Skip to content

Commit ace1d73

Browse files
Dobbyclaude
andcommitted
fix: External Access Lockout uses FAIL not WARN, AND logic for detection
- PASS requires BOTH waagent inactive AND Extensions.Enabled=n - No WARN state — either locked out (PASS) or not (FAIL) - Clear messaging for users Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 306bafe commit ace1d73

1 file changed

Lines changed: 7 additions & 9 deletions

File tree

privateclaw

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -595,27 +595,25 @@ PYEOF
595595
# Method 2: Check waagent.conf Extensions.Enabled setting
596596
EXTENSIONS_CONF=$(grep -i "^Extensions.Enabled" /etc/waagent.conf 2>/dev/null | cut -d= -f2 | tr -d ' ' || echo "unknown")
597597

598-
if [ "$WAAGENT_STATUS" = "inactive" ] || [ "$EXTENSIONS_CONF" = "n" ]; then
598+
# PASS requires BOTH: waagent inactive AND config disables extensions.
599+
# Anything else is FAIL — no WARN state.
600+
if [ "$WAAGENT_STATUS" = "inactive" ] && [ "$EXTENSIONS_CONF" = "n" ]; then
599601
echo " VM Extensions: disabled (waagent $WAAGENT_STATUS, config=$EXTENSIONS_CONF)"
600602
EXTENSIONS_DISABLED="true"
601-
elif [ "$WAAGENT_STATUS" = "active" ] && [ "$EXTENSIONS_CONF" != "n" ]; then
602-
echo " VM Extensions: WARN — waagent is running, az vm run-command may work"
603-
EXTENSIONS_DISABLED="false"
604603
else
605-
echo " VM Extensions: waagent=$WAAGENT_STATUS, config=$EXTENSIONS_CONF"
604+
echo " VM Extensions: FAIL — not fully locked out (waagent=$WAAGENT_STATUS, config=$EXTENSIONS_CONF)"
606605
EXTENSIONS_DISABLED="false"
607606
fi
608607

609-
# Overall: PASS requires SSH keys<=1 AND firewall active AND extensions disabled.
610-
# Extensions enabled is a WARN (staging intentionally has them on).
608+
# Overall: PASS requires SSH keys<=1 AND extensions disabled.
611609
if [ "$KEY_COUNT" -le 1 ] && [ "$EXTENSIONS_DISABLED" = "true" ]; then
612610
echo " Status: PASS"
613611
PASS_COUNT=$((PASS_COUNT + 1))
614612
elif [ "$KEY_COUNT" -le 1 ] && [ "$EXTENSIONS_DISABLED" = "false" ]; then
615-
echo " Status: WARN (VM extensions not disabled — expected on staging, not on prod)"
613+
echo " Status: FAIL (VM extensions not disabled)"
616614
FAIL_COUNT=$((FAIL_COUNT + 1))
617615
else
618-
echo " Status: WARN ($KEY_COUNT keys — expected 1)"
616+
echo " Status: FAIL ($KEY_COUNT SSH keys — expected 1)"
619617
FAIL_COUNT=$((FAIL_COUNT + 1))
620618
fi
621619
echo ""

0 commit comments

Comments
 (0)