dan/ops-jrz1
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity
64 commits 3 branches 1 tag 5.5 MiB
Commit graph

3 commits

Author SHA1 Message Date
Dan f8e77c44b1 Fix code review items from security scripts 
- egress-watchdog: Use process substitution to avoid subshell gotcha
- killswitch: Rename USER to TARGET_USER (avoid shadowing builtin)
- Add documentation comments for UID range and grep -P dependency

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-03 09:35:40 -08:00
Dan 89f2987f1e Add cgroups limits and CPU watchdog 
- User slice: MemoryMax 80%, TasksMax 500, CPUWeight 100
- CPU watchdog: detects sustained abuse (>180% for 5 min), kills user
- Fixed scripts for NixOS (shebang, PATH)
- Closes ops-jrz1-8m7, ops-jrz1-1bk

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-02 21:02:18 -08:00
Dan 8e266b5e82 Add killswitch script for emergency user termination 
- Kills all processes for a user
- Terminates login session
- Logs to syslog with reason
- Refuses to kill system users (uid < 1000)
- Closes ops-jrz1-396

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-02 20:23:31 -08:00