1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
#!/bin/bash
# This script is run on an Ubuntu VM.
# This script is inserted into the VM by prepare_guest_template.sh
# and is run when that VM boots.
# It customizes a fresh Ubuntu install, so it is ready
# to run stack.sh
#
# creating the user called "stack",
# and shuts down the VM to signal the script has completed
set -o errexit
set -o nounset
set -o xtrace
# Configurable nuggets
GUEST_PASSWORD="$1"
STACK_USER="$2"
DOMZERO_USER="$3"
function setup_domzero_user {
local username
username="$1"
local key_updater_script
local sudoers_file
key_updater_script="/home/$username/update_authorized_keys.sh"
sudoers_file="/etc/sudoers.d/allow_$username"
# Create user
adduser --disabled-password --quiet "$username" --gecos "$username"
# Give passwordless sudo
cat > $sudoers_file << EOF
$username ALL = NOPASSWD: ALL
EOF
chmod 0440 $sudoers_file
# A script to populate this user's authenticated_keys from xenstore
cat > $key_updater_script << EOF
#!/bin/bash
set -eux
DOMID=\$(sudo xenstore-read domid)
sudo xenstore-exists /local/domain/\$DOMID/authorized_keys/$username
sudo xenstore-read /local/domain/\$DOMID/authorized_keys/$username > /home/$username/xenstore_value
cat /home/$username/xenstore_value > /home/$username/.ssh/authorized_keys
EOF
# Give the key updater to the user
chown $username:$username $key_updater_script
chmod 0700 $key_updater_script
# Setup the .ssh folder
mkdir -p /home/$username/.ssh
chown $username:$username /home/$username/.ssh
chmod 0700 /home/$username/.ssh
touch /home/$username/.ssh/authorized_keys
chown $username:$username /home/$username/.ssh/authorized_keys
chmod 0600 /home/$username/.ssh/authorized_keys
# Setup the key updater as a cron job
crontab -u $username - << EOF
* * * * * $key_updater_script
EOF
}
# Make a small cracklib dictionary, so that passwd still works, but we don't
# have the big dictionary.
mkdir -p /usr/share/cracklib
echo a | cracklib-packer
# Make /etc/shadow, and set the root password
pwconv
echo "root:$GUEST_PASSWORD" | chpasswd
# Put the VPX into UTC.
rm -f /etc/localtime
# Add stack user
groupadd libvirtd
useradd $STACK_USER -s /bin/bash -d /opt/stack -G libvirtd
echo $STACK_USER:$GUEST_PASSWORD | chpasswd
echo "$STACK_USER ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
setup_domzero_user "$DOMZERO_USER"
# Add an udev rule, so that new block devices could be written by stack user
cat > /etc/udev/rules.d/50-openstack-blockdev.rules << EOF
KERNEL=="xvd[b-z]", GROUP="$STACK_USER", MODE="0660"
EOF
# Give ownership of /opt/stack to stack user
chown -R $STACK_USER /opt/stack
function setup_vimrc {
if [ ! -e $1 ]; then
# Simple but usable vimrc
cat > $1 <<EOF
se ts=4
se expandtab
se shiftwidth=4
EOF
fi
}
# Setup simple .vimrcs
setup_vimrc /root/.vimrc
setup_vimrc /opt/stack/.vimrc
# remove self from local.rc
# so this script is not run again
rm -rf /etc/rc.local
# Restore rc.local file
cp /etc/rc.local.preparebackup /etc/rc.local
# shutdown to notify we are done
shutdown -h now
|
