| #!/bin/bash |
| # |
| # ssh-user-config, Copyright 2000, 2001, 2002, 2003, Red Hat Inc. |
| # |
| # This file is part of the Cygwin port of OpenSSH. |
| |
| # ====================================================================== |
| # Initialization |
| # ====================================================================== |
| PROGNAME=$(basename -- $0) |
| _tdir=$(dirname -- $0) |
| PROGDIR=$(cd $_tdir && pwd) |
| |
| CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh |
| |
| # Subdirectory where the new package is being installed |
| PREFIX=/usr |
| |
| # Directory where the config files are stored |
| SYSCONFDIR=/etc |
| |
| source ${CSIH_SCRIPT} |
| |
| auto_passphrase="no" |
| passphrase="" |
| pwdhome= |
| with_passphrase= |
| |
| # ====================================================================== |
| # Routine: create_ssh1_identity |
| # optionally create ~/.ssh/identity[.pub] |
| # optionally add result to ~/.ssh/authorized_keys |
| # ====================================================================== |
| create_ssh1_identity() { |
| if [ ! -f "${pwdhome}/.ssh/identity" ] |
| then |
| if csih_request "Shall I create an SSH1 RSA identity file for you?" |
| then |
| csih_inform "Generating ${pwdhome}/.ssh/identity" |
| if [ "${with_passphrase}" = "yes" ] |
| then |
| ssh-keygen -t rsa1 -N "${passphrase}" -f "${pwdhome}/.ssh/identity" > /dev/null |
| else |
| ssh-keygen -t rsa1 -f "${pwdhome}/.ssh/identity" > /dev/null |
| fi |
| if csih_request "Do you want to use this identity to login to this machine?" |
| then |
| csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" |
| cat "${pwdhome}/.ssh/identity.pub" >> "${pwdhome}/.ssh/authorized_keys" |
| fi |
| fi |
| fi |
| } # === End of create_ssh1_identity() === # |
| readonly -f create_ssh1_identity |
| |
| # ====================================================================== |
| # Routine: create_ssh2_rsa_identity |
| # optionally create ~/.ssh/id_rsa[.pub] |
| # optionally add result to ~/.ssh/authorized_keys |
| # ====================================================================== |
| create_ssh2_rsa_identity() { |
| if [ ! -f "${pwdhome}/.ssh/id_rsa" ] |
| then |
| if csih_request "Shall I create an SSH2 RSA identity file for you?" |
| then |
| csih_inform "Generating ${pwdhome}/.ssh/id_rsa" |
| if [ "${with_passphrase}" = "yes" ] |
| then |
| ssh-keygen -t rsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_rsa" > /dev/null |
| else |
| ssh-keygen -t rsa -f "${pwdhome}/.ssh/id_rsa" > /dev/null |
| fi |
| if csih_request "Do you want to use this identity to login to this machine?" |
| then |
| csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" |
| cat "${pwdhome}/.ssh/id_rsa.pub" >> "${pwdhome}/.ssh/authorized_keys" |
| fi |
| fi |
| fi |
| } # === End of create_ssh2_rsa_identity() === # |
| readonly -f create_ssh2_rsa_identity |
| |
| # ====================================================================== |
| # Routine: create_ssh2_dsa_identity |
| # optionally create ~/.ssh/id_dsa[.pub] |
| # optionally add result to ~/.ssh/authorized_keys |
| # ====================================================================== |
| create_ssh2_dsa_identity() { |
| if [ ! -f "${pwdhome}/.ssh/id_dsa" ] |
| then |
| if csih_request "Shall I create an SSH2 DSA identity file for you?" |
| then |
| csih_inform "Generating ${pwdhome}/.ssh/id_dsa" |
| if [ "${with_passphrase}" = "yes" ] |
| then |
| ssh-keygen -t dsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_dsa" > /dev/null |
| else |
| ssh-keygen -t dsa -f "${pwdhome}/.ssh/id_dsa" > /dev/null |
| fi |
| if csih_request "Do you want to use this identity to login to this machine?" |
| then |
| csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" |
| cat "${pwdhome}/.ssh/id_dsa.pub" >> "${pwdhome}/.ssh/authorized_keys" |
| fi |
| fi |
| fi |
| } # === End of create_ssh2_dsa_identity() === # |
| readonly -f create_ssh2_dsa_identity |
| |
| # ====================================================================== |
| # Routine: check_user_homedir |
| # Perform various checks on the user's home directory |
| # SETS GLOBAL VARIABLE: |
| # pwdhome |
| # ====================================================================== |
| check_user_homedir() { |
| local uid=$(id -u) |
| pwdhome=$(awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd) |
| if [ "X${pwdhome}" = "X" ] |
| then |
| csih_error_multiline \ |
| "There is no home directory set for you in ${SYSCONFDIR}/passwd." \ |
| 'Setting $HOME is not sufficient!' |
| fi |
| |
| if [ ! -d "${pwdhome}" ] |
| then |
| csih_error_multiline \ |
| "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" \ |
| 'but it is not a valid directory. Cannot create user identity files.' |
| fi |
| |
| # If home is the root dir, set home to empty string to avoid error messages |
| # in subsequent parts of that script. |
| if [ "X${pwdhome}" = "X/" ] |
| then |
| # But first raise a warning! |
| csih_warning "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!" |
| if csih_request "Would you like to proceed anyway?" |
| then |
| pwdhome='' |
| else |
| csih_warning "Exiting. Configuration is not complete" |
| exit 1 |
| fi |
| fi |
| |
| if [ -d "${pwdhome}" -a csih_is_nt -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ] |
| then |
| echo |
| csih_warning 'group and other have been revoked write permission to your home' |
| csih_warning "directory ${pwdhome}." |
| csih_warning 'This is required by OpenSSH to allow public key authentication using' |
| csih_warning 'the key files stored in your .ssh subdirectory.' |
| csih_warning 'Revert this change ONLY if you know what you are doing!' |
| echo |
| fi |
| } # === End of check_user_homedir() === # |
| readonly -f check_user_homedir |
| |
| # ====================================================================== |
| # Routine: check_user_dot_ssh_dir |
| # Perform various checks on the ~/.ssh directory |
| # PREREQUISITE: |
| # pwdhome -- check_user_homedir() |
| # ====================================================================== |
| check_user_dot_ssh_dir() { |
| if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ] |
| then |
| csih_error "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files." |
| fi |
| |
| if [ ! -e "${pwdhome}/.ssh" ] |
| then |
| mkdir "${pwdhome}/.ssh" |
| if [ ! -e "${pwdhome}/.ssh" ] |
| then |
| csih_error "Creating users ${pwdhome}/.ssh directory failed" |
| fi |
| fi |
| } # === End of check_user_dot_ssh_dir() === # |
| readonly -f check_user_dot_ssh_dir |
| |
| # ====================================================================== |
| # Routine: fix_authorized_keys_perms |
| # Corrects the permissions of ~/.ssh/authorized_keys |
| # PREREQUISITE: |
| # pwdhome -- check_user_homedir() |
| # ====================================================================== |
| fix_authorized_keys_perms() { |
| if [ csih_is_nt -a -e "${pwdhome}/.ssh/authorized_keys" ] |
| then |
| if ! setfacl -m "u::rw-,g::---,o::---" "${pwdhome}/.ssh/authorized_keys" |
| then |
| csih_warning "Setting correct permissions to ${pwdhome}/.ssh/authorized_keys" |
| csih_warning "failed. Please care for the correct permissions. The minimum requirement" |
| csih_warning "is, the owner needs read permissions." |
| echo |
| fi |
| fi |
| } # === End of fix_authorized_keys_perms() === # |
| readonly -f fix_authorized_keys_perms |
| |
| |
| # ====================================================================== |
| # Main Entry Point |
| # ====================================================================== |
| |
| # Check how the script has been started. If |
| # (1) it has been started by giving the full path and |
| # that path is /etc/postinstall, OR |
| # (2) Otherwise, if the environment variable |
| # SSH_USER_CONFIG_AUTO_ANSWER_NO is set |
| # then set auto_answer to "no". This allows automatic |
| # creation of the config files in /etc w/o overwriting |
| # them if they already exist. In both cases, color |
| # escape sequences are suppressed, so as to prevent |
| # cluttering setup's logfiles. |
| if [ "$PROGDIR" = "/etc/postinstall" ] |
| then |
| csih_auto_answer="no" |
| csih_disable_color |
| fi |
| if [ -n "${SSH_USER_CONFIG_AUTO_ANSWER_NO}" ] |
| then |
| csih_auto_answer="no" |
| csih_disable_color |
| fi |
| |
| # ====================================================================== |
| # Parse options |
| # ====================================================================== |
| while : |
| do |
| case $# in |
| 0) |
| break |
| ;; |
| esac |
| |
| option=$1 |
| shift |
| |
| case "$option" in |
| -d | --debug ) |
| set -x |
| csih_trace_on |
| ;; |
| |
| -y | --yes ) |
| csih_auto_answer=yes |
| ;; |
| |
| -n | --no ) |
| csih_auto_answer=no |
| ;; |
| |
| -p | --passphrase ) |
| with_passphrase="yes" |
| passphrase=$1 |
| shift |
| ;; |
| |
| --privileged ) |
| csih_FORCE_PRIVILEGED_USER=yes |
| ;; |
| |
| *) |
| echo "usage: ${PROGNAME} [OPTION]..." |
| echo |
| echo "This script creates an OpenSSH user configuration." |
| echo |
| echo "Options:" |
| echo " --debug -d Enable shell's debug output." |
| echo " --yes -y Answer all questions with \"yes\" automatically." |
| echo " --no -n Answer all questions with \"no\" automatically." |
| echo " --passphrase -p word Use \"word\" as passphrase automatically." |
| echo " --privileged On Windows NT/2k/XP, assume privileged user" |
| echo " instead of LocalSystem for sshd service." |
| echo |
| exit 1 |
| ;; |
| |
| esac |
| done |
| |
| # ====================================================================== |
| # Action! |
| # ====================================================================== |
| |
| # Check passwd file |
| if [ ! -f ${SYSCONFDIR}/passwd ] |
| then |
| csih_error_multiline \ |
| "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" \ |
| 'first using mkpasswd. Check if it contains an entry for you and' \ |
| 'please care for the home directory in your entry as well.' |
| fi |
| |
| check_user_homedir |
| check_user_dot_ssh_dir |
| create_ssh1_identity |
| create_ssh2_rsa_identity |
| create_ssh2_dsa_identity |
| fix_authorized_keys_perms |
| |
| echo |
| csih_inform "Configuration finished. Have fun!" |
| |
| |