122 lines
2.8 KiB
Bash
Executable File
122 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
set -exu
|
|
shopt -s nullglob
|
|
basedir=/var/ssh-box/
|
|
test -f "$basedir"/ssh-cache/ssh_host_rsa_key || {
|
|
ssh-keygen -A
|
|
grep -v -e AuthorizedKeys -e PermitEmptyPasswords -e PasswordAuthentication \
|
|
-e Subsystem \
|
|
/etc/ssh/sshd_config > /etc/ssh/sshd_config.tmp
|
|
mv /etc/ssh/sshd_config.tmp /etc/ssh/sshd_config
|
|
cat <<EOF >> /etc/ssh/sshd_config
|
|
AuthorizedKeysFile /tmp/empty_keys
|
|
AuthorizedKeysCommand /usr/local/sbin/get_pub_keys.sh
|
|
AuthorizedKeysCommandUser root
|
|
PermitEmptyPasswords no
|
|
PasswordAuthentication no
|
|
Subsystem sftp /usr/lib/ssh/sftp-server -u 002
|
|
EOF
|
|
rsync -va /etc/ssh/ "$basedir"/ssh-cache/
|
|
}
|
|
mkdir -p "$basedir"/users "$basedir"/ssh-cache "$basedir"/home "$basedir"/log
|
|
rsync -va --del "$basedir"/ssh-cache/ /etc/ssh/
|
|
chown -R $USR "$basedir"/users "$basedir"/ssh-cache
|
|
chown -R root:root /etc/ssh/
|
|
chmod 0644 /etc/ssh/*
|
|
chmod 0600 /etc/ssh/*key
|
|
chmod 0700 "$basedir"/ssh-cache/ "$basedir"/users/
|
|
chmod 0600 "$basedir"/ssh-cache/*
|
|
chmod 0711 "$basedir"
|
|
|
|
if getent group box; then
|
|
echo Group already added
|
|
else
|
|
groupadd -g $GRP box
|
|
fi
|
|
if getent group trusted; then
|
|
echo Trusted already added
|
|
else
|
|
groupadd trusted
|
|
fi
|
|
|
|
|
|
rmdir /home || true
|
|
chown root:trusted "$basedir"/home
|
|
chmod 0751 "$basedir"/home
|
|
ln -sfT "$basedir"/home /home
|
|
|
|
touch /tmp/empty_keys
|
|
chmod 0200 /tmp/empty_keys
|
|
cat <<EOF > /etc/profile
|
|
alias ll='ls -al'
|
|
EOF
|
|
echo "$NAME" > /etc/motd
|
|
|
|
cat <<EOF > /usr/local/sbin/sshd_start.sh
|
|
#!/bin/sh
|
|
exec "/usr/sbin/sshd" "-D" "-e" -g 60 "-f" "/etc/ssh/sshd_config" 2>&1 | \
|
|
ts "%b %d %H:%M:%S ${HOSTNAME} sshd[$$]:" >> "${basedir}"/log/sshd.log
|
|
EOF
|
|
|
|
cat <<'EOF' > /usr/local/sbin/sshd_restart.sh
|
|
#!/bin/sh
|
|
test -e /var/run/sshd.pid && {
|
|
kill `cat /var/run/sshd.pid`
|
|
}
|
|
/usr/local/sbin/sshd_start.sh &
|
|
EOF
|
|
|
|
cat <<'EOF' > /etc/logrotate.d/sshd
|
|
/var/log/sshd.log
|
|
{
|
|
rotate 12
|
|
monthly
|
|
missingok
|
|
notifempty
|
|
compress
|
|
delaycompress
|
|
sharedscripts
|
|
postrotate
|
|
[ -x /usr/local/sbin/sshd_restart.sh ] && /usr/local/sbin/sshd_restart.sh || true
|
|
endscript
|
|
}
|
|
EOF
|
|
|
|
cat <<'EOF' > /usr/local/sbin/logrotate_weekly.sh
|
|
#!/bin/sh
|
|
/usr/sbin/logrotate -s /var/log/logrotate.state /etc/logrotate.conf
|
|
EOF
|
|
|
|
ln -sfT /usr/local/sbin/logrotate_weekly.sh /etc/periodic/daily/logrotate_weekly
|
|
|
|
cat <<'EOF' > /usr/local/sbin/health_check.sh
|
|
#!/bin/sh
|
|
|
|
_fail() {
|
|
echo sshd missing | \
|
|
ts "%b %d %H:%M:%S ${HOSTNAME} health[$$]:" >> /var/log/health.log
|
|
kill -9 -1
|
|
}
|
|
|
|
test -e /var/run/sshd.pid || _fail
|
|
test -e /var/run/sshd.pid && {
|
|
sshdpid=$( cat /var/run/sshd.pid )
|
|
test -e /proc/$sshdpid/stat || _fail
|
|
}
|
|
EOF
|
|
|
|
ln -sfT /usr/local/sbin/health_check.sh /etc/periodic/15min/health_check
|
|
|
|
chown root:root /usr/local/sbin/*.sh
|
|
chmod 0700 /usr/local/sbin/*.sh
|
|
|
|
update_users.sh
|
|
|
|
rmdir /var/log || true
|
|
ln -sfT "$basedir"/log /var/log
|
|
touch "$basedir"/log/sshd.log
|
|
chmod 0600 "$basedir"/log/*
|
|
|
|
/usr/local/sbin/sshd_restart.sh
|
|
crond -f -L "${basedir}/log/cron.log"
|