KDC Trust Path Progress and osTicket Phase 3 Deployment

KDC Trust Path: node90x Cluster Subset

The KDC trust path restoration effort has reached a significant inflection point. After weeks of incremental principal creation and keytab deployment, the node90x cluster now has enough operational host principals to begin rolling out krb5i NFS mounts at scale:

• node900: Host principal confirmed operational via kinit. Keytab at /etc/krb5.keytab. Ready for NFS mount switch from sys to krb5i.
• node903: First host principal created and validated. Keytab deployed. Awaiting the broader cluster-wide trust path before switching its own NFS mounts.
• node904: Keytab generated but still awaiting deployment to offline target.
• stargate/bitsmasher.net: Wildcard kadmin ACL verified on odroid-c1. Can now issue host principals for the remaining node90x nodes without per-principal authorization entries.
• host/node90x-cluster: Host-based principal group entry created, enabling automated bulk enrollment for future nodes.

The two remaining blockers — node905 (requires console access for first-key generation) and node901/node902 (P1 hardware issues, both offline since August 27) — keep the trust path incomplete. Until these four nodes can present valid host credentials to the KDC, the krb5i NFS rollout must remain incremental rather than cluster-wide.

osTicket Phase 3 Deployed on blowfish

osTicket v1.18.1 has been deployed on blowfish.lab.bitsmasher.net as the new ticketing system. The stack:

• OS: OpenBSD 7.8 amd64
• Database: MariaDB 11.4 (installed via pkg)
• Web server: nginx
• PHP: 8.4
• Application: osTicket v1.18.1

DB user and application source are in place. The MariaDB instance runs as _mysql:502 with ~138MB RSS. No rcctl-managed services are enabled on blowfish beyond MySQL — the host remains a general-purpose OpenBSD workstation rather than a dedicated daemon server, which means deployment relied on manual service start rather than automated boot-time activation.

⚠️ Pre-Production Checklist

The osTicket instance is functionally operational but requires attention before production use:

• Default password change: The MariaDB root and osTicket admin defaults must be changed immediately.
• MySQL service persistence: Currently managed manually. Consider adding to /etc/rc.conf.local for automatic startup.
• TLS termination: No HTTPS proxy configured yet — this should be added before any external-facing traffic is directed here.

Blowfish Survey Notes

Ground truth collected during deployment verification:

• franklin user authenticates fine, uid 9001, groups: wheel/operator/www/minecraft
• No rcctl-managed services enabled — /etc/rc.conf is all default NO
• X11 workstation: Xorg + xenodm + Openbox (session since September 4)
• Heavy pkg forest with multiple autoconf/automake versions and GNOME/adwaita dependencies
• SSH key auth rejected on this host; password auth is the only path

Upcoming

• Kerberos host principal for node905: Blocked on console access. Will be prioritized when remote KVM window opens.
• Credential management: Ensure all host principals have secure key storage before krb5i NFS rollout reaches production traffic volumes.