Files
explorer-monorepo/scripts/check-besu-logs-with-password.sh

130 lines
5.7 KiB
Bash
Raw Normal View History

#!/usr/bin/env bash
# Check Besu Logs on RPC Node with Password Authentication
# Updated to use password for SSH access
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
RPC_IP="${1:-192.168.11.250}"
RPC_VMID="${2:-2500}"
LOG_LINES="${3:-200}"
fix(security): fail-fast on missing JWT_SECRET, harden CSP, strip hardcoded passwords backend/api/rest/server.go: - NewServer() now delegates to loadJWTSecret(), which: - Rejects JWT_SECRET < 32 bytes (log.Fatal). - Requires JWT_SECRET when APP_ENV=production or GO_ENV=production. - Generates a 32-byte crypto/rand ephemeral secret in dev only. - Treats rand.Read failure as fatal (removes the prior time-based fallback that was deterministic and forgeable). - Default Content-Security-Policy rewritten: - Drops 'unsafe-inline' and 'unsafe-eval'. - Drops private CIDRs (192.168.11.221:854[5|6]). - Adds frame-ancestors 'none', base-uri 'self', form-action 'self'. - CSP_HEADER is required in production; fatal if unset there. backend/api/rest/server_security_test.go (new): - Covers the three loadJWTSecret() paths (valid, whitespace-trimmed, ephemeral in dev). - Covers isProductionEnv() across APP_ENV / GO_ENV combinations. - Asserts defaultDevCSP contains no unsafe directives or private CIDRs and includes the frame-ancestors / base-uri / form-action directives. scripts/*.sh: - Removed '***REDACTED-LEGACY-PW***' default value from SSH_PASSWORD / NEW_PASSWORD in 7 helper scripts. Each script now fails with exit 2 and points to docs/SECURITY.md if the password isn't supplied via env or argv. EXECUTE_DEPLOYMENT.sh, EXECUTE_NOW.sh: - Replaced hardcoded DB_PASSWORD='***REDACTED-LEGACY-PW***' with a ':?' guard that aborts with a clear error if DB_PASSWORD (and, for EXECUTE_DEPLOYMENT, RPC_URL) is not exported. Other env vars keep sensible non-secret defaults via ${VAR:-default}. README.md: - Removed the hardcoded Database Password / RPC URL lines. Replaced with an env-variable reference table pointing at docs/SECURITY.md and docs/DATABASE_CONNECTION_GUIDE.md. docs/DEPLOYMENT.md: - Replaced 'PASSWORD: SSH password (default: ***REDACTED-LEGACY-PW***)' with a required-no-default contract and a link to docs/SECURITY.md. docs/SECURITY.md (new): - Full secret inventory keyed to the env variable name and the file that consumes it. - Five-step rotation checklist covering the Postgres role, the Proxmox VM SSH password, JWT_SECRET, vendor API keys, and a gitleaks-based history audit. - Explicit note that merging secret-scrub PRs does NOT invalidate already-leaked credentials; rotation is the operator's responsibility. Verification: - go build ./... + go vet ./... pass clean. - Targeted tests (LoadJWTSecret*, IsProduction*, DefaultDevCSP*) pass. Advances completion criterion 2 (Secrets & config hardened). Residual leakage from START_HERE.md / LETSENCRYPT_CONFIGURATION_GUIDE.md is handled by PR #2 (doc consolidation), which deletes those files.
2026-04-18 19:02:27 +00:00
SSH_PASSWORD="${SSH_PASSWORD:-${4:-}}"
if [ -z "${SSH_PASSWORD}" ]; then
echo "ERROR: SSH_PASSWORD is required. Pass it as an argument or export SSH_PASSWORD in the environment." >&2
echo " Hardcoded default removed for security; see docs/SECURITY.md." >&2
exit 2
fi
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ CHECKING BESU LOGS ON RPC NODE (WITH PASSWORD) ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
echo "RPC IP: $RPC_IP"
echo "VMID: $RPC_VMID"
echo "Log Lines: $LOG_LINES"
echo ""
# Check if sshpass is available
if ! command -v sshpass >/dev/null 2>&1; then
echo "⚠️ sshpass not installed. Installing..."
sudo apt-get update -qq && sudo apt-get install -y sshpass 2>/dev/null || {
echo "❌ Cannot install sshpass automatically"
echo "Please install manually: sudo apt-get install sshpass"
echo "Or use manual SSH: ssh root@$RPC_IP"
exit 1
}
fi
# Method 1: SSH with password
echo "═══════════════════════════════════════════════════════════════"
echo "Method 1: SSH Access with Password"
echo "═══════════════════════════════════════════════════════════════"
echo ""
echo "Attempting SSH connection..."
SSH_OUTPUT=$(sshpass -p "$SSH_PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 \
root@"$RPC_IP" \
"journalctl -u besu-rpc -n $LOG_LINES --no-pager 2>/dev/null || \
journalctl -u besu -n $LOG_LINES --no-pager 2>/dev/null || \
journalctl -u hyperledger-besu -n $LOG_LINES --no-pager 2>/dev/null || \
echo 'NO_LOGS_FOUND'" 2>&1)
if echo "$SSH_OUTPUT" | grep -q "NO_LOGS_FOUND"; then
echo " ⚠️ SSH successful but no Besu logs found"
echo " Checking for alternative service names..."
# Try to find Besu service
SERVICE_LIST=$(sshpass -p "$SSH_PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 \
root@"$RPC_IP" \
"systemctl list-units --type=service --no-pager | grep -i besu || echo 'NO_BESU_SERVICE'" 2>&1)
echo "$SERVICE_LIST"
elif echo "$SSH_OUTPUT" | grep -q "Permission denied\|Connection refused\|Connection timed out"; then
echo " ❌ SSH failed: $(echo "$SSH_OUTPUT" | head -1)"
echo ""
echo " Troubleshooting:"
echo " 1. Verify password is correct"
echo " 2. Check if SSH is enabled on container"
echo " 3. Verify network connectivity"
echo " 4. Try setting password: pct set $RPC_VMID --password \"$SSH_PASSWORD\""
elif [ -n "$SSH_OUTPUT" ]; then
echo " ✅ Retrieved logs via SSH:"
echo ""
echo "$SSH_OUTPUT" | head -100
echo ""
# Search for transaction-related errors
echo " Searching for transaction-related errors..."
echo "$SSH_OUTPUT" | grep -iE "transaction|reject|invalid|revert|gas|deploy|create|contract" | tail -20 || echo " No transaction errors found"
echo ""
fi
# Method 2: Check for Docker containers
echo "═══════════════════════════════════════════════════════════════"
echo "Method 2: Docker Container Logs"
echo "═══════════════════════════════════════════════════════════════"
echo ""
DOCKER_PS=$(sshpass -p "$SSH_PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 \
root@"$RPC_IP" \
"docker ps -a 2>/dev/null | grep -i besu || echo 'NO_DOCKER'" 2>&1)
if echo "$DOCKER_PS" | grep -qv "NO_DOCKER"; then
echo " Found Docker containers:"
echo "$DOCKER_PS"
echo ""
echo " Retrieving logs..."
sshpass -p "$SSH_PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 \
root@"$RPC_IP" \
"docker ps -a --format '{{.Names}}' 2>/dev/null | grep -i besu | while read container; do \
echo \"--- Container: \$container ---\"; \
docker logs \"\$container\" --tail $LOG_LINES 2>/dev/null | head -100; \
echo \"\"; \
done" 2>&1 || echo " ⚠️ Could not retrieve Docker logs"
else
echo " ⚠️ No Docker containers found"
fi
echo ""
# Summary
echo "═══════════════════════════════════════════════════════════════"
echo "Summary"
echo "═══════════════════════════════════════════════════════════════"
echo ""
echo "Password configured for VMID $RPC_VMID: $SSH_PASSWORD"
echo ""
echo "Manual access:"
echo " ssh root@$RPC_IP"
echo " Password: $SSH_PASSWORD"
echo ""
echo "Check logs manually:"
echo " ssh root@$RPC_IP 'journalctl -u besu-rpc -n $LOG_LINES'"
echo ""