1 #!/bin/bash 2 # 3 # ssh-user-config, Copyright 2000-2008 Red Hat Inc. 4 # 5 # This file is part of the Cygwin port of OpenSSH. 6 # 7 # Permission to use, copy, modify, and distribute this software for any 8 # purpose with or without fee is hereby granted, provided that the above 9 # copyright notice and this permission notice appear in all copies. 10 # 11 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 # OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 13 # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 14 # IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, 15 # DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR 16 # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR 17 # THE USE OR OTHER DEALINGS IN THE SOFTWARE. 18 19 # ====================================================================== 20 # Initialization 21 # ====================================================================== 22 PROGNAME=$(basename -- $0) 23 _tdir=$(dirname -- $0) 24 PROGDIR=$(cd $_tdir && pwd) 25 26 CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh 27 28 # Subdirectory where the new package is being installed 29 PREFIX=/usr 30 31 # Directory where the config files are stored 32 SYSCONFDIR=/etc 33 34 source ${CSIH_SCRIPT} 35 36 auto_passphrase="no" 37 passphrase="" 38 pwdhome= 39 with_passphrase= 40 41 # ====================================================================== 42 # Routine: create_identity 43 # optionally create identity of type argument in ~/.ssh 44 # optionally add result to ~/.ssh/authorized_keys 45 # ====================================================================== 46 create_identity() { 47 local file="$1" 48 local type="$2" 49 local name="$3" 50 if [ ! -f "${pwdhome}/.ssh/${file}" ] 51 then 52 if csih_request "Shall I create a ${name} identity file for you?" 53 then 54 csih_inform "Generating ${pwdhome}/.ssh/${file}" 55 if [ "${with_passphrase}" = "yes" ] 56 then 57 ssh-keygen -t "${type}" -N "${passphrase}" -f "${pwdhome}/.ssh/${file}" > /dev/null 58 else 59 ssh-keygen -t "${type}" -f "${pwdhome}/.ssh/${file}" > /dev/null 60 fi 61 if csih_request "Do you want to use this identity to login to this machine?" 62 then 63 csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" 64 cat "${pwdhome}/.ssh/${file}.pub" >> "${pwdhome}/.ssh/authorized_keys" 65 fi 66 fi 67 fi 68 } # === End of create_ssh1_identity() === # 69 readonly -f create_identity 70 71 # ====================================================================== 72 # Routine: check_user_homedir 73 # Perform various checks on the user's home directory 74 # SETS GLOBAL VARIABLE: 75 # pwdhome 76 # ====================================================================== 77 check_user_homedir() { 78 local uid=$(id -u) 79 pwdhome=$(awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd) 80 if [ "X${pwdhome}" = "X" ] 81 then 82 csih_error_multi \ 83 "There is no home directory set for you in ${SYSCONFDIR}/passwd." \ 84 'Setting $HOME is not sufficient!' 85 fi 86 87 if [ ! -d "${pwdhome}" ] 88 then 89 csih_error_multi \ 90 "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" \ 91 'but it is not a valid directory. Cannot create user identity files.' 92 fi 93 94 # If home is the root dir, set home to empty string to avoid error messages 95 # in subsequent parts of that script. 96 if [ "X${pwdhome}" = "X/" ] 97 then 98 # But first raise a warning! 99 csih_warning "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!" 100 if csih_request "Would you like to proceed anyway?" 101 then 102 pwdhome='' 103 else 104 csih_warning "Exiting. Configuration is not complete" 105 exit 1 106 fi 107 fi 108 109 if [ -d "${pwdhome}" -a csih_is_nt -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ] 110 then 111 echo 112 csih_warning 'group and other have been revoked write permission to your home' 113 csih_warning "directory ${pwdhome}." 114 csih_warning 'This is required by OpenSSH to allow public key authentication using' 115 csih_warning 'the key files stored in your .ssh subdirectory.' 116 csih_warning 'Revert this change ONLY if you know what you are doing!' 117 echo 118 fi 119 } # === End of check_user_homedir() === # 120 readonly -f check_user_homedir 121 122 # ====================================================================== 123 # Routine: check_user_dot_ssh_dir 124 # Perform various checks on the ~/.ssh directory 125 # PREREQUISITE: 126 # pwdhome -- check_user_homedir() 127 # ====================================================================== 128 check_user_dot_ssh_dir() { 129 if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ] 130 then 131 csih_error "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files." 132 fi 133 134 if [ ! -e "${pwdhome}/.ssh" ] 135 then 136 mkdir "${pwdhome}/.ssh" 137 if [ ! -e "${pwdhome}/.ssh" ] 138 then 139 csih_error "Creating users ${pwdhome}/.ssh directory failed" 140 fi 141 fi 142 } # === End of check_user_dot_ssh_dir() === # 143 readonly -f check_user_dot_ssh_dir 144 145 # ====================================================================== 146 # Routine: fix_authorized_keys_perms 147 # Corrects the permissions of ~/.ssh/authorized_keys 148 # PREREQUISITE: 149 # pwdhome -- check_user_homedir() 150 # ====================================================================== 151 fix_authorized_keys_perms() { 152 if [ csih_is_nt -a -e "${pwdhome}/.ssh/authorized_keys" ] 153 then 154 if ! setfacl -m "u::rw-,g::---,o::---" "${pwdhome}/.ssh/authorized_keys" 155 then 156 csih_warning "Setting correct permissions to ${pwdhome}/.ssh/authorized_keys" 157 csih_warning "failed. Please care for the correct permissions. The minimum requirement" 158 csih_warning "is, the owner needs read permissions." 159 echo 160 fi 161 fi 162 } # === End of fix_authorized_keys_perms() === # 163 readonly -f fix_authorized_keys_perms 164 165 166 # ====================================================================== 167 # Main Entry Point 168 # ====================================================================== 169 170 # Check how the script has been started. If 171 # (1) it has been started by giving the full path and 172 # that path is /etc/postinstall, OR 173 # (2) Otherwise, if the environment variable 174 # SSH_USER_CONFIG_AUTO_ANSWER_NO is set 175 # then set auto_answer to "no". This allows automatic 176 # creation of the config files in /etc w/o overwriting 177 # them if they already exist. In both cases, color 178 # escape sequences are suppressed, so as to prevent 179 # cluttering setup's logfiles. 180 if [ "$PROGDIR" = "/etc/postinstall" ] 181 then 182 csih_auto_answer="no" 183 csih_disable_color 184 fi 185 if [ -n "${SSH_USER_CONFIG_AUTO_ANSWER_NO}" ] 186 then 187 csih_auto_answer="no" 188 csih_disable_color 189 fi 190 191 # ====================================================================== 192 # Parse options 193 # ====================================================================== 194 while : 195 do 196 case $# in 197 0) 198 break 199 ;; 200 esac 201 202 option=$1 203 shift 204 205 case "$option" in 206 -d | --debug ) 207 set -x 208 csih_trace_on 209 ;; 210 211 -y | --yes ) 212 csih_auto_answer=yes 213 ;; 214 215 -n | --no ) 216 csih_auto_answer=no 217 ;; 218 219 -p | --passphrase ) 220 with_passphrase="yes" 221 passphrase=$1 222 shift 223 ;; 224 225 --privileged ) 226 csih_FORCE_PRIVILEGED_USER=yes 227 ;; 228 229 *) 230 echo "usage: ${PROGNAME} [OPTION]..." 231 echo 232 echo "This script creates an OpenSSH user configuration." 233 echo 234 echo "Options:" 235 echo " --debug -d Enable shell's debug output." 236 echo " --yes -y Answer all questions with \"yes\" automatically." 237 echo " --no -n Answer all questions with \"no\" automatically." 238 echo " --passphrase -p word Use \"word\" as passphrase automatically." 239 echo " --privileged On Windows NT/2k/XP, assume privileged user" 240 echo " instead of LocalSystem for sshd service." 241 echo 242 exit 1 243 ;; 244 245 esac 246 done 247 248 # ====================================================================== 249 # Action! 250 # ====================================================================== 251 252 # Check passwd file 253 if [ ! -f ${SYSCONFDIR}/passwd ] 254 then 255 csih_error_multi \ 256 "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" \ 257 'first using mkpasswd. Check if it contains an entry for you and' \ 258 'please care for the home directory in your entry as well.' 259 fi 260 261 check_user_homedir 262 check_user_dot_ssh_dir 263 create_identity id_rsa rsa "SSH2 RSA" 264 create_identity id_dsa dsa "SSH2 DSA" 265 create_identity id_ecdsa ecdsa "SSH2 ECDSA" 266 create_identity identity rsa1 "(deprecated) SSH1 RSA" 267 fix_authorized_keys_perms 268 269 echo 270 csih_inform "Configuration finished. Have fun!" 271 272 273
