for the whole machine through sudo; systemd unit running as root; `tester` recorded as the owner |
|
|
| `status` from the owner's account | Says the bastion runs for the whole machine and points at `privatae-bastion ui` |
|
|
| `ui` from the owner's account | A one-use link; redeemed, it opens a limited session; a second use is refused |
|
|
| Limited session | Every page loads; pairing is refused with the administrator's command; Settings shows that command instead of the form |
|
|
| `ui` from `other` | Refused: the console opens without sudo only for the owner's account |
|
|
| Agents planted: a cron'd `aider`, `claude` in a terminal, a Python program keeping a TLS connection to api.anthropic.com | All listed: `aider` started by a scheduled job, Claude Code started from a terminal, the Python program as a model client talking to api.anthropic.com |
|
|
| Stop the cron'd `aider` from the console, from the owner's account, with the owner's code | Stopped; the cron shell and `aider` are gone; Activity says "You stopped aider"; the audit row is in the system log |
|
|
| `report` | One Markdown file: summary, agents running now, scheduled jobs, MCP tool servers, changes since the baseline, activity |
|
|
| Service log, grep host/lane/pair | No line waiting for or retrying a Host |
|
|
| `other` runs the installer | Refused: the machine's bastion is installed for the whole machine and updating it needs sudo; nothing installed |
|
|
| Reinstall by `tester` | Service restarted on the new program; the owner record kept |
|
|
| `sudo -H privatae-bastion uninstall` | Unit and program removed; state kept (owner record, owner's code, audit log, reports) |
|
|
|
|
Found and fixed during the run (commit e46bd57): `sudo -v` asked for a
|
|
password where the account's sudo rules were not all NOPASSWD, so the installer
|
|
fell back to an install for the account; an account without sudo beside the
|
|
machine's bastion got a second one that could not run; `uninstall` from that
|
|
account was refused.
|
|
|
|
The first test of the model client used a socket that never started TLS.
|
|
api.anthropic.com closed it, and the bastion, which counts open connections
|
|
only, did not list it. The second, which keeps a live connection, was listed.
|
|
|
|
## Transcript (abridged)
|
|
|
|
```
|
|
$ curl -fsSL http://10.0.2.2:8099/install.sh | sh
|
|
Installing the bastion for the whole machine, so that no program running as you, an AI agent included, can stop it or change what it allows.
|
|
sudo asks for your password once.
|
|
Fetching manifest...
|
|
Downloading privatae-bastion (linux-amd64)...
|
|
Checksum verified (…).
|
|
Installed: /usr/local/bin/privatae-bastion
|
|
this machine's owner account is tester: `privatae-bastion ui` opens the console from it.
|
|
Anything that stops an agent or widens access still takes the owner's code.
|
|
|
|
The bastion runs for the whole machine and starts at boot. It is watching the AI agents on this computer now; no Host is needed.
|
|
Open its console: privatae-bastion ui
|
|
Set up your code, to stop an agent or answer what agents ask (an authenticator app on your phone):
|
|
sudo -H privatae-bastion stepup-enroll --machine
|
|
Connect a Host, if you run one (optional): sudo -H privatae-bastion pair <token>
|
|
|
|
$ ps -o user=,args= -C privatae-bastion
|
|
root /usr/local/bin/privatae-bastion run
|
|
|
|
$ privatae-bastion status
|
|
error: this machine's bastion runs for the whole machine, as a system service.
|
|
Open its console from your own account: privatae-bastion ui
|
|
Its full status: sudo -H privatae-bastion status
|
|
|
|
$ privatae-bastion ui
|
|
opening the local UI: http://127.0.0.1:7877
|
|
could not open a browser (exec: "xdg-open": executable file not found in $PATH).
|
|
Paste this into one, within a minute:
|
|
http://127.0.0.1:7877/?k=…
|
|
|
|
redeem=303 GET /=200 /setup=200 /approvals=200 /activity=200 /machine=200
|
|
POST /setup/pair=403 From your own account the console does not do this: it widens what reaches this machine and takes no code. The machine's administrator does it: sudo -H privatae-bastion ui
|
|
reuse of the link=403
|
|
|
|
(other)$ privatae-bastion ui
|
|
error: this machine's console opens without sudo only for its owner's account (tester), not other
|
|
|
|
$ sudo -H privatae-bastion agents
|
|
aider: 2 sessions
|
|
aider in tester
|
|
in /home/tester · started 1m ago · started by a scheduled job · as tester · pid 2018
|
|
…
|
|
Claude Code: 1 session
|
|
Claude Code in tester
|
|
in /home/tester · started 1m ago · started from a terminal here · as tester · pid 1903
|
|
|
|
$ sudo -H privatae-bastion agents --json (the model client)
|
|
2220 llm-client evidence: model-traffic api.anthropic.com (verified), model-endpoint api.anthropic.com (verified)
|
|
|
|
POST /agent/stop pid=2018 with the owner's code → 200 "stopped aider (pid 2018) running on this machine."
|
|
$ ps -p 2017,2018 → process tree gone
|
|
$ sudo -H privatae-bastion activity
|
|
Oct 31 03:52 You stopped aider (pid 2018) running on this machine.
|
|
journal: privatae-bastion-audit: {"decision":"You stopped aider (pid 2018) running on this machine.","op":"local_stop",…}
|
|
|
|
$ sudo -H privatae-bastion report
|
|
report written to /root/.config/privatae-bastion/reports/report-2026-10-31-035215.md
|
|
# AI agents on m0-gate / ## Summary / ## Agents running now / ## Scheduled jobs that start an agent /
|
|
## MCP tool servers / ## Changes since the baseline / ## Activity
|
|
|
|
$ journalctl -u privatae-bastion | grep -iE 'host|lane|pair'
|
|
privatae-bastion: no Host connected: watching this machine on its own. Open the console with `privatae-bastion ui`.
|
|
(the rest are systemd's start lines)
|
|
|
|
(other)$ curl -fsSL http://10.0.2.2:8099/install.sh | sh
|
|
… ERROR: this machine's bastion is installed for the whole machine, and updating it needs an account that may use sudo, in a terminal. Nothing was installed.
|
|
|
|
$ sudo -H privatae-bastion uninstall
|
|
stopped the system service privatae-bastion
|
|
removed /usr/local/bin/privatae-bastion
|
|
Kept /root/.config/privatae-bastion: its pairings, keys and the audit log of what Hosts and agents did here.
|
|
The bastion is uninstalled.
|
|
```
|