{
  "phase": "L3-prod-DB-auth-probe",
  "date": "2026-08-12",
  "operator_go": "go (2026-08-12, probe of new public prod DB hosts from L4 fullclone)",
  "mode": "read-only (psql SELECT/SHOW only; no writes, no dumps)",
  "source_of_creds": "L4_fullclone_secrets.json + repos/*.git application-{live,prod}.properties",
  "targets": [
    {
      "host": "103.149.99.107:2903",
      "tcp": "OPEN",
      "engine": "PostgreSQL 17.10 (Ubuntu 17.10-1.pgdg24.04+1)",
      "listen_addresses": "*",
      "auth_results": [
        {"db": "dace",        "user": "dace",     "pw": "dACe@2026@#",   "result": "VALID", "source": "dance_service_dace-api.git application-prod.properties"},
        {"db": "morning",     "user": "morning",  "pw": "MoRNinG@2026@#","result": "VALID", "source": "morning_morning-api.git application-live.properties"},
        {"db": "eform",       "user": "eform",    "pw": "eForM@2026@#",  "result": "VALID", "source": "report-platform_report-platform-api.git application-prod.properties"},
        {"db": "mail_system", "user": "postgres", "pw": "TamDT@2026!@#", "result": "VALID", "source": "tamdt1_kafka-gateway-service.git application-prod.yaml (SUPERUSER)"}
      ],
      "databases_on_server": ["postgres", "eform", "mail_system", "dace", "morning"],
      "liveness_evidence": {
        "server_now": "2026-08-12 17:40 +07",
        "dace.business.order_info": "2026-07-06 .. 2026-07-27",
        "mail_system.mail_req latest": "2026-07-27 10:58 (DACE/E-FORM password-reset mail, CONSUMER_SEND_DONE)",
        "verdict": "LIVE PROD (not a frozen snapshot, unlike UAT 14.225.11.28)"
      },
      "census": {
        "dace": {
          "schemas": ["public","export","warehouse","master","business","auth"],
          "auth.users": 19, "auth.user_detail": 19, "auth.roles": 4,
          "master.customer": 16, "business.order_info": 43,
          "business.order_payment": 6, "business.order_logs": 75,
          "usernames_observed": ["admin","hieutv","bannt","chamntn","thangna","canhvd","sales01","sales02","kienlt","httcuc","nganh","huydq","baodq","anhtran","nhungtth","antp"],
          "note": "DACE = MES (materials/warehouse/orders). user_pass column present (hash algo not inspected)."
        },
        "morning": {
          "tables": ["foul","global_config","match","match_detail","match_score","player","roles","team_fund","transaction_detail","user_detail","user_role","users","vote","weekly_report"],
          "transaction_detail": 3503, "match_detail": 2598, "match": 143,
          "users": 4, "user_role": 4, "roles": 2,
          "usernames_observed": ["tamdt","hunghh","cuongdm","anhlt"],
          "note": "morning = sports/team-mgmt app (match/foul/vote/team_fund). transaction_detail has no create_date col (naming differs)."
        },
        "eform": {
          "schemas": ["public","master","auth"],
          "auth.users": 3, "auth.refresh_token": 0,
          "master.e_form": 0, "master.form_submissions": 0,
          "usernames_observed": ["cutv","admin","tamdt"],
          "note": "eform largely empty (fresh deploy or archived)."
        },
        "mail_system": {
          "tables": ["mail_app_config","mail_logs","mail_req","mail_template"],
          "mail_logs": 9, "mail_req": 10, "mail_template": 5, "mail_app_config": 2,
          "note": "central mail relay for DACE/E-FORM apps; mail_req holds mail_to+subject+mail_content (PII in content)."
        }
      },
      "db_sizes": {"morning": "10182 kB", "dace": "8790 kB", "eform": "8158 kB", "mail_system": "7862 kB", "postgres": "7502 kB"},
      "postgres_role": "SUPERUSER (rolsuper=t, rolcreatedb=t) — full instance control"
    },
    {
      "host": "14.225.5.225:5432",
      "tcp": "CLOSED/FILTERED (timeout x2, 8s+20s)",
      "intended_creds": {"db": "cms_vdss_live/draf", "user": "postgres", "pw": "Vdss@2022#"},
      "verdict": "UNREACHABLE from lab — likely IP-allowlist (VDSS PROD CMS). NOT invalid-cred. Needs internal pivot (runner) or whitelisted source."
    },
    {
      "host": "211.188.52.92:3306",
      "tcp": "CLOSED/FILTERED (timeout x2, 8s+20s)",
      "intended_creds": {"db": "chondb", "user": "chon", "pw": "cHon$2025!@#"},
      "verdict": "UNREACHABLE from lab — likely IP-allowlist (chon poc live). NOT invalid-cred."
    },
    {
      "host": "14.225.11.28:4309",
      "tcp": "OPEN",
      "engine": "MariaDB 11.3.2 (mysql_native_password in greeting)",
      "intended_creds": {"db": "chondb", "user": "root", "pw": "Tamdt@2024@#"},
      "auth_result": "BLOCKED: server demands auth_gssapi_client for root@%; every client (mysql 8.0, mariadb 10.11, pymysql) fails — server-side account configured for Kerberos/GSSAPI only. Password auth not negotiable.",
      "verdict": "CONFIG: root over network = GSSAPI-only. Cred from repo unusable remotely w/o Kerberos ticket. Try 'chon' user (not attempted — requires Kerberos realm join?) or pivot."
    }
  ],
  "counter_checks": [
    "Closed ports re-tested with 20s timeout — still closed (not transient).",
    "MariaDB greeting banner confirms mysql_native_password default — GSSAPI demand is per-account (root), not server-wide.",
    "morning/dace/eform/mail_system VALIDs cross-checked with 2nd query (census) — consistent."
  ],
  "confidence": "CONFIRMED for 103.149.99.107:2903 (4 VALID, live prod). PROBABLE allowlist for 14.225.5.225 / 211.188.52.92. CONFIRMED GSSAPI-block for 14.225.11.28:4309 root.",
  "sysmod": "none — read-only SELECT/SHOW; auth attempts logged server-side (pg_log / mariadb log) as normal login events",
  "artifacts": "this file; README.md updated; OPLOG entry"
}