Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 1 | #!/bin/bash |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 2 | # |
Darren Tucker | 8fdcba5 | 2009-07-12 21:58:42 +1000 | [diff] [blame] | 3 | # ssh-user-config, Copyright 2000-2008 Red Hat Inc. |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 4 | # |
| 5 | # This file is part of the Cygwin port of OpenSSH. |
Darren Tucker | 8fdcba5 | 2009-07-12 21:58:42 +1000 | [diff] [blame] | 6 | # |
| 7 | # Permission to use, copy, modify, and distribute this software for any |
| 8 | # purpose with or without fee is hereby granted, provided that the above |
| 9 | # copyright notice and this permission notice appear in all copies. |
| 10 | # |
| 11 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS |
| 12 | # OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
| 13 | # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. |
| 14 | # IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, |
| 15 | # DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR |
| 16 | # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR |
| 17 | # THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 18 | |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 19 | # ====================================================================== |
| 20 | # Initialization |
| 21 | # ====================================================================== |
| 22 | PROGNAME=$(basename -- $0) |
| 23 | _tdir=$(dirname -- $0) |
| 24 | PROGDIR=$(cd $_tdir && pwd) |
| 25 | |
| 26 | CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh |
| 27 | |
| 28 | # Subdirectory where the new package is being installed |
| 29 | PREFIX=/usr |
| 30 | |
Darren Tucker | 798ca84 | 2003-11-13 11:28:49 +1100 | [diff] [blame] | 31 | # Directory where the config files are stored |
| 32 | SYSCONFDIR=/etc |
| 33 | |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 34 | source ${CSIH_SCRIPT} |
| 35 | |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 36 | auto_passphrase="no" |
| 37 | passphrase="" |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 38 | pwdhome= |
| 39 | with_passphrase= |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 40 | |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 41 | # ====================================================================== |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 42 | # Routine: create_identity |
| 43 | # optionally create identity of type argument in ~/.ssh |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 44 | # optionally add result to ~/.ssh/authorized_keys |
| 45 | # ====================================================================== |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 46 | create_identity() { |
| 47 | local file="$1" |
| 48 | local type="$2" |
| 49 | local name="$3" |
| 50 | if [ ! -f "${pwdhome}/.ssh/${file}" ] |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 51 | then |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 52 | if csih_request "Shall I create a ${name} identity file for you?" |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 53 | then |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 54 | csih_inform "Generating ${pwdhome}/.ssh/${file}" |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 55 | if [ "${with_passphrase}" = "yes" ] |
| 56 | then |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 57 | ssh-keygen -t "${type}" -N "${passphrase}" -f "${pwdhome}/.ssh/${file}" > /dev/null |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 58 | else |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 59 | ssh-keygen -t "${type}" -f "${pwdhome}/.ssh/${file}" > /dev/null |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 60 | fi |
| 61 | if csih_request "Do you want to use this identity to login to this machine?" |
| 62 | then |
| 63 | csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 64 | cat "${pwdhome}/.ssh/${file}.pub" >> "${pwdhome}/.ssh/authorized_keys" |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 65 | fi |
| 66 | fi |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 67 | fi |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 68 | } # === End of create_ssh1_identity() === # |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 69 | readonly -f create_identity |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 70 | |
| 71 | # ====================================================================== |
| 72 | # Routine: check_user_homedir |
| 73 | # Perform various checks on the user's home directory |
| 74 | # SETS GLOBAL VARIABLE: |
| 75 | # pwdhome |
| 76 | # ====================================================================== |
| 77 | check_user_homedir() { |
| 78 | local uid=$(id -u) |
| 79 | pwdhome=$(awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd) |
| 80 | if [ "X${pwdhome}" = "X" ] |
| 81 | then |
Tim Rice | caeb164 | 2009-07-29 07:21:13 -0700 | [diff] [blame] | 82 | csih_error_multi \ |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 83 | "There is no home directory set for you in ${SYSCONFDIR}/passwd." \ |
| 84 | 'Setting $HOME is not sufficient!' |
| 85 | fi |
| 86 | |
| 87 | if [ ! -d "${pwdhome}" ] |
| 88 | then |
Tim Rice | caeb164 | 2009-07-29 07:21:13 -0700 | [diff] [blame] | 89 | csih_error_multi \ |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 90 | "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" \ |
| 91 | 'but it is not a valid directory. Cannot create user identity files.' |
| 92 | fi |
| 93 | |
| 94 | # If home is the root dir, set home to empty string to avoid error messages |
| 95 | # in subsequent parts of that script. |
| 96 | if [ "X${pwdhome}" = "X/" ] |
| 97 | then |
| 98 | # But first raise a warning! |
| 99 | csih_warning "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!" |
| 100 | if csih_request "Would you like to proceed anyway?" |
| 101 | then |
| 102 | pwdhome='' |
| 103 | else |
| 104 | csih_warning "Exiting. Configuration is not complete" |
| 105 | exit 1 |
| 106 | fi |
| 107 | fi |
| 108 | |
| 109 | if [ -d "${pwdhome}" -a csih_is_nt -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ] |
| 110 | then |
| 111 | echo |
| 112 | csih_warning 'group and other have been revoked write permission to your home' |
| 113 | csih_warning "directory ${pwdhome}." |
| 114 | csih_warning 'This is required by OpenSSH to allow public key authentication using' |
| 115 | csih_warning 'the key files stored in your .ssh subdirectory.' |
| 116 | csih_warning 'Revert this change ONLY if you know what you are doing!' |
| 117 | echo |
| 118 | fi |
| 119 | } # === End of check_user_homedir() === # |
| 120 | readonly -f check_user_homedir |
| 121 | |
| 122 | # ====================================================================== |
| 123 | # Routine: check_user_dot_ssh_dir |
| 124 | # Perform various checks on the ~/.ssh directory |
| 125 | # PREREQUISITE: |
| 126 | # pwdhome -- check_user_homedir() |
| 127 | # ====================================================================== |
| 128 | check_user_dot_ssh_dir() { |
| 129 | if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ] |
| 130 | then |
| 131 | csih_error "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files." |
| 132 | fi |
| 133 | |
| 134 | if [ ! -e "${pwdhome}/.ssh" ] |
| 135 | then |
| 136 | mkdir "${pwdhome}/.ssh" |
| 137 | if [ ! -e "${pwdhome}/.ssh" ] |
| 138 | then |
| 139 | csih_error "Creating users ${pwdhome}/.ssh directory failed" |
| 140 | fi |
| 141 | fi |
| 142 | } # === End of check_user_dot_ssh_dir() === # |
| 143 | readonly -f check_user_dot_ssh_dir |
| 144 | |
| 145 | # ====================================================================== |
| 146 | # Routine: fix_authorized_keys_perms |
| 147 | # Corrects the permissions of ~/.ssh/authorized_keys |
| 148 | # PREREQUISITE: |
| 149 | # pwdhome -- check_user_homedir() |
| 150 | # ====================================================================== |
| 151 | fix_authorized_keys_perms() { |
| 152 | if [ csih_is_nt -a -e "${pwdhome}/.ssh/authorized_keys" ] |
| 153 | then |
| 154 | if ! setfacl -m "u::rw-,g::---,o::---" "${pwdhome}/.ssh/authorized_keys" |
| 155 | then |
| 156 | csih_warning "Setting correct permissions to ${pwdhome}/.ssh/authorized_keys" |
| 157 | csih_warning "failed. Please care for the correct permissions. The minimum requirement" |
| 158 | csih_warning "is, the owner needs read permissions." |
| 159 | echo |
| 160 | fi |
| 161 | fi |
| 162 | } # === End of fix_authorized_keys_perms() === # |
| 163 | readonly -f fix_authorized_keys_perms |
| 164 | |
| 165 | |
| 166 | # ====================================================================== |
| 167 | # Main Entry Point |
| 168 | # ====================================================================== |
| 169 | |
| 170 | # Check how the script has been started. If |
| 171 | # (1) it has been started by giving the full path and |
| 172 | # that path is /etc/postinstall, OR |
| 173 | # (2) Otherwise, if the environment variable |
| 174 | # SSH_USER_CONFIG_AUTO_ANSWER_NO is set |
| 175 | # then set auto_answer to "no". This allows automatic |
| 176 | # creation of the config files in /etc w/o overwriting |
| 177 | # them if they already exist. In both cases, color |
| 178 | # escape sequences are suppressed, so as to prevent |
| 179 | # cluttering setup's logfiles. |
| 180 | if [ "$PROGDIR" = "/etc/postinstall" ] |
Darren Tucker | 798ca84 | 2003-11-13 11:28:49 +1100 | [diff] [blame] | 181 | then |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 182 | csih_auto_answer="no" |
| 183 | csih_disable_color |
| 184 | fi |
| 185 | if [ -n "${SSH_USER_CONFIG_AUTO_ANSWER_NO}" ] |
| 186 | then |
| 187 | csih_auto_answer="no" |
| 188 | csih_disable_color |
Darren Tucker | 798ca84 | 2003-11-13 11:28:49 +1100 | [diff] [blame] | 189 | fi |
| 190 | |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 191 | # ====================================================================== |
| 192 | # Parse options |
| 193 | # ====================================================================== |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 194 | while : |
| 195 | do |
| 196 | case $# in |
| 197 | 0) |
| 198 | break |
| 199 | ;; |
| 200 | esac |
| 201 | |
| 202 | option=$1 |
| 203 | shift |
| 204 | |
| 205 | case "$option" in |
| 206 | -d | --debug ) |
| 207 | set -x |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 208 | csih_trace_on |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 209 | ;; |
| 210 | |
| 211 | -y | --yes ) |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 212 | csih_auto_answer=yes |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 213 | ;; |
| 214 | |
| 215 | -n | --no ) |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 216 | csih_auto_answer=no |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 217 | ;; |
| 218 | |
| 219 | -p | --passphrase ) |
| 220 | with_passphrase="yes" |
| 221 | passphrase=$1 |
| 222 | shift |
| 223 | ;; |
| 224 | |
| 225 | *) |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 226 | echo "usage: ${PROGNAME} [OPTION]..." |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 227 | echo |
| 228 | echo "This script creates an OpenSSH user configuration." |
| 229 | echo |
| 230 | echo "Options:" |
| 231 | echo " --debug -d Enable shell's debug output." |
| 232 | echo " --yes -y Answer all questions with \"yes\" automatically." |
| 233 | echo " --no -n Answer all questions with \"no\" automatically." |
| 234 | echo " --passphrase -p word Use \"word\" as passphrase automatically." |
| 235 | echo |
| 236 | exit 1 |
| 237 | ;; |
| 238 | |
| 239 | esac |
| 240 | done |
| 241 | |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 242 | # ====================================================================== |
| 243 | # Action! |
| 244 | # ====================================================================== |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 245 | |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 246 | # Check passwd file |
Darren Tucker | 798ca84 | 2003-11-13 11:28:49 +1100 | [diff] [blame] | 247 | if [ ! -f ${SYSCONFDIR}/passwd ] |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 248 | then |
Tim Rice | caeb164 | 2009-07-29 07:21:13 -0700 | [diff] [blame] | 249 | csih_error_multi \ |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 250 | "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" \ |
| 251 | 'first using mkpasswd. Check if it contains an entry for you and' \ |
| 252 | 'please care for the home directory in your entry as well.' |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 253 | fi |
| 254 | |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 255 | check_user_homedir |
| 256 | check_user_dot_ssh_dir |
Darren Tucker | ea676a6 | 2011-02-06 13:31:23 +1100 | [diff] [blame] | 257 | create_identity id_rsa rsa "SSH2 RSA" |
| 258 | create_identity id_dsa dsa "SSH2 DSA" |
| 259 | create_identity id_ecdsa ecdsa "SSH2 ECDSA" |
| 260 | create_identity identity rsa1 "(deprecated) SSH1 RSA" |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 261 | fix_authorized_keys_perms |
Darren Tucker | 798ca84 | 2003-11-13 11:28:49 +1100 | [diff] [blame] | 262 | |
Ben Lindstrom | b100ec9 | 2001-01-19 05:37:32 +0000 | [diff] [blame] | 263 | echo |
Damien Miller | 1fc231c | 2008-07-14 12:12:52 +1000 | [diff] [blame] | 264 | csih_inform "Configuration finished. Have fun!" |
| 265 | |
| 266 | |