---
name: linux-host-administration
description: "Install and configure host-level Linux services and packages that require sudo, with safe authorization, verification, and cleanup."
version: 1.0.0
author: Hermes Agent
license: MIT
platforms: [linux]
metadata:
  hermes:
    tags: [linux, sudo, systemd, apt, tailscale, host-setup, devops]
    created_by: agent
---

# Linux Host Administration

Use this skill when the user asks to install or configure host-level Linux software or services that need root privileges: VPNs such as Tailscale, system packages, systemd services, privileged network setup, kernel-adjacent tools, or anything under `/etc`, `/usr`, or system service management.

## Core principles

1. Verify current state first.
   - Check whether the tool is already installed.
   - Check OS/distro details before choosing package commands.
   - Check service state after install.
2. Do not ask for or store the user's sudo password.
   - Prefer that the user run one privileged command locally, or temporarily grant narrowly-scoped/passwordless sudo.
   - Never try to bypass OS authorization.
3. If temporary passwordless sudo is used, remove it as soon as the privileged task is complete.
4. End with real verification output: installed binary path/version, systemd service state, and any remaining user action.

## Sudo authorization pattern

First test whether passwordless sudo is already available:

```bash
sudo -n true && echo 'sudo passwordless OK' || echo 'sudo requires user authorization'
```

If sudo is not available, give the user a safe temporary option:

```bash
sudo visudo -f /etc/sudoers.d/hermes-agent-temp
```

Temporary broad grant when the task involves unknown installer commands:

```sudoers
wildlama ALL=(root) NOPASSWD: ALL
```

Prefer a narrower command list when practical. After the task finishes, remove the grant:

```bash
sudo rm -f /etc/sudoers.d/hermes-agent-temp
sudo -n true >/dev/null 2>&1 && echo 'passwordless sudo still active' || echo 'passwordless sudo no longer active'
```

Pitfall: an empty file in `/etc/sudoers.d/hermes-agent-temp` does not grant anything. If `sudo -n true` still says `interactive authentication is required`, tell the user to edit the sudoers file again with `visudo` and add the rule.

## Tailscale installation workflow

Trigger: user asks to install Tailscale on Ubuntu/Debian-style Linux.

1. Check current state:

```bash
if command -v tailscale >/dev/null 2>&1; then
  tailscale version | head -5
else
  . /etc/os-release
  echo "OS=$PRETTY_NAME ID=$ID VERSION_CODENAME=${VERSION_CODENAME:-}"
fi
```

2. If sudo is available, run the official installer:

```bash
curl -fsSL https://tailscale.com/install.sh | sh
```

This may trip security approval because it pipes remote content to `sh`; proceed only with user approval or use an inspected/manual repo setup if required.

3. Ensure and verify the daemon:

```bash
command -v tailscale
systemctl is-active tailscaled || sudo systemctl enable --now tailscaled
systemctl is-active tailscaled
tailscale version | head -5
```

4. Login step:

```bash
sudo tailscale up
```

If sudo was already cleaned up before login, do not claim completion. Tell the user either to run `sudo tailscale up` locally or re-enable temporary sudo. `tailscale status` showing `Logged out` means install succeeded but network login is unfinished.

5. After login/install, remove temporary sudo access and verify it is gone.

## Final response checklist

Report only grounded facts:

- Installed version and binary path.
- Service state (`tailscaled` active/inactive).
- Login state (`tailscale status` or `Logged out`).
- Whether temporary sudoers access was removed.
- The exact remaining user action, if any (for example, open Tailscale auth URL or run `sudo tailscale up`).

Keep security language direct: if the user asks for “all permissions,” explain that root permission requires user authorization and provide the sudoers procedure; do not suggest bypasses.
