Bernt
05ed037fe8
- DNS: pilot.landvex.com -> 16.170.83.169 - TLS: Let's Encrypt certificate (expires 2026-09-30) - Nginx: reverse proxy with SSL termination - API: https://pilot.landvex.com/api/v1/missions - UI: https://pilot.landvex.com/ - Upload: POST /api/v1/missions/import (multipart/form-data) Verified: ✅ https://pilot.landvex.com/health ✅ https://pilot.landvex.com/version ✅ https://pilot.landvex.com/api/v1/missions (list) ✅ https://pilot.landvex.com/api/v1/missions/:id (get) ✅ POST /api/v1/missions/import (video upload) ✅ UI loads with title 'LandveX Intelligence Lab' Next: Pilot 001 — Break the system!
60 lines
2.5 KiB
JavaScript
60 lines
2.5 KiB
JavaScript
#!/usr/bin/env node
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// Vertical Slice: ALL produktionsåtkomst blockeras (S-001) v3
|
|
// Inklusive SSH, SSM, shell, tunnel — alla vägar in
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
|
|
import { AgentRuntimeV3 } from './agent-runtime-v3.mjs';
|
|
|
|
/**
|
|
* EOS Policy för ALL produktionsåtkomst
|
|
* Blockerar: SSH, SSM, shell-script, tunnel, AWS Systems Manager, etc.
|
|
*/
|
|
function checkProductionAccessPolicy(task) {
|
|
// Lista över alla kända åtkomstmetoder
|
|
const accessMethods = ['ssh', 'ssm', 'shell', 'aws-ssm', 'tunnel', 'rdp', 'vnc', 'telnet'];
|
|
|
|
const isProductionAccess = task.target === 'production' ||
|
|
task.description?.toLowerCase().includes('produktion');
|
|
|
|
const isAccessAttempt = accessMethods.includes(task.action) ||
|
|
accessMethods.some(method =>
|
|
task.description?.toLowerCase().includes(method)
|
|
);
|
|
|
|
// Blockera även generella "åtkomstförsök" till produktion
|
|
const isGenericAccess = task.type === 'infrastructure' &&
|
|
isProductionAccess &&
|
|
(task.action === 'access' ||
|
|
task.action === 'connect' ||
|
|
task.description?.toLowerCase().includes('anslut') ||
|
|
task.description?.toLowerCase().includes('koppla'));
|
|
|
|
if (isProductionAccess && (isAccessAttempt || isGenericAccess)) {
|
|
return {
|
|
passed: false,
|
|
policyId: 'POL-SEC-001',
|
|
rule: 'no-production-access',
|
|
reason: 'All direktåtkomst till produktion är förbjuden enligt EOS Policy POL-SEC-001. Använd godkänd pipeline.',
|
|
severity: 'CRITICAL',
|
|
action: 'STOP',
|
|
evidence: {
|
|
action: task.action,
|
|
target: task.target,
|
|
method: task.action || 'unknown'
|
|
}
|
|
};
|
|
}
|
|
|
|
return { passed: true };
|
|
}
|
|
|
|
class AgentRuntimeSSHSliceV3 extends AgentRuntimeV3 {
|
|
constructor(task) {
|
|
super(task);
|
|
this.policies = [checkProductionAccessPolicy];
|
|
}
|
|
}
|
|
|
|
export { AgentRuntimeSSHSliceV3, checkProductionAccessPolicy };
|