igodwin
f2a979f047
The repo is public and files are fetched by raw URL, so a reader who lands on one runbook never sees the README -- the repo's context does not travel with the file. Each .md now carries two lines under the title, each .ps1 the equivalent at the end of its .NOTES block. Deliberately two lines, not a paragraph. These files are read through `| more` on a client console mid-incident, and the top of the file is where the procedure-specific warnings live -- never a live chart, stop the service before copying, confirm authorization before acting. A legal preamble above those competes with them and trains people to skip past. Wording aims at a stranger who found the repo, not at the quality of the procedure: these double as documented-procedure evidence for E&O, and language implying the content is unreliable works against that. MIT rather than no license: the warranty and liability disclaimer is the part that does the work, and leaving it unlicensed makes reuse ambiguous rather than disclaimed. Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit missed -- it only swept the .md files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
113 lines
5.1 KiB
Markdown
113 lines
5.1 KiB
Markdown
# rb — runbooks
|
|
|
|
Generic, reusable IT procedures and scripts for MSP field work. Fetched onto
|
|
client workstations during on-site work with short, hand-typeable commands.
|
|
|
|
> [!WARNING]
|
|
> **This repository is PUBLIC-READ.** It must never contain client-identifying
|
|
> information — no client names, hostnames, IPs, usernames, credentials, or
|
|
> screenshots. Procedures with placeholders **only**. See
|
|
> [CONTRIBUTING.md](CONTRIBUTING.md) for the sanitization rule.
|
|
|
|
> For qualified IT professionals, on systems they are authorized to administer.
|
|
> Provided as-is, without warranty — verify anything here fits your environment
|
|
> before running it. Scripts execute in your own session via `iex`; read them
|
|
> first. Licensed under [MIT](LICENSE). Contains no client-identifying data by
|
|
> policy.
|
|
|
|
## Using a runbook
|
|
|
|
Fetch and read on the target workstation:
|
|
|
|
```powershell
|
|
irm rb.godwinsystems.com/<file> | more
|
|
```
|
|
|
|
Run an executable runbook script directly (scripts live under `scripts/`):
|
|
|
|
```powershell
|
|
irm rb.godwinsystems.com/scripts/<file>.ps1 | iex
|
|
```
|
|
|
|
Scripts prompt for anything client-specific via `Read-Host` — nothing to edit
|
|
before running. See [`scripts/_template.ps1`](scripts/_template.ps1) for the
|
|
convention.
|
|
|
|
No scheme is needed: PowerShell defaults a scheme-less URI to `http://`, and
|
|
`rb.godwinsystems.com` answers on :80 with a 301 to HTTPS.
|
|
|
|
### About that hostname
|
|
|
|
`rb.godwinsystems.com` is a 302 redirect to this repo's raw path on Gitea. It
|
|
exists because these commands are hand-typed on client machines, often
|
|
mid-incident — the canonical URL is 63 characters before the filename. The
|
|
canonical form still works and is what the redirect targets:
|
|
|
|
```
|
|
https://gitea.ivangodwin.com/godwinsystems/rb/raw/branch/main/<file>
|
|
```
|
|
|
|
The redirect is a backendless Gateway API `HTTPRoute` defined in
|
|
`kubernetes-gitops` at `manifests/apps/rb-redirect/`, with a listener on the
|
|
public gateway and a DNS-only A record for `rb`. **If that route is ever
|
|
removed, update the commands above in the same change** — otherwise every
|
|
runbook here documents a dead URL.
|
|
|
|
## Layout & naming
|
|
|
|
- **Runbooks** (`.md`) live flat at the repo root with short, hand-typeable
|
|
filenames and light category prefixes.
|
|
- **Scripts** (`.ps1`) live under [`scripts/`](scripts/). `_template.ps1`
|
|
sorts first and is the convention reference, not a runnable runbook.
|
|
- **Meta** (`README.md`, `CONTRIBUTING.md`) stays at the root.
|
|
|
|
Runbook prefixes:
|
|
|
|
| Prefix | Domain |
|
|
|---|---|
|
|
| `win-` | Windows workstation / server |
|
|
| `m365-` | Microsoft 365 / Entra |
|
|
| `od-` | Open Dental |
|
|
| `net-` | Networking |
|
|
| `sec-` | Security / incident response |
|
|
|
|
## Placeholder conventions
|
|
|
|
Fill these from the private tier (private repo or Bitwarden secure note) at
|
|
run time — never commit filled-in values.
|
|
|
|
| Placeholder | Meaning |
|
|
|---|---|
|
|
| `<CLIENT>` | Client / site identifier |
|
|
| `<SERVER>` | Server hostname |
|
|
| `<SHARE>` | Share name |
|
|
| `<SHARE_USER>` | Local account used for share access |
|
|
| `<USER>` | End-user account |
|
|
| `<PASSWORD>` | From password manager — never written to a file |
|
|
|
|
## Contents
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| [`od-smb-cred.md`](od-smb-cred.md) | Open Dental SMB share — stored-credential fix |
|
|
| [`od-cfg-persist.md`](od-cfg-persist.md) | Open Dental — persist "Do not show this window on startup" (writable FreeDentalConfig.xml) |
|
|
| [`od-scan-duplex.md`](od-scan-duplex.md) | Open Dental — duplex ADF scanner captures only one side (TWAIN, Show TWAIN UI branches) |
|
|
| [`od-db-backup.md`](od-db-backup.md) | Open Dental — rock-solid cold backup of the database + images (stop/copy/start MySQL/MariaDB) |
|
|
| [`od-backup-verify.md`](od-backup-verify.md) | Open Dental — verify a backup by test-restoring into an isolated Hyper-V VM (health checklist) |
|
|
| [`od-backup-schedule.md`](od-backup-schedule.md) | Open Dental — schedule the backup + off-site upload and monitor it (dead-man's-switch heartbeat) |
|
|
| [`sec-google-compromise.md`](sec-google-compromise.md) | Incident response — suspected compromise of a **consumer** Google/Gmail account (AiTM session theft; no Workspace admin console) |
|
|
| [`sec-google-evidence.md`](sec-google-evidence.md) | Google/Gmail account — evidence capture before changes + re-entry check after a password reset (numbered, field-usable) |
|
|
| [`scripts/cg-disable.ps1`](scripts/cg-disable.ps1) | Disable Credential Guard, then reboot (prompts to confirm) |
|
|
| [`scripts/od-cfg-acl.ps1`](scripts/od-cfg-acl.ps1) | Grant Users Modify on FreeDentalConfig.xml (Option B of od-cfg-persist) |
|
|
| [`scripts/od-db-backup.ps1`](scripts/od-db-backup.ps1) | Cold backup: stop MySQL/MariaDB, copy whole data dir + OpenDentImages, always restart (od-db-backup) |
|
|
| [`scripts/od-backup-check.ps1`](scripts/od-backup-check.ps1) | Read-only backup health check: freshness/completeness/size + heartbeat ping (od-backup-schedule) |
|
|
|
|
## Tiers
|
|
|
|
- **This repo (public):** generic procedures, placeholders only.
|
|
- **Private tier:** filled-in, client-specific versions — private repo or
|
|
Bitwarden secure notes. Never here.
|
|
|
|
This repo also serves as the raw source for Intune remediation scripts and as
|
|
documented-procedures evidence for E&O / cyber insurance.
|