File: sshcommand

package info (click to toggle)
sshcommand 0~20160110.1~2795f65-1
  • links: PTS, VCS
  • area: main
  • in suites: bullseye, buster, sid, stretch
  • size: 100 kB
  • ctags: 17
  • sloc: sh: 188; makefile: 53
file content (98 lines) | stat: -rwxr-xr-x 2,537 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
#!/bin/bash
set -e

shopt -s nocasematch #For case insensitive string matching, for the first parameter

OSRELEASE=/etc/os-release

f_print_os_name() {
  sed -n 's#^NAME="\(.*\)"#\1#p' $OSRELEASE
  return 0
}

f_adduser() {
  local l_user l_platform

  l_user=$1
  l_platform="$(f_print_os_name)"
  case $l_platform in
    Debian*|Ubuntu)
      adduser --disabled-password --gecos "" "$l_user"
      ;;
    *)
      useradd -m -s /bin/bash "$l_user"
      groupadd "$l_user"
      usermod -L -aG "$l_user" "$l_user"
      ;;

  esac
}

case "$1" in
  create) # sshcommand create <user> <command>
    if [[ $# -ne 3 ]]; then
      echo "Usage : sshcommand create user command"
      exit -1
    fi
    USER="$2"; COMMAND="$3"

    if id -u "$USER" >/dev/null 2>&1; then
      echo "User '$USER' already exists"
    else
      f_adduser "$USER"
    fi

    USERHOME=$(sh -c "echo ~$USER")
    mkdir -p "$USERHOME/.ssh"
    touch "$USERHOME/.ssh/authorized_keys"
    echo "$COMMAND" > "$USERHOME/.sshcommand"
    chown -R "$USER" "$USERHOME"
    ;;

  acl-add) # sshcommand acl-add <user> <identifier>
    if [[ $# -ne 3 ]]; then
      echo "Usage : sshcommand acl-add user identifier"
      exit -1
    fi
    USER="$2"; NAME="$3"

    getent passwd "$USER" > /dev/null || false
    USERHOME=$(sh -c "echo ~$USER")
    KEY_FILE=$(mktemp)
    KEY=$(tee "$KEY_FILE")
    delete_key_file() {
      rm -f "$KEY_FILE"
    }
    trap delete_key_file INT EXIT
    FINGERPRINT=$(ssh-keygen -lf "$KEY_FILE" | awk '{print $2}')

    if [[ ! "$FINGERPRINT" =~ :.* ]]; then
      echo "Invalid ssh public key"
      exit -1
    fi
    KEY_PREFIX="command=\"FINGERPRINT=$FINGERPRINT NAME=\\\"$NAME\\\" \`cat $USERHOME/.sshcommand\` \$SSH_ORIGINAL_COMMAND\",no-agent-forwarding,no-user-rc,no-X11-forwarding,no-port-forwarding"
    echo "$KEY_PREFIX $KEY" >> "$USERHOME/.ssh/authorized_keys"
    echo "$FINGERPRINT"
    ;;

  acl-remove) # sshcommand acl-remove <user> <identifier>
    if [[ $# -ne 3 ]]; then
      echo "Usage : sshcommand acl-remove user identifier"
      exit -1
    fi
    USER="$2"; NAME="$3"

    getent passwd "$USER" > /dev/null || false
    USERHOME=$(sh -c "echo ~$USER")

    sed --in-place "/ NAME=\\\\\"$NAME\\\\\" /d" "$USERHOME/.ssh/authorized_keys"
    ;;

  help|*) # sshcommand help
    echo "Usage : sshcommand create user command"
    echo "        sshcommand acl-add user identifier"
    echo "        sshcommand acl-remove user identifier"
    echo "        sshcommand help # shows this usage message"
    ;;

esac