| /* Secure Shout Host Oriented Unified Talk |
| * Copyright 2015-2018 Rivoreo |
| * |
| * This program is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License as published by the |
| * Free Software Foundation, either version 3 of the License, or (at your |
| * option) any later version. |
| * |
| * This program is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for |
| * more details. |
| */ |
| |
| #include "common.h" |
| #include "syncrw.h" |
| #include "base64.h" |
| #include "misc.h" |
| #include <unistd.h> |
| #include <fcntl.h> |
| #include <pwd.h> |
| #include <string.h> |
| #include <stdlib.h> |
| #include <stdio.h> |
| #include "file-helpers.h" |
| #include <errno.h> |
| #include <sys/stat.h> |
| #include <arpa/inet.h> |
| #include <mhash.h> |
| |
| static void print_usage(const char *); |
| |
| static enum key_types { |
| KEY_INVALID = -1, |
| KEY_RSA, |
| KEY_DSA, |
| KEY_ECDSA, |
| KEY_ED25519 |
| } get_key_type(const char *key, size_t type_len) { |
| switch(type_len) { |
| case 3: |
| if(strncasecmp(key, "RSA", 3) == 0) return KEY_RSA; |
| if(strncasecmp(key, "DSA", 3) == 0) return KEY_DSA; |
| return KEY_INVALID; |
| case 5: |
| if(strncasecmp(key, "ECDSA", 5) == 0) return KEY_ECDSA; |
| return KEY_INVALID; |
| case 7: |
| if(strncasecmp(key, "ED25519", 7) == 0) return KEY_ED25519; |
| if(memcmp(key, "ssh-rsa", 7) == 0) return KEY_RSA; |
| if(memcmp(key, "ssh-dss", 7) == 0) return KEY_DSA; |
| return KEY_INVALID; |
| case 11: |
| if(memcmp(key, "ssh-ed25519", 11) == 0) return KEY_ED25519; |
| return KEY_INVALID; |
| case 19: |
| if(memcmp(key, "ecdsa-sha2-nistp", 16) == 0) { |
| if(memcmp(key + 16, "256", 3) == 0 || |
| memcmp(key + 16, "384", 3) == 0 || |
| memcmp(key + 16, "521", 3) == 0) { |
| return KEY_ECDSA; |
| } |
| } |
| return KEY_INVALID; |
| } |
| return KEY_INVALID; |
| } |
| |
| static const char *key_type_to_string(enum key_types t) { |
| switch(t) { |
| case KEY_RSA: return "RSA"; |
| case KEY_DSA: return "DSA"; |
| case KEY_ECDSA: return "ECDSA"; |
| case KEY_ED25519: return "ED25519"; |
| default: return NULL; |
| } |
| } |
| |
| static int get_length_and_type_string_length_of_key_in_base64(const char *key, size_t *base64_len, size_t *type_len, char *buffer, size_t buffer_size) { |
| #if 0 |
| const char *space = strchr(key, ' '); |
| *base64_len = space ? space - key : strlen(key); |
| #else |
| *base64_len = 0; |
| while(key[*base64_len] && key[*base64_len] != ' ') (*base64_len)++; |
| #endif |
| int blob_len = base64_decode(key, *base64_len, buffer, buffer_size); |
| if(blob_len == -1) { |
| fputs("Invalid key: invalid BASE64 encoding\n", stderr); |
| return -1; |
| } |
| if(blob_len < 4) { |
| fputs("Invalid key: too short\n", stderr); |
| return -1; |
| } |
| *type_len = ntohl(*(uint32_t *)buffer); |
| if(*type_len > (size_t)blob_len - 4) { |
| fprintf(stderr, "Invalid key: key type string length %u too long\n", (unsigned int)*type_len); |
| return -1; |
| } |
| return 0; |
| } |
| |
| static int read_user_info(FILE *f, char **name, char **public_key, char **comment, enum key_types *key_type, size_t *line_len) { |
| int i = 0; |
| char line[4096]; |
| while(1) { |
| i++; |
| int len = fgetline(f, line, sizeof line); |
| if(len == -2) { |
| int c; |
| fprintf(stderr, "Warning: line %u in file " USER_LIST_FILE " is too long, skipping\n", i); |
| while((c = fgetc(f)) != EOF && c != '\n'); |
| continue; |
| } |
| if(len < 0) return -1; // EOF |
| if(len == 0 || *line == '#') continue; |
| char *p = line; |
| while(*p && (*p == ' ' || *p == ' ')) p++; |
| if(!*p) continue; |
| char *q1 = strchr(p, '"'); |
| if(!q1) { |
| fprintf(stderr, "Warning: cannot find '\"' at line %u in file " USER_LIST_FILE "\n", i); |
| continue; |
| } |
| *q1 = 0; |
| if(q1 - p < 8 || strcmp(q1 - 8, "command=") || strchr(p, ' ')) { |
| fprintf(stderr, "Warning: syntax error in file " USER_LIST_FILE " line %u\n", i); |
| continue; |
| } |
| q1++; |
| char *q2 = strchr(q1, '"'); |
| if(!q2) { |
| fprintf(stderr, "Warning: unmatched '\"' in file " USER_LIST_FILE " line %u\n", i); |
| continue; |
| } |
| char *space = strchr(q2 + 1, ' '); |
| if(!space) { |
| fprintf(stderr, "Warning: syntax error in file " USER_LIST_FILE " line %u\n", i); |
| continue; |
| } |
| size_t user_name_len = q2 - q1; |
| if(!user_name_len) { |
| fprintf(stderr, "Warning: empty user name in file " USER_LIST_FILE " line %u\n", i); |
| continue; |
| } |
| char *type_string = space + 1; |
| space = strchr(type_string, ' '); |
| if(!space) { |
| fprintf(stderr, "Warning: syntax error in file " USER_LIST_FILE " line %u\n", i); |
| continue; |
| } |
| size_t type_len = space - type_string; |
| enum key_types key_type_1 = get_key_type(type_string, type_len); |
| if(key_type_1 == KEY_INVALID) { |
| *space = 0; |
| fprintf(stderr, "Warning: invalid key type '%s' in file " USER_LIST_FILE " line %u\n", type_string, i); |
| continue; |
| } |
| const char *base64 = space + 1; |
| char buffer[32]; |
| size_t base64_len, inner_type_len; |
| if(get_length_and_type_string_length_of_key_in_base64(base64, &base64_len, &inner_type_len, buffer, sizeof buffer) < 0) return 1; |
| char *inner_key_type_string = buffer + 4; |
| enum key_types key_type_2 = get_key_type(inner_key_type_string, inner_type_len); |
| if(key_type_2 == KEY_INVALID) { |
| inner_key_type_string[inner_type_len] = 0; |
| fprintf(stderr, "Warning: invalid key type '%s' from BASE64 in file " USER_LIST_FILE " line %u\n", inner_key_type_string, i); |
| continue; |
| } |
| if(key_type_2 != key_type_1) { |
| fprintf(stderr, "Warning: key type didn't match in file " USER_LIST_FILE " line %u; key ignored\n", i); |
| continue; |
| } |
| *name = malloc(user_name_len + 1); |
| if(!*name) { |
| fprintf(stderr, "Error: allocate %zu bytes failed when processing file " USER_LIST_FILE " line %u\n", user_name_len + 1, i); |
| return -1; |
| } |
| memcpy(*name, q1, user_name_len); |
| (*name)[user_name_len] = 0; |
| *public_key = malloc(type_len + 1 + base64_len + 1); |
| if(!*public_key) { |
| fprintf(stderr, "Error: out of memory when processing file " USER_LIST_FILE " line %u\n", i); |
| return -1; |
| } |
| memcpy(*public_key, type_string, type_len + 1 + base64_len); |
| (*public_key)[type_len + 1 + base64_len] = 0; |
| if(comment) { |
| if(base64[base64_len] == ' ') { |
| *comment = strdup(base64 + base64_len + 1); |
| if(!*comment) { |
| fprintf(stderr, "Error: out of memory when processing file " USER_LIST_FILE " line %u\n", i); |
| return -1; |
| } |
| } else *comment = NULL; |
| } |
| if(key_type) *key_type = key_type_1; |
| if(line_len) *line_len = len; |
| return 0; |
| } |
| } |
| |
| static int remove_ssh_rc_file() { |
| struct stat st; |
| if(lstat(".ssh/rc", &st) < 0) { |
| if(errno == ENOENT) return 0; |
| perror(".ssh/rc"); |
| return -1; |
| } |
| if(S_ISDIR(st.st_mode)) { |
| fputs("'.ssh/rc' exists, and it is a directory!\n", stderr); |
| return -1; |
| } |
| fputs("sshout shouldn't have a SSH RC file '.ssh/rc'; removing\n", stderr); |
| if(unlink(".ssh/rc") < 0) { |
| perror("unlink: .ssh/rc"); |
| return -1; |
| } |
| return 0; |
| } |
| |
| static int ask_confirm() { |
| char answer[16]; |
| do { |
| int len = fgetline(stdin, answer, sizeof answer); |
| // Ignore line too long error |
| if(len == -1 || strncasecmp(answer, "no", 2) == 0 || strncmp(answer, "不", 3) == 0 || strcmp(answer, "否") == 0) { |
| return 0; |
| } |
| } while(strncasecmp(answer, "yes", 3) && strncmp(answer, "是", 3) && strncmp(answer, "好", 3) && strcmp(answer, "可以")); |
| return 1; |
| } |
| |
| static int adduser_command(int argc, char **argv) { |
| char *key = NULL; |
| int force = 0; |
| while(1) { |
| int c = getopt(argc, argv, "a:fh"); |
| if(c == -1) break; |
| switch(c) { |
| case 'a': |
| key = strdup(optarg); |
| if(!key) { |
| perror("strdup"); |
| return 1; |
| } |
| break; |
| case 'f': |
| force = 1; |
| break; |
| case 'h': |
| print_usage(argv[0]); |
| return 0; |
| case '?': |
| return -1; |
| } |
| } |
| if(argc - optind != 1) { |
| print_usage(argv[0]); |
| return -1; |
| } |
| const char *user = argv[optind]; |
| if(!is_valid_user_name(user)) { |
| fprintf(stderr, "Invalid user name '%s'\n", user); |
| return 1; |
| } |
| if(!key) { |
| key = malloc(4096); |
| if(!key) { |
| perror("malloc"); |
| return 1; |
| } |
| fprintf(stderr, "Input public key for %s: ", user); |
| if(fgetline(stdin, key, 4096) == -2) { |
| free(key); |
| fputs("Public key too long\n", stderr); |
| return 1; |
| } |
| } |
| |
| char *space = strchr(key, ' '); |
| if(space) { |
| size_t type_len = space - key; |
| enum key_types key_type = get_key_type(key, type_len); |
| if(key_type == KEY_INVALID) { |
| *space = 0; |
| fprintf(stderr, "Invalid key type '%s'\n", key); |
| return 1; |
| } |
| const char *base64 = space + 1; |
| char buffer[32]; |
| size_t base64_len, inner_type_len; |
| if(get_length_and_type_string_length_of_key_in_base64(base64, &base64_len, &inner_type_len, buffer, sizeof buffer) < 0) return 1; |
| char *inner_key_type_string = buffer + 4; |
| enum key_types inner_key_type = get_key_type(inner_key_type_string, inner_type_len); |
| if(inner_key_type == KEY_INVALID) { |
| inner_key_type_string[inner_type_len] = 0; |
| fprintf(stderr, "Invalid key type '%s'\n", inner_key_type_string); |
| return 1; |
| } |
| if(inner_key_type != key_type) { |
| fputs("Invalid key: key type didn't match\n", stderr); |
| return 1; |
| } |
| } else { |
| char buffer[32]; |
| size_t base64_len, type_len; |
| if(get_length_and_type_string_length_of_key_in_base64(key, &base64_len, &type_len, buffer, sizeof buffer) < 0) return 1; |
| char *key_type_string = buffer + 4; |
| enum key_types key_type = get_key_type(key_type_string, type_len); |
| if(key_type == KEY_INVALID) { |
| key_type_string[type_len] = 0; |
| fprintf(stderr, "Invalid key type '%s'\n", key_type_string); |
| return 1; |
| } |
| char *type_and_key_in_base64 = malloc(type_len + 1 + base64_len + 1); |
| if(!type_and_key_in_base64) { |
| perror("malloc"); |
| return 1; |
| } |
| memcpy(type_and_key_in_base64, key_type_string, type_len); |
| type_and_key_in_base64[type_len] = ' '; |
| memcpy(type_and_key_in_base64 + type_len + 1, key, base64_len); |
| type_and_key_in_base64[type_len + 1 + base64_len] = 0; |
| free(key); |
| key = type_and_key_in_base64; |
| } |
| |
| struct stat st; |
| if(stat(".ssh", &st) == 0) { |
| if(!S_ISDIR(st.st_mode)) { |
| free(key); |
| fputs("'.ssh' is not a directory\n", stderr); |
| return 1; |
| } |
| uid_t myuid = getuid(); |
| if(st.st_uid != myuid) { |
| free(key); |
| fprintf(stderr, "'.ssh' is not owned by sshout (%u != %u)\n", st.st_uid, myuid); |
| return 1; |
| } |
| if(st.st_mode & S_IWOTH) { |
| fputs("'.ssh' is global writable\n", stderr); |
| if(chmod(".ssh", st.st_mode & ~(S_IWOTH)) < 0) { |
| perror("chmod: .ssh"); |
| free(key); |
| return 1; |
| } |
| fputs("fixed\n", stderr); |
| } |
| if(remove_ssh_rc_file() < 0) { |
| free(key); |
| fputs("Cannot continue\n", stderr); |
| return 1; |
| } |
| } else if(mkdir(".ssh", 0755) < 0) { |
| perror("mkdir: .ssh"); |
| free(key); |
| return 1; |
| } |
| |
| FILE *f = fopen(USER_LIST_FILE, "a+"); |
| if(!f) { |
| perror(USER_LIST_FILE); |
| free(key); |
| return 1; |
| } |
| |
| int existing_count = 0; |
| { |
| char *user_name, *public_key; |
| while(read_user_info(f, &user_name, &public_key, NULL, NULL, NULL) == 0) { |
| if(strcmp(key, public_key) == 0) { |
| free(key); |
| fprintf(stderr, "This public key is already used by user %s.\n" |
| "Are you pasted wrong key?\n", user_name); |
| free(user_name); |
| free(public_key); |
| return 1; |
| } |
| if(strcmp(user, user_name) == 0) existing_count++; |
| free(user_name); |
| free(public_key); |
| } |
| } |
| if(existing_count) { |
| fprintf(stderr, "%d key%s already exist for user %s\n", existing_count, existing_count > 1 ? "s" : "", user); |
| if(!force) { |
| fprintf(stderr, "Are you sure you want to add this key for user %s? ", user); |
| if(!ask_confirm()) { |
| fputs("Operation canceled\n", stderr); |
| free(key); |
| return 1; |
| } |
| } |
| } |
| |
| if(fprintf(f, "command=\"%s\",no-agent-forwarding,no-port-forwarding %s\n", user, key) < 0) { |
| perror("fprintf"); |
| free(key); |
| return 1; |
| } |
| free(key); |
| return 0; |
| } |
| |
| static int removeuser_command(int argc, char **argv) { |
| int force = 0; |
| while(1) { |
| int c = getopt(argc, argv, "fh"); |
| if(c == -1) break; |
| switch(c) { |
| case 'f': |
| force = 1; |
| break; |
| case 'h': |
| print_usage(argv[0]); |
| return 0; |
| case '?': |
| return -1; |
| } |
| } |
| if(argc - optind != 1) { |
| print_usage(argv[0]); |
| return -1; |
| } |
| const char *user = argv[optind]; |
| if(!is_valid_user_name(user)) { |
| fprintf(stderr, "Invalid user name '%s'\n", user); |
| return 1; |
| } |
| |
| FILE *f = fopen(USER_LIST_FILE, "r+"); |
| if(!f) { |
| perror(USER_LIST_FILE); |
| return 1; |
| } |
| |
| struct line_info { |
| long int end_offset; |
| size_t length; |
| } *match_lines = NULL; |
| size_t line_count = 0, match_lines_allocated_size = 0; |
| char *user_name, *public_key; |
| size_t line_len; |
| while(read_user_info(f, &user_name, &public_key, NULL, NULL, &line_len) == 0) { |
| if(strcmp(user, user_name) == 0) { |
| if(line_count * sizeof(struct line_info) >= match_lines_allocated_size) { |
| match_lines = realloc(match_lines, match_lines_allocated_size += 2 * sizeof(struct line_info)); |
| if(!match_lines) { |
| perror("realloc"); |
| return 1; |
| } |
| } |
| match_lines[line_count].end_offset = ftell(f); |
| match_lines[line_count].length = line_len; |
| line_count++; |
| } |
| free(user_name); |
| free(public_key); |
| } |
| |
| if(!line_count) { |
| fclose(f); |
| fprintf(stderr, "User %s not found\n", user); |
| return 1; |
| } |
| |
| if(line_count == 1) { |
| if(!force) { |
| fprintf(stderr, "Remove user %s from SSHOUT user list? ", user); |
| if(!ask_confirm()) { |
| fclose(f); |
| fputs("Operation canceled\n", stderr); |
| return 1; |
| } |
| } |
| if(fseek(f, match_lines->end_offset, SEEK_SET) < 0 || |
| fbackwardoverwrite(f, match_lines->length + 1) < 0) { |
| perror("Failed to remove user"); |
| fclose(f); |
| return 1; |
| } |
| if(fclose(f) == EOF) { |
| perror("fclose"); |
| return 1; |
| } |
| return 0; |
| } else { |
| if(!force) { |
| fprintf(stderr, "User %s have %zu public keys registered in the user list\n", user, line_count); |
| fprintf(stderr, "If you want to remove only some of the user's keys, edit file '%s/ " USER_LIST_FILE "' manually\n", |
| getenv("HOME")); |
| fprintf(stderr, "Remove all keys for user %s? ", user); |
| if(!ask_confirm()) { |
| fclose(f); |
| fputs("Operation canceled\n", stderr); |
| return 1; |
| } |
| } |
| unsigned int i = line_count; |
| do { |
| i--; |
| if(fseek(f, match_lines[i].end_offset, SEEK_SET) < 0 || |
| fbackwardoverwrite(f, match_lines[i].length + 1) < 0) { |
| perror("Failed to remove user"); |
| fprintf(stderr, "when removing key %u from user list\n", i); |
| fclose(f); |
| return 1; |
| } |
| } while(i > 0); |
| if(fclose(f) == EOF) { |
| perror("fclose"); |
| return 1; |
| } |
| fprintf(stderr, "Removed %zu keys for user %s\n", line_count, user); |
| return 0; |
| } |
| } |
| |
| static int listuser_command(int argc, char **argv) { |
| hashid hash_type = -1; |
| while(1) { |
| int c = getopt(argc, argv, "h:"); |
| if(c == -1) break; |
| switch(c) { |
| case 'h': |
| if(strcmp(optarg, "md5") == 0) hash_type = MHASH_MD5; |
| else if(strcmp(optarg, "sha256") == 0) hash_type = MHASH_SHA256; |
| else { |
| fprintf(stderr, "Invalid hash algorithm '%s'\n", optarg); |
| return -1; |
| } |
| break; |
| case '?': |
| print_usage(argv[0]); |
| return -1; |
| } |
| } |
| |
| if(remove_ssh_rc_file() < 0) { |
| fputs("Warning: configuration error left unresolved\n", stderr); |
| } |
| |
| FILE *f = fopen(USER_LIST_FILE, "r"); |
| if(!f) { |
| perror(USER_LIST_FILE); |
| return 1; |
| } |
| |
| char *user_name, *public_key, *comment; |
| while(read_user_info(f, &user_name, &public_key, &comment, NULL, NULL) == 0) { |
| //printf("User \"%s\", Public key \"%s\"", user_name, public_key); |
| printf("User \"%s\", ", user_name); |
| if((int)hash_type == -1) { |
| printf("Public key \"%s\"", public_key); |
| } else { |
| MHASH h = mhash_init(hash_type); |
| if(h == MHASH_FAILED) { |
| fputs("Cannot start hash public key\n", stderr); |
| return 1; |
| } |
| char *space = strchr(public_key, ' '); |
| if(!space) { |
| fputs("Invalid key\n", stderr); |
| return 1; |
| } |
| char *base64 = space + 1; |
| int len = strlen(base64); |
| char buffer[len]; |
| len = base64_decode(base64, len, buffer, sizeof buffer); |
| if(len < 0) { |
| fputs("Invalid BASE64 encoding\n", stderr); |
| return 1; |
| } |
| if(len < 8) { |
| fputs("Invalid key\n", stderr); |
| return 1; |
| } |
| size_t type_len = ntohl(*(uint32_t *)buffer); |
| if(type_len > len - 4) { |
| fputs("Invalid key\n", stderr); |
| return 1; |
| } |
| printf("Public key fingerprint %s ", key_type_to_string(get_key_type(buffer + 4, type_len))); |
| mhash(h, buffer, len); |
| unsigned char *hash = mhash_end(h); |
| unsigned int i = 0, hash_len = mhash_get_block_size(hash_type); |
| if(hash_type == MHASH_SHA256) { |
| char buffer[44]; |
| len = base64_encode(hash, hash_len, buffer, sizeof buffer, 0); |
| fputs(len < 0 ? "Cannot encode SHA-256 fingerprint" : buffer, stdout); |
| } else while(i < hash_len) { |
| if(i) putchar(':'); |
| printf("%.2hhx", hash[i++]); |
| } |
| } |
| if(comment) printf(", Comment \"%s\"", comment); |
| putchar('\n'); |
| free(user_name); |
| free(public_key); |
| free(comment); |
| } |
| return 0; |
| } |
| |
| static int getmotd_command(int argc, char **argv) { |
| char buffer[4096]; |
| int fd = open(SSHOUT_MOTD_FILE, O_RDONLY); |
| if(fd == -1) { |
| perror(SSHOUT_MOTD_FILE); |
| return 1; |
| } |
| while(1) { |
| int s = sync_read(fd, buffer, sizeof buffer); |
| if(s < 0) { |
| perror("read"); |
| return 1; |
| } |
| if(!s) return 0; |
| s = sync_write(STDOUT_FILENO, buffer, s); |
| if(s < 0) { |
| perror("write"); |
| return 1; |
| } |
| } |
| } |
| |
| static int setmotd_command(int argc, char **argv) { |
| const char *message = NULL; |
| int need_del = 0; |
| while(1) { |
| int c = getopt(argc, argv, "m:dh"); |
| if(c == -1) break; |
| switch(c) { |
| case 'm': |
| message = optarg; |
| break; |
| case 'd': |
| need_del = 1; |
| break; |
| case 'h': |
| print_usage(argv[0]); |
| return 0; |
| case '?': |
| print_usage(argv[0]); |
| return -1; |
| } |
| } |
| if(need_del) { |
| if(message) { |
| fputs("Option '-d' cannot be used together with '-m'\n", stderr); |
| return -1; |
| } |
| if(unlink(SSHOUT_MOTD_FILE) < 0) { |
| perror(SSHOUT_MOTD_FILE); |
| return 1; |
| } |
| return 0; |
| } |
| int fd = creat(SSHOUT_MOTD_FILE, 0600); |
| if(fd == -1) { |
| perror(SSHOUT_MOTD_FILE); |
| return 1; |
| } |
| if(message) { |
| size_t len = strlen(message); |
| int s = sync_write(fd, message, len); |
| if(s < 0) { |
| perror("write"); |
| return 1; |
| } |
| if(len && message[len - 1] != '\n') { |
| char new_line = '\n'; |
| if(sync_write(fd, &new_line, 1) < 0) { |
| perror("write"); |
| return 1; |
| } |
| } |
| return 0; |
| } else { |
| char buffer[4096]; |
| if(isatty(STDIN_FILENO)) fputs("Type message below:\n", stderr); |
| while(1) { |
| int s = read(STDIN_FILENO, buffer, sizeof buffer); |
| if(s < 0) { |
| if(errno == EINTR) continue; |
| perror("read"); |
| return 1; |
| } |
| if(!s) return 0; |
| s = sync_write(fd, buffer, s); |
| if(s < 0) { |
| perror("write"); |
| return 1; |
| } |
| } |
| } |
| } |
| |
| static struct subcommand { |
| const char *name; |
| const char *usage; |
| int (*func)(int, char **); |
| } commands[] = { |
| #define SUBCOMMAND(N,U) { #N, U, N##_command } |
| SUBCOMMAND(adduser, "[-a <public-key-in-base64>] [-f] <user-name>"), |
| SUBCOMMAND(removeuser, "[-f] <user-name>"), |
| SUBCOMMAND(listuser, "[-h {md5|sha256}]"), |
| SUBCOMMAND(getmotd, ""), |
| SUBCOMMAND(setmotd, "[-m <message> | -d]"), |
| #undef SUBCOMMAND |
| { NULL, NULL, NULL } |
| }; |
| |
| static void print_commands() { |
| struct subcommand *c = commands; |
| fputs("Following subcommands are available:\n", stderr); |
| while(c->name) { |
| fprintf(stderr, " %s %s\n", c->name, c->usage); |
| c++; |
| } |
| } |
| |
| static void print_usage(const char *name) { |
| struct subcommand *c = commands; |
| while(c->name) { |
| if(strcmp(c->name, name) == 0) { |
| fprintf(stderr, "Usage: %s %s\n", name, c->usage); |
| return; |
| } |
| c++; |
| } |
| fprintf(stderr, "Error: cannot find usage for command '%s'", name); |
| } |
| |
| int main(int argc, char **argv) { |
| struct passwd *pw = getpwnam("sshout"); |
| if(!pw) { |
| fputs("sshout user account not exist\n", stderr); |
| return 1; |
| } |
| if(pw->pw_uid == 0) { |
| fputs("sshout user account have UID 0\n", stderr); |
| return 1; |
| } |
| |
| if(argc < 2) { |
| print_commands(); |
| return -1; |
| } |
| |
| uid_t myeuid = geteuid(); |
| if(myeuid == 0) { |
| if(setreuid(pw->pw_uid, pw->pw_uid) < 0) { |
| perror("setreuid"); |
| return 1; |
| } |
| } else if(myeuid != pw->pw_uid) { |
| fprintf(stderr, "Current effective UID %u doesn't equal to sshout user account\n", myeuid); |
| return 1; |
| } |
| |
| const char *home = pw->pw_dir; |
| struct stat st; |
| if(stat(home, &st) < 0) { |
| perror(home); |
| return 1; |
| } |
| if(st.st_uid != pw->pw_uid) { |
| fprintf(stderr, "Home directory '%s' is not owned by sshout (expecting UID=%u, got %u)\n", home, pw->pw_uid, st.st_uid); |
| return 1; |
| } |
| setenv("HOME", home, 1); |
| if(chdir(home) < 0) { |
| perror(home); |
| return 1; |
| } |
| |
| struct subcommand *c = commands; |
| while(c->name) { |
| if(strcmp(argv[1], c->name) == 0) return c->func(argc - 1, argv + 1); |
| c++; |
| } |
| fprintf(stderr, "Unknown command '%s'\n", argv[1]); |
| print_commands(); |
| return -1; |
| } |