blob: 070fb0760cc69c0326a0f99534875cf8a1937c31 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
#!/usr/bin/env bash
set -euo pipefail
# ================= CONFIG =================
WG_CON="wg-sanctum"
SERVER_WG_IP="10.50.0.1"
SERVER_USER="lukasz"
SSH_PORT="57385"
SSH_KEY="$HOME/.ssh/sacrum.key"
# ================= HELPERS =================
log() { printf "\n==> %s\n" "$*"; }
die() { printf "\nERROR: %s\n" "$*" >&2; exit 1; }
# ================= 1) RESTART WG =================
log "Restarting WireGuard connection: $WG_CON"
nmcli -t -f NAME con show | grep -Fxq "$WG_CON" \
|| die "NetworkManager connection '$WG_CON' not found"
nmcli con down "$WG_CON" >/dev/null 2>&1 || true
nmcli con up "$WG_CON" >/dev/null
sleep 2
log "WireGuard status (host)"
sudo wg show "$WG_CON" || die "wg show failed"
# ================= 2) TEST WG =================
log "Testing WG reachability to server ($SERVER_WG_IP)"
if ! ping -c 2 -W 2 "$SERVER_WG_IP" >/dev/null; then
die "WG ping failed (likely VPN/killswitch or routing issue)"
fi
log "WG ping OK"
# ================= 3) FIX SSH ON SERVER =================
log "Fixing SSH permissions on server (interactive, safe)"
ssh -tt -i "$SSH_KEY" -p "$SSH_PORT" \
-o IdentitiesOnly=yes \
"$SERVER_USER@$SERVER_WG_IP" \
"set -e;
USER_NAME='lukasz';
HOME_DIR=\"/home/\$USER_NAME\";
SSH_DIR=\"\$HOME_DIR/.ssh\";
AUTH_KEYS=\"\$SSH_DIR/authorized_keys\";
echo '-> Enforcing SSH directory invariants';
sudo mkdir -p \"\$SSH_DIR\";
sudo chown -R \"\$USER_NAME:\$USER_NAME\" \"\$SSH_DIR\";
sudo chmod 700 \"\$SSH_DIR\";
if [ -f \"\$AUTH_KEYS\" ]; then
sudo chown \"\$USER_NAME:\$USER_NAME\" \"\$AUTH_KEYS\";
sudo chmod 600 \"\$AUTH_KEYS\";
fi;
echo '-> Restarting sshd';
sudo systemctl restart ssh;
"
# ================= 4) FINAL VERIFICATION =================
log "Final SSH verification over WireGuard"
ssh -i "$SSH_KEY" -p "$SSH_PORT" \
-o IdentitiesOnly=yes \
"$SERVER_USER@$SERVER_WG_IP" \
'echo "SSH OK via WireGuard"'
log "ALL FIXES APPLIED SUCCESSFULLY"
|
