homelab-runtime-publisher
35 lines
34 KiB
Plaintext
35 lines
34 KiB
Plaintext
CHAT_OUTPUT_BEGIN
|
||
COMMAND_ID=HOMELAB-CLUSTER-V41-DEEP-READ-ONLY-AUDIT-20260801T133800Z
|
||
STATUS=OK
|
||
RC=0
|
||
HOST=pve01
|
||
MODE=verify
|
||
COMPONENT=cluster-v41-deep-audit
|
||
REFERENCE_REGISTER_CHECK=OK
|
||
REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
|
||
ERROR_REGISTER_CHECK=OK
|
||
ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
|
||
COMMAND_SHA256=9c5a8f66e57cb536e745a0a2a6d4c119ae2d2999c6cc3501e4d54301af593a1c
|
||
DUPLICATE_FAILED_COMMAND_BLOCKED=false
|
||
EXECUTION_STARTED=true
|
||
CHANGE_DECLARED=false
|
||
RESULT_CONTRACT_VALID=true
|
||
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
|
||
RESULT_CONTRACT_ERROR=NONE
|
||
COMMAND_RC=0
|
||
CHANGES_MADE=false
|
||
ROLLBACK_STARTED=false
|
||
ROLLBACK_RESTORED=null
|
||
MUTATION_OUTCOME=NO_MUTATION
|
||
SANITIZED=yes
|
||
SECRETS_INCLUDED=no
|
||
PRIVATE_ADDRESSES_INCLUDED=no
|
||
RAW_EVIDENCE_SHA256=d49fd3bb9647ce96d93d464c343233389c01851d20838a4d26002905e5375d71
|
||
SANITIZED_OUTPUT_SHA256=d49fd3bb9647ce96d93d464c343233389c01851d20838a4d26002905e5375d71
|
||
OUTPUT_BEGIN
|
||
HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"HOMELAB-CLUSTER-V41-DEEP-READ-ONLY-AUDIT-20260801T133800Z","mutation_outcome":"NO_MUTATION","rollback_restored":null,"rollback_started":false,"status":"OK","version":1}
|
||
{"audit_duration_seconds":5.276,"audit_scope":"Proxmox cluster, quorum, nodes, services, storage, hardware, network, backups, updates, security, HA, replication, snapshots and operational opportunities","changes_made":false,"command_evidence":{"apt_simulated_upgrade":{"duration_seconds":0.63,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"b02fccf2fa828498c4dfac7a4782d7aa267403562556adf4dd37817509d758f8","stdout_truncated":false},"backup_jobs":{"duration_seconds":0.47,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"backup_tasks":{"duration_seconds":0.484,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"ceph_health":{"duration_seconds":0.061,"rc":1,"stderr_excerpt":"Error initializing cluster client: ObjectNotFound('RADOS object not found (error calling conf_read_file)')\n","stderr_sha256":"a1d1a278613accb53853259bb71b72122c0081638d7ddfc6ea9f285c35a7215a","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"cert_pve-ssl.pem":{"duration_seconds":0.009,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"4c235086a4bb6a1236bb4aa8452ad4d305e7dfb60c28aaaecc26f5f95a517412","stdout_truncated":false},"cert_pveproxy-ssl.pem":{"duration_seconds":0.007,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"9dc45fc6b61f546f5c245b6bcf9edb750cfab78bee8d5409d5eeec239e25774e","stdout_truncated":false},"cluster_status_json":{"duration_seconds":0.461,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"cluster_vm_resources":{"duration_seconds":0.465,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"df_bytes":{"duration_seconds":0.002,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"ba1da7808b520fd2df6c39cbaed602478d720f24f99593d9734fa3dbaf9de41d","stdout_truncated":false},"df_inodes":{"duration_seconds":0.002,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"117ca038e58b074a4b95985e565690167f4c3624c5e516bffff3a2e47cbde774","stdout_truncated":false},"ha_resources":{"duration_seconds":0.461,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"hostname":{"duration_seconds":0.001,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"b8c2ce290546573a7b09b9530a83f59c3a9a00358f5094732037a9f65bcaf430","stdout_truncated":false},"kernel":{"duration_seconds":0.001,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"01d9618db76138f152b53aa07f44596797fb50fb620be502b3b876ef2b0be471","stdout_truncated":false},"kernel_errors_7d":{"duration_seconds":0.047,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"9709c8d8ac498ddfbb16b1c343286ba6b569330752aec01c8d9cedd05366497d","stdout_truncated":false},"lvs_json":{"duration_seconds":0.023,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"8359fa3d3a5e91d59ae93ad34eb3028503d0a2ffa7354d8859687091eb11d196","stdout_truncated":false},"nodes_json":{"duration_seconds":0.459,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"pve_firewall_status":{"duration_seconds":0.352,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"pvecm_status":{"duration_seconds":0.155,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"pvesm_status_json":{"duration_seconds":0.232,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"pveversion":{"duration_seconds":0.36,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"19ba1ac5d9e5ee6299326b5ad7d5b334a03b23b84a97f3cbdf0f1cf7748d1c0a","stdout_truncated":false},"replication_jobs":{"duration_seconds":0.472,"rc":255,"stderr_excerpt":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","stderr_sha256":"7f7c6a4e34d689a6246e2dda50729abf93fb15fdc56cc971b1690257d4e0d228","stderr_truncated":false,"stdout_excerpt":"","stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false},"service_corosync":{"duration_seconds":0.005,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"45df5ad5e0ecfa54d3226343e0e6857337494ba6e32f189d1174070665d8c659","stdout_truncated":false},"service_pve-cluster":{"duration_seconds":0.005,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"45df5ad5e0ecfa54d3226343e0e6857337494ba6e32f189d1174070665d8c659","stdout_truncated":false},"service_pvedaemon":{"duration_seconds":0.005,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"45df5ad5e0ecfa54d3226343e0e6857337494ba6e32f189d1174070665d8c659","stdout_truncated":false},"service_pveproxy":{"duration_seconds":0.004,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"45df5ad5e0ecfa54d3226343e0e6857337494ba6e32f189d1174070665d8c659","stdout_truncated":false},"service_pvescheduler":{"duration_seconds":0.005,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"45df5ad5e0ecfa54d3226343e0e6857337494ba6e32f189d1174070665d8c659","stdout_truncated":false},"service_pvestatd":{"duration_seconds":0.005,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"45df5ad5e0ecfa54d3226343e0e6857337494ba6e32f189d1174070665d8c659","stdout_truncated":false},"smart_health_0":{"duration_seconds":0.011,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"79f3a260dd24b7352210206ed0dc7638c3dd9f1fa0088837e310d165a015443a","stdout_truncated":false},"smart_scan":{"duration_seconds":0.008,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"bdd9c6262f7084200be70fe4f114937b73ddc9363d2b17a898cc6de810c61aeb","stdout_truncated":false},"sshd_effective":{"duration_seconds":0.007,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"ca13aa430aaba12409bf273bc3dbe7cc2d9931c09ba7b7bd6b1ae70f6550045c","stdout_truncated":false},"systemd_failed":{"duration_seconds":0.005,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"2be7fca65a60c1f3a022fc247aaf5c671cfdeb503d685daaac1eff64762bc8b0","stdout_truncated":false},"timedatectl":{"duration_seconds":0.044,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"6c8cfc6ad7c28c39c61897e34c7a41b21557a5b889a89fbf0f43fd4e68bba179","stdout_truncated":false},"uptime":{"duration_seconds":0.006,"rc":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderr_truncated":false,"stdout_sha256":"2650c732006dcd407933672c01c5f9a558c2a3ca4002b4deae3daf8be3548b64","stdout_truncated":false},"zpool_status":{"duration_seconds":0.006,"rc":0,"stderr_sha256":"7963e46dc311bf4242deae5ec473af64749b3e1e2b004c6c001defc4ae2621ac","stderr_truncated":false,"stdout_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_truncated":false}},"command_id":"HOMELAB-CLUSTER-V41-DEEP-READ-ONLY-AUDIT-20260801T133800Z","control_plane_error":null,"fatal_errors":[],"findings":[{"action":"Восстановить доступность pmxcfs/corosync и повторить проверку.","category":"cluster","evidence":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","severity":"CRITICAL","task_id":"CLUSTER-QUORUM-CHECK","title":"Не удалось проверить quorum Proxmox-кластера"},{"action":"Разобрать degraded/faulted devices и восстановить redundancy.","category":"storage","evidence":"no pools available\n","severity":"CRITICAL","task_id":"ZFS-UNHEALTHY","title":"ZFS pool не подтверждён как healthy"},{"action":"Отключить password auth после проверки ключевого доступа и аварийного канала.","category":"security","evidence":{"maxauthtries":"6","passwordauthentication":"yes","permitrootlogin":"yes","pubkeyauthentication":"yes"},"severity":"HIGH","task_id":"SSH-PASSWORD-AUTH","title":"SSH password authentication включена"},{"action":"Разобрать первичную ошибку unit и устранить её.","category":"services","evidence":{"active":"failed","description":"Generate unified homelab backup matrix state","load":"loaded","sub":"failed","unit":"homelab-backup-matrix-refresh.service"},"severity":"HIGH","task_id":"FAILED-UNIT-homelab-backup-matrix-refresh.service","title":"Systemd unit failed: homelab-backup-matrix-refresh.service"},{"action":"Разобрать первичную ошибку unit и устранить её.","category":"services","evidence":{"active":"failed","description":"Crypto portfolio chart health check","load":"loaded","sub":"failed","unit":"homelab-crypto-portfolio-chart-health.service"},"severity":"HIGH","task_id":"FAILED-UNIT-homelab-crypto-portfolio-chart-health.service","title":"Systemd unit failed: homelab-crypto-portfolio-chart-health.service"},{"action":"Разобрать первичную ошибку unit и устранить её.","category":"services","evidence":{"active":"failed","description":"Skladchik reports monitor full supervisor","load":"loaded","sub":"failed","unit":"skladchik-reports-monitor-supervisor.service"},"severity":"HIGH","task_id":"FAILED-UNIT-skladchik-reports-monitor-supervisor.service","title":"Systemd unit failed: skladchik-reports-monitor-supervisor.service"},{"action":"Сформировать окно обновления с backup, проверкой release notes и reboot plan.","category":"updates","evidence":{"packages":["base-files","libexpat1","postfix","python3.13","libpython3.13-stdlib","python3.13-minimal","libpython3.13-minimal","liblzma5","rsync","shim-signed-common","shim-unsigned","shim-helpers-amd64-signed","shim-signed","dhcpcd-base","libxml2","bind9-host","bind9-dnsutils","bind9-libs","xz-utils","chrony","libcorosync-common4","libcfg7","libcmap4","libcpg4","libnss3","libknet1t64","libnozzle1t64","libquorum5","libvotequorum8","corosync","libssh2-1t64","curl","libcurl4t64","gpgsm","dirmngr","gpg","gpgconf","gpg-agent","libbytes-random-secure-perl","libcurl3t64-gnutls","libgbm1","mesa-libgallium","libgraphite2-3","libhtml-parser-perl","libtalloc2","libtevent0t64","libsmbclient0","samba-common","smbclient","libtdb1","libldb2","samba-libs","libwbclient0","libnvpair3linux","libproxmox-acme-plugins","libxml-libxml-perl","proxmox-backup-client","proxmox-backup-file-restore","libpve-storage-perl","libproxmox-acme-perl","libpve-common-perl","libpve-guest-common-perl","libslirp0","pve-qemu-kvm","pve-container","qemu-server","pve-ha-manager","novnc-pve","proxmox-enterprise-support-keyring","proxmox-mini-journalreader","proxmox-widget-toolkit","pve-docs","pve-i18n","pve-xtermjs","pve-manager","libpve-network-api-perl","libpve-network-perl","pve-firewall","libtasn1-6","libuutil3linux","libzfs7linux","libzpool7linux","netbird","pve-firmware","pve-yew-mobile-i18n","python3-idna","python3-markdown","python3-urllib3","python3.13-tk","zfs-initramfs","zfsutils-linux","zfs-zed"],"simulation_sha256":"b02fccf2fa828498c4dfac7a4782d7aa267403562556adf4dd37817509d758f8"},"severity":"HIGH","task_id":"UPDATES-PENDING","title":"Доступны обновления пакетов: 92"},{"action":"Сравнить рост счётчиков за интервал и проверить физический/очередной уровень.","category":"network","evidence":{"interface":"wt0","mtu":1280,"operstate":"unknown","rx_dropped":0,"rx_errors":0,"tx_dropped":1,"tx_errors":2},"severity":"MEDIUM","task_id":"NET-DROPS-wt0","title":"Есть сетевые ошибки/дропы на wt0"},{"action":"Проверить, где обеспечивается фильтрация management и guest traffic; включить host firewall при отсутствии внешней защиты.","category":"security","evidence":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","severity":"MEDIUM","task_id":"FIREWALL-STATE","title":"Proxmox firewall не подтверждён как enabled/running"},{"action":"Ограничить root login по management-сети/ключам или перейти на отдельного администратора + sudo.","category":"security","evidence":{"maxauthtries":"6","passwordauthentication":"yes","permitrootlogin":"yes","pubkeyauthentication":"yes"},"severity":"MEDIUM","task_id":"SSH-ROOT-LOGIN","title":"Разрешён прямой SSH-доступ root"},{"action":"Собрать Proxmox, SMART, ZFS/Ceph, backup age, certificate expiry, UPS и network errors в Prometheus/Grafana с алертами.","category":"observability","evidence":{},"severity":"OPPORTUNITY","task_id":"CLUSTER-OBSERVABILITY","title":"Создать единый SLO-мониторинг кластера"},{"action":"Документировать порядок: потеря узла, storage, quorum, сети, сертификата, backup restore и доступ без control plane.","category":"operations","evidence":{},"severity":"OPPORTUNITY","task_id":"DISASTER-RUNBOOK","title":"Зафиксировать runbook аварийного восстановления"},{"action":"Интегрировать NUT/UPS, выполнить тест отключения питания и проверить порядок остановки VM/storage/узлов.","category":"power","evidence":{},"severity":"OPPORTUNITY","task_id":"UPS-DRILL","title":"Проверить UPS и автоматическое завершение работы"},{"action":"Проверить MFA/ACL Proxmox, сервисные токены, SSH keys, ротацию секретов и отдельные break-glass учётные записи.","category":"security","evidence":{"sshd":{"maxauthtries":"6","passwordauthentication":"yes","permitrootlogin":"yes","pubkeyauthentication":"yes"}},"severity":"OPPORTUNITY","task_id":"ACCESS-REVIEW","title":"Провести аудит доступа и секретов"}],"gitea_changed":false,"mutation_outcome":"NO_MUTATION","production_site_changed":false,"rc":0,"rollback_restored":null,"rollback_started":false,"schema":1,"sections":{"backups":{"backup_storages":[],"failed_recent":[],"guest_backup_state":[],"inventory_count":0,"jobs":[],"recent_tasks":[]},"capacity":{"guests":[],"memory_overcommit":[],"nodes":[]},"cluster_nodes":[],"cluster_quorum":{"parsed":{},"raw_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},"hardware":{"cpu_count":24,"kernel_critical_pattern_count_7d":0,"kernel_priority_0_3_count_7d":9,"load_15_per_cpu":0.02,"load_1_5_15":[0.41,0.4,0.42],"memory_available":8871043072,"memory_available_percent":26.58,"memory_total":33379028992,"smart_health":[{"device":"/dev/nvme0","output_sha256":"5c389122381ffa3697b8d4044b9b478189d78f0126ba7a948e07154955dd4105","passed":true,"rc":0,"unknown":false}],"swap_total":10737414144,"swap_used_percent":0.0,"temperatures":[{"celsius":27.8,"sensor":"acpitz"},{"celsius":41.0,"sensor":"x86_pkg_temp"}]},"identity":{"audit_utc":"2026-08-01T13:48:52.070106+00:00","hostname":"pve01.gram1.ru","kernel":"Linux pve01 7.0.12-1-pve #1 SMP PREEMPT_DYNAMIC PMX 7.0.12-1 (2026-06-09T21:07Z) x86_64 GNU/Linux","pveversion":"proxmox-ve: 9.2.0 (running kernel: 7.0.12-1-pve)\npve-manager: 9.2.3 (running version: 9.2.3/d0fde103346cf89a)\nproxmox-kernel-helper: 9.2.0\nproxmox-kernel-7.0: 7.0.12-1\nproxmox-kernel-7.0.12-1-pve-signed: 7.0.12-1\nproxmox-kernel-7.0.6-2-pve-signed: 7.0.6-2\nproxmox-kernel-7.0.2-6-pve-signed: 7.0.2-6\nceph-fuse: 19.2.3-pve4\ncorosync: 3.1.10-pve2\ncriu: 4.1.1-1\nfrr-pythontools: 10.6.1-1+pve2\nifupdown2: 3.3.0-1+pmx12\nintel-microcode: 3.20251111.1~deb13u1\nksm-control-daemon: 1.5-1\nlibjs-extjs: 7.0.0-5\nlibproxmox-acme-perl: 1.7.1\nlibproxmox-backup-qemu0: 2.0.2\nlibproxmox-rs-perl: 0.4.1\nlibpve-access-control: 9.1.1\nlibpve-apiclient-perl: 3.4.2\nlibpve-cluster-api-perl: 9.1.6\nlibpve-cluster-perl: 9.1.6\nlibpve-common-perl: 9.1.16\nlibpve-guest-common-perl: 6.0.4\nlibpve-http-server-perl: 6.0.5\nlibpve-network-perl: 1.6.6\nlibpve-notify-perl: 9.1.6\nlibpve-rs-perl: 0.15.3\nlibpve-storage-perl: 9.1.6\nlibspice-server1: 0.15.2-1+b1\nlvm2: 2.03.31-2+pmx1\nlxc-pve: 7.0.0-2\nlxcfs: 7.0.0-pve1\nnovnc-pve: 1.7.0-1\nproxmox-backup-client: 4.2.2-1\nproxmox-backup-file-restore: 4.2.2-1\nproxmox-backup-restore-image: 1.0.0\nproxmox-firewall: 1.2.3\nproxmox-kernel-helper: 9.2.0\nproxmox-mail-forward: 1.0.3\nproxmox-mini-journalreader: 1.6\nproxmox-offline-mirror-helper: 0.7.4\nproxmox-widget-toolkit: 5.2.5\npve-cluster: 9.1.6\npve-container: 6.1.10\npve-docs: 9.2.2\npve-edk2-firmware: 4.2025.05-2\npve-esxi-import-tools: 1.0.1\npve-firewall: 6.0.4\npve-firmware: 3.18-4\npve-ha-manager: 5.2.4\npve-i18n: 3.8.0\npve-qemu-kvm: 11.0.0-4\npve-xtermjs: 6.0.0-1\nqemu-server: 9.1.17\nsmartmontools: 7.5-pve2\nspiceterm: 3.4.2\nswtpm: 0.8.0+pve3\nvncterm: 1.9.2\nzfsutils-linux: 2.4.2-pve1","uptime":"up 4 days, 2 hours, 43 minutes"},"network":{"bonds":[],"interfaces":[{"interface":"bonding_masters","mtu":null,"operstate":"unknown","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"enx6c1ff7c17576","mtu":1500,"operstate":"down","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"nic0","mtu":1500,"operstate":"up","rx_dropped":11827,"rx_errors":0,"tx_dropped":6,"tx_errors":0},{"interface":"podman0","mtu":1500,"operstate":"up","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"tap150i0","mtu":1500,"operstate":"unknown","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"tap170i0","mtu":1500,"operstate":"unknown","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"tap171i0","mtu":1500,"operstate":"unknown","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"veth0","mtu":1500,"operstate":"up","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"veth110i0","mtu":1500,"operstate":"up","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"veth112i0","mtu":1500,"operstate":"up","rx_dropped":0,"rx_errors":0,"tx_dropped":0,"tx_errors":0},{"interface":"vmbr0","mtu":1500,"operstate":"up","rx_dropped":0,"rx_errors":0,"tx_dropped":9,"tx_errors":0},{"interface":"wt0","mtu":1280,"operstate":"unknown","rx_dropped":0,"rx_errors":0,"tx_dropped":1,"tx_errors":2}]},"resilience":{"ha_resources":[],"replication_jobs":[],"snapshots":[]},"security_updates":{"certificates":[{"days_remaining":680.7,"not_after":"2028-06-12T07:27:09+00:00","output_sha256":"4c235086a4bb6a1236bb4aa8452ad4d305e7dfb60c28aaaecc26f5f95a517412","path":"/etc/pve/local/pve-ssl.pem"},{"days_remaining":45.1,"not_after":"2026-09-15T16:01:38+00:00","output_sha256":"9dc45fc6b61f546f5c245b6bcf9edb750cfab78bee8d5409d5eeec239e25774e","path":"/etc/pve/local/pveproxy-ssl.pem"}],"firewall_status":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","reboot_required":false,"sshd":{"maxauthtries":"6","passwordauthentication":"yes","permitrootlogin":"yes","pubkeyauthentication":"yes"},"time":{"NTP":"yes","NTPSynchronized":"yes","Timezone":"Europe/Moscow"},"upgradable_count":92,"upgradable_packages":["base-files","libexpat1","postfix","python3.13","libpython3.13-stdlib","python3.13-minimal","libpython3.13-minimal","liblzma5","rsync","shim-signed-common","shim-unsigned","shim-helpers-amd64-signed","shim-signed","dhcpcd-base","libxml2","bind9-host","bind9-dnsutils","bind9-libs","xz-utils","chrony","libcorosync-common4","libcfg7","libcmap4","libcpg4","libnss3","libknet1t64","libnozzle1t64","libquorum5","libvotequorum8","corosync","libssh2-1t64","curl","libcurl4t64","gpgsm","dirmngr","gpg","gpgconf","gpg-agent","libbytes-random-secure-perl","libcurl3t64-gnutls","libgbm1","mesa-libgallium","libgraphite2-3","libhtml-parser-perl","libtalloc2","libtevent0t64","libsmbclient0","samba-common","smbclient","libtdb1","libldb2","samba-libs","libwbclient0","libnvpair3linux","libproxmox-acme-plugins","libxml-libxml-perl","proxmox-backup-client","proxmox-backup-file-restore","libpve-storage-perl","libproxmox-acme-perl","libpve-common-perl","libpve-guest-common-perl","libslirp0","pve-qemu-kvm","pve-container","qemu-server","pve-ha-manager","novnc-pve","proxmox-enterprise-support-keyring","proxmox-mini-journalreader","proxmox-widget-toolkit","pve-docs","pve-i18n","pve-xtermjs","pve-manager","libpve-network-api-perl","libpve-network-perl","pve-firewall","libtasn1-6","libuutil3linux","libzfs7linux","libzpool7linux","netbird","pve-firmware","pve-yew-mobile-i18n","python3-idna","python3-markdown","python3-urllib3","python3.13-tk","zfs-initramfs","zfsutils-linux","zfs-zed"]},"services":{"failed_units":[{"active":"failed","description":"Generate unified homelab backup matrix state","load":"loaded","sub":"failed","unit":"homelab-backup-matrix-refresh.service"},{"active":"failed","description":"Crypto portfolio chart health check","load":"loaded","sub":"failed","unit":"homelab-crypto-portfolio-chart-health.service"},{"active":"failed","description":"Skladchik reports monitor full supervisor","load":"loaded","sub":"failed","unit":"skladchik-reports-monitor-supervisor.service"}],"key_services":{"corosync":"active","pve-cluster":"active","pvedaemon":"active","pveproxy":"active","pvescheduler":"active","pvestatd":"active"}},"storage":{"ceph_health":null,"filesystems":[{"available":85349027840,"filesystem":"/dev/mapper/pve-root","inode_used_percent":3.0,"mount":"/","total":105089261568,"type":"ext4","used":14354747392,"used_percent":15.0},{"available":53818,"filesystem":"efivarfs","inode_used_percent":null,"mount":"/sys/firmware/efi/efivars","total":196608,"type":"efivarfs","used":137670,"used_percent":72.0},{"available":1062166528,"filesystem":"/dev/nvme0n1p2","inode_used_percent":null,"mount":"/boot/efi","total":1071628288,"type":"vfat","used":9461760,"used_percent":1.0},{"available":141639290880,"filesystem":"/dev/mapper/pve-homelab--staging","inode_used_percent":1.0,"mount":"/mnt/staging","total":315926315008,"type":"ext4","used":158164119552,"used_percent":53.0},{"available":132767744,"filesystem":"/dev/fuse","inode_used_percent":1.0,"mount":"/etc/pve","total":134217728,"type":"fuse","used":1449984,"used_percent":2.0},{"available":85349027840,"filesystem":"overlay","inode_used_percent":3.0,"mount":"/var/lib/containers/storage/overlay/c638354547700f5f06ca229429e8a557150144d8c21fb899d880f76665f74690/merged","total":105089261568,"type":"overlay","used":14354747392,"used_percent":15.0}],"lvm_report_present":true,"mdstat_sha256":"23b7359ec0388daf52cf07dfabc1ad1a9558e4ce801633a126f351b99028d8b8","pvesm":[],"zpool_summary":""}},"status":"OK","summary":{"critical_count":2,"critical_tasks":[{"action":"Восстановить доступность pmxcfs/corosync и повторить проверку.","category":"cluster","evidence":"ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n","severity":"CRITICAL","task_id":"CLUSTER-QUORUM-CHECK","title":"Не удалось проверить quorum Proxmox-кластера"},{"action":"Разобрать degraded/faulted devices и восстановить redundancy.","category":"storage","evidence":"no pools available\n","severity":"CRITICAL","task_id":"ZFS-UNHEALTHY","title":"ZFS pool не подтверждён как healthy"}],"high_count":5,"high_priority_tasks":[{"action":"Отключить password auth после проверки ключевого доступа и аварийного канала.","category":"security","evidence":{"maxauthtries":"6","passwordauthentication":"yes","permitrootlogin":"yes","pubkeyauthentication":"yes"},"severity":"HIGH","task_id":"SSH-PASSWORD-AUTH","title":"SSH password authentication включена"},{"action":"Разобрать первичную ошибку unit и устранить её.","category":"services","evidence":{"active":"failed","description":"Generate unified homelab backup matrix state","load":"loaded","sub":"failed","unit":"homelab-backup-matrix-refresh.service"},"severity":"HIGH","task_id":"FAILED-UNIT-homelab-backup-matrix-refresh.service","title":"Systemd unit failed: homelab-backup-matrix-refresh.service"},{"action":"Разобрать первичную ошибку unit и устранить её.","category":"services","evidence":{"active":"failed","description":"Crypto portfolio chart health check","load":"loaded","sub":"failed","unit":"homelab-crypto-portfolio-chart-health.service"},"severity":"HIGH","task_id":"FAILED-UNIT-homelab-crypto-portfolio-chart-health.service","title":"Systemd unit failed: homelab-crypto-portfolio-chart-health.service"},{"action":"Разобрать первичную ошибку unit и устранить её.","category":"services","evidence":{"active":"failed","description":"Skladchik reports monitor full supervisor","load":"loaded","sub":"failed","unit":"skladchik-reports-monitor-supervisor.service"},"severity":"HIGH","task_id":"FAILED-UNIT-skladchik-reports-monitor-supervisor.service","title":"Systemd unit failed: skladchik-reports-monitor-supervisor.service"},{"action":"Сформировать окно обновления с backup, проверкой release notes и reboot plan.","category":"updates","evidence":{"packages":["base-files","libexpat1","postfix","python3.13","libpython3.13-stdlib","python3.13-minimal","libpython3.13-minimal","liblzma5","rsync","shim-signed-common","shim-unsigned","shim-helpers-amd64-signed","shim-signed","dhcpcd-base","libxml2","bind9-host","bind9-dnsutils","bind9-libs","xz-utils","chrony","libcorosync-common4","libcfg7","libcmap4","libcpg4","libnss3","libknet1t64","libnozzle1t64","libquorum5","libvotequorum8","corosync","libssh2-1t64","curl","libcurl4t64","gpgsm","dirmngr","gpg","gpgconf","gpg-agent","libbytes-random-secure-perl","libcurl3t64-gnutls","libgbm1","mesa-libgallium","libgraphite2-3","libhtml-parser-perl","libtalloc2","libtevent0t64","libsmbclient0","samba-common","smbclient","libtdb1","libldb2","samba-libs","libwbclient0","libnvpair3linux","libproxmox-acme-plugins","libxml-libxml-perl","proxmox-backup-client","proxmox-backup-file-restore","libpve-storage-perl","libproxmox-acme-perl","libpve-common-perl","libpve-guest-common-perl","libslirp0","pve-qemu-kvm","pve-container","qemu-server","pve-ha-manager","novnc-pve","proxmox-enterprise-support-keyring","proxmox-mini-journalreader","proxmox-widget-toolkit","pve-docs","pve-i18n","pve-xtermjs","pve-manager","libpve-network-api-perl","libpve-network-perl","pve-firewall","libtasn1-6","libuutil3linux","libzfs7linux","libzpool7linux","netbird","pve-firmware","pve-yew-mobile-i18n","python3-idna","python3-markdown","python3-urllib3","python3.13-tk","zfs-initramfs","zfsutils-linux","zfs-zed"],"simulation_sha256":"b02fccf2fa828498c4dfac7a4782d7aa267403562556adf4dd37817509d758f8"},"severity":"HIGH","task_id":"UPDATES-PENDING","title":"Доступны обновления пакетов: 92"}],"info_count":0,"low_count":0,"medium_count":3,"opportunity_count":4,"recommended_next_projects":[{"action":"Собрать Proxmox, SMART, ZFS/Ceph, backup age, certificate expiry, UPS и network errors в Prometheus/Grafana с алертами.","category":"observability","evidence":{},"severity":"OPPORTUNITY","task_id":"CLUSTER-OBSERVABILITY","title":"Создать единый SLO-мониторинг кластера"},{"action":"Документировать порядок: потеря узла, storage, quorum, сети, сертификата, backup restore и доступ без control plane.","category":"operations","evidence":{},"severity":"OPPORTUNITY","task_id":"DISASTER-RUNBOOK","title":"Зафиксировать runbook аварийного восстановления"},{"action":"Интегрировать NUT/UPS, выполнить тест отключения питания и проверить порядок остановки VM/storage/узлов.","category":"power","evidence":{},"severity":"OPPORTUNITY","task_id":"UPS-DRILL","title":"Проверить UPS и автоматическое завершение работы"},{"action":"Проверить MFA/ACL Proxmox, сервисные токены, SSH keys, ротацию секретов и отдельные break-glass учётные записи.","category":"security","evidence":{"sshd":{"maxauthtries":"6","passwordauthentication":"yes","permitrootlogin":"yes","pubkeyauthentication":"yes"}},"severity":"OPPORTUNITY","task_id":"ACCESS-REVIEW","title":"Провести аудит доступа и секретов"}]}}
|
||
|
||
OUTPUT_END
|
||
CHAT_OUTPUT_END
|