edge-control: per-caller attribution for register/deregister #1094

New issue

Closed

opened 2026-04-20 18:46:25 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-20 18:46:25 +00:00

Collaborator

Mirrored from johba/disinto#835

---## Problem

tools/edge-control/register.sh does not know which admin invoked it. When install.sh:363 seeds the forced-command entry, every key in disinto-register's authorized_keys invokes register.sh with the same (empty) identity.

Consequences when more than one admin key exists:

Registry entries record registered_at but no registered_by.
Audit reconstruction after a bad register/deregister requires matching timestamps against SSH login logs.
No way to show list output scoped by caller.

Proposal

Each admin key in disinto-register/.ssh/authorized_keys gets a distinct forced-command tag:

restrict,command="/opt/disinto-edge/register.sh --as alice" ssh-ed25519 AAAA... alice@laptop

register.sh parses --as <tag> and stores it in the registry as registered_by.
list output includes registered_by.
install.sh takes a --admin-tag <name> flag for the initial seeded key; defaults to admin.

Acceptance

Registry entries include registered_by.
list output shows the tag.
Missing --as is allowed (defaults to "unknown") so existing deployments keep working.

_Mirrored from [johba/disinto#835](https://codeberg.org/johba/disinto/issues/835)_ ---## Problem `tools/edge-control/register.sh` does not know which admin invoked it. When `install.sh:363` seeds the forced-command entry, every key in `disinto-register`'s `authorized_keys` invokes `register.sh` with the same (empty) identity. Consequences when more than one admin key exists: - Registry entries record `registered_at` but no `registered_by`. - Audit reconstruction after a bad register/deregister requires matching timestamps against SSH login logs. - No way to show `list` output scoped by caller. ## Proposal - Each admin key in `disinto-register/.ssh/authorized_keys` gets a distinct forced-command tag: ``` restrict,command="/opt/disinto-edge/register.sh --as alice" ssh-ed25519 AAAA... alice@laptop ``` - `register.sh` parses `--as <tag>` and stores it in the registry as `registered_by`. - `list` output includes `registered_by`. - `install.sh` takes a `--admin-tag <name>` flag for the initial seeded key; defaults to `admin`. ## Acceptance - Registry entries include `registered_by`. - `list` output shows the tag. - Missing `--as` is allowed (defaults to `"unknown"`) so existing deployments keep working.