1#!/bin/bash 2# 3# ssh-user-config, Copyright 2000-2014 Red Hat Inc. 4# 5# This file is part of the Cygwin port of OpenSSH. 6# 7# Permission to use, copy, modify, and distribute this software for any 8# purpose with or without fee is hereby granted, provided that the above 9# copyright notice and this permission notice appear in all copies. 10# 11# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 13# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 14# IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, 15# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR 16# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR 17# THE USE OR OTHER DEALINGS IN THE SOFTWARE. 18 19# ====================================================================== 20# Initialization 21# ====================================================================== 22PROGNAME=$(basename -- $0) 23_tdir=$(dirname -- $0) 24PROGDIR=$(cd $_tdir && pwd) 25 26CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh 27 28# Subdirectory where the new package is being installed 29PREFIX=/usr 30 31# Directory where the config files are stored 32SYSCONFDIR=/etc 33 34source ${CSIH_SCRIPT} 35 36auto_passphrase="no" 37passphrase="" 38pwdhome= 39with_passphrase= 40 41# ====================================================================== 42# Routine: create_identity 43# optionally create identity of type argument in ~/.ssh 44# optionally add result to ~/.ssh/authorized_keys 45# ====================================================================== 46create_identity() { 47 local file="$1" 48 local type="$2" 49 local name="$3" 50 if [ ! -f "${pwdhome}/.ssh/${file}" ] 51 then 52 if csih_request "Shall I create a ${name} identity file for you?" 53 then 54 csih_inform "Generating ${pwdhome}/.ssh/${file}" 55 if [ "${with_passphrase}" = "yes" ] 56 then 57 ssh-keygen -t "${type}" -N "${passphrase}" -f "${pwdhome}/.ssh/${file}" > /dev/null 58 else 59 ssh-keygen -t "${type}" -f "${pwdhome}/.ssh/${file}" > /dev/null 60 fi 61 if csih_request "Do you want to use this identity to login to this machine?" 62 then 63 csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" 64 cat "${pwdhome}/.ssh/${file}.pub" >> "${pwdhome}/.ssh/authorized_keys" 65 fi 66 fi 67 fi 68} # === End of create_ssh1_identity() === # 69readonly -f create_identity 70 71# ====================================================================== 72# Routine: check_user_homedir 73# Perform various checks on the user's home directory 74# SETS GLOBAL VARIABLE: 75# pwdhome 76# ====================================================================== 77check_user_homedir() { 78 pwdhome=$(getent passwd $UID | awk -F: '{ print $6; }') 79 if [ "X${pwdhome}" = "X" ] 80 then 81 csih_error_multi \ 82 "There is no home directory set for you in the account database." \ 83 'Setting $HOME is not sufficient!' 84 fi 85 86 if [ ! -d "${pwdhome}" ] 87 then 88 csih_error_multi \ 89 "${pwdhome} is set in the account database as your home directory" \ 90 'but it is not a valid directory. Cannot create user identity files.' 91 fi 92 93 # If home is the root dir, set home to empty string to avoid error messages 94 # in subsequent parts of that script. 95 if [ "X${pwdhome}" = "X/" ] 96 then 97 # But first raise a warning! 98 csih_warning "Your home directory in the account database is set to root (/). This is not recommended!" 99 if csih_request "Would you like to proceed anyway?" 100 then 101 pwdhome='' 102 else 103 csih_warning "Exiting. Configuration is not complete" 104 exit 1 105 fi 106 fi 107 108 if [ -d "${pwdhome}" -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ] 109 then 110 echo 111 csih_warning 'group and other have been revoked write permission to your home' 112 csih_warning "directory ${pwdhome}." 113 csih_warning 'This is required by OpenSSH to allow public key authentication using' 114 csih_warning 'the key files stored in your .ssh subdirectory.' 115 csih_warning 'Revert this change ONLY if you know what you are doing!' 116 echo 117 fi 118} # === End of check_user_homedir() === # 119readonly -f check_user_homedir 120 121# ====================================================================== 122# Routine: check_user_dot_ssh_dir 123# Perform various checks on the ~/.ssh directory 124# PREREQUISITE: 125# pwdhome -- check_user_homedir() 126# ====================================================================== 127check_user_dot_ssh_dir() { 128 if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ] 129 then 130 csih_error "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files." 131 fi 132 133 if [ ! -e "${pwdhome}/.ssh" ] 134 then 135 mkdir "${pwdhome}/.ssh" 136 if [ ! -e "${pwdhome}/.ssh" ] 137 then 138 csih_error "Creating users ${pwdhome}/.ssh directory failed" 139 fi 140 fi 141} # === End of check_user_dot_ssh_dir() === # 142readonly -f check_user_dot_ssh_dir 143 144# ====================================================================== 145# Routine: fix_authorized_keys_perms 146# Corrects the permissions of ~/.ssh/authorized_keys 147# PREREQUISITE: 148# pwdhome -- check_user_homedir() 149# ====================================================================== 150fix_authorized_keys_perms() { 151 if [ -e "${pwdhome}/.ssh/authorized_keys" ] 152 then 153 setfacl -b "${pwdhome}/.ssh/authorized_keys" 2>/dev/null || echo -n 154 if ! chmod u-x,g-wx,o-wx "${pwdhome}/.ssh/authorized_keys" 155 then 156 csih_warning "Setting correct permissions to ${pwdhome}/.ssh/authorized_keys" 157 csih_warning "failed. Please care for the correct permissions. The minimum requirement" 158 csih_warning "is, the owner needs read permissions." 159 echo 160 fi 161 fi 162} # === End of fix_authorized_keys_perms() === # 163readonly -f fix_authorized_keys_perms 164 165 166# ====================================================================== 167# Main Entry Point 168# ====================================================================== 169 170# Check how the script has been started. If 171# (1) it has been started by giving the full path and 172# that path is /etc/postinstall, OR 173# (2) Otherwise, if the environment variable 174# SSH_USER_CONFIG_AUTO_ANSWER_NO is set 175# then set auto_answer to "no". This allows automatic 176# creation of the config files in /etc w/o overwriting 177# them if they already exist. In both cases, color 178# escape sequences are suppressed, so as to prevent 179# cluttering setup's logfiles. 180if [ "$PROGDIR" = "/etc/postinstall" ] 181then 182 csih_auto_answer="no" 183 csih_disable_color 184fi 185if [ -n "${SSH_USER_CONFIG_AUTO_ANSWER_NO}" ] 186then 187 csih_auto_answer="no" 188 csih_disable_color 189fi 190 191# ====================================================================== 192# Parse options 193# ====================================================================== 194while : 195do 196 case $# in 197 0) 198 break 199 ;; 200 esac 201 202 option=$1 203 shift 204 205 case "$option" in 206 -d | --debug ) 207 set -x 208 csih_trace_on 209 ;; 210 211 -y | --yes ) 212 csih_auto_answer=yes 213 ;; 214 215 -n | --no ) 216 csih_auto_answer=no 217 ;; 218 219 -p | --passphrase ) 220 with_passphrase="yes" 221 passphrase=$1 222 shift 223 ;; 224 225 *) 226 echo "usage: ${PROGNAME} [OPTION]..." 227 echo 228 echo "This script creates an OpenSSH user configuration." 229 echo 230 echo "Options:" 231 echo " --debug -d Enable shell's debug output." 232 echo " --yes -y Answer all questions with \"yes\" automatically." 233 echo " --no -n Answer all questions with \"no\" automatically." 234 echo " --passphrase -p word Use \"word\" as passphrase automatically." 235 echo 236 exit 1 237 ;; 238 239 esac 240done 241 242# ====================================================================== 243# Action! 244# ====================================================================== 245 246check_user_homedir 247check_user_dot_ssh_dir 248create_identity id_rsa rsa "SSH2 RSA" 249create_identity id_dsa dsa "SSH2 DSA" 250create_identity id_ecdsa ecdsa "SSH2 ECDSA" 251create_identity identity rsa1 "(deprecated) SSH1 RSA" 252fix_authorized_keys_perms 253 254echo 255csih_inform "Configuration finished. Have fun!" 256 257 258