ssfs annotate ssfs-server @ rev 29
Add ssfs-sh - Ssfs SHell for chrooted users with minimal env vars, also needed since chroot drop user to / by default
| author | Christophe Lincoln <pankso@slitaz.org> |
|---|---|
| date | Sun Jun 12 09:49:52 2011 +0200 (2011-06-12) |
| parents | 6034fcc9741c |
| children | d9e1240da61a |
| rev | line source |
|---|---|
| pankso@4 | 1 #!/bin/sh |
| pankso@4 | 2 # |
| pankso@4 | 3 # SliTaz Secure File Storage server side tool. |
| pankso@4 | 4 # |
| pankso@4 | 5 # Copyright (C) SliTaz GNU/Linux - BSD License |
| pankso@4 | 6 # Author: Christophe Lincoln <pankso@slitaz.org> |
| pankso@4 | 7 # |
| pankso@4 | 8 |
| pankso@4 | 9 app=$(basename $0) |
| pankso@23 | 10 cache=/var/cache/ssfs |
| pankso@4 | 11 [ -f "/etc/ssfs/$app.conf" ] && . /etc/ssfs/$app.conf |
| pankso@4 | 12 [ -f "./data/$app.conf" ] && . ./data/$app.conf |
| pankso@4 | 13 |
| pankso@4 | 14 # Be sure we're root. |
| pankso@4 | 15 [ $(id -u) != 0 ] && gettext "You must be root to run:" && \ |
| pankso@4 | 16 echo " $app" && exit 0 |
| pankso@4 | 17 |
| pankso@4 | 18 # Parse cmdline options. |
| pankso@4 | 19 for opt in $@ |
| pankso@4 | 20 do |
| pankso@4 | 21 case "$opt" in |
| pankso@4 | 22 --login=*) |
| pankso@4 | 23 login=${opt#--login=} ;; |
| pankso@4 | 24 --id=*) |
| pankso@4 | 25 id=${opt#--id=} ;; |
| pankso@4 | 26 --pass=*) |
| pankso@4 | 27 pass=${opt#--pass=} ;; |
| pankso@4 | 28 --root=*) |
| pankso@4 | 29 root=${opt#--root=} ;; |
| pankso@13 | 30 --vdisk=*) |
| pankso@13 | 31 vdisk=${opt#--vdisk=} ;; |
| pankso@13 | 32 --size=*) |
| pankso@13 | 33 size=${opt#--size=} ;; |
| pankso@4 | 34 *) |
| pankso@4 | 35 continue ;; |
| pankso@4 | 36 esac |
| pankso@4 | 37 done |
| pankso@4 | 38 |
| pankso@4 | 39 [ "$root" ] || root=${SSFS_CHROOT} |
| pankso@13 | 40 [ "$vdisk" ] || vdisk=${SSFS_VDISK} |
| pankso@13 | 41 [ "$size" ] || size=${SSFS_SIZE} |
| pankso@4 | 42 |
| pankso@4 | 43 # |
| pankso@4 | 44 # Functions |
| pankso@4 | 45 # |
| pankso@4 | 46 |
| pankso@4 | 47 # Built-in help usage. |
| pankso@4 | 48 help() { |
| pankso@4 | 49 cat << EOT |
| pankso@4 | 50 |
| pankso@4 | 51 $(echo -e "\033[1m$(gettext "Usage:")\033[0m") $app [command] [--option=] |
| pankso@4 | 52 |
| pankso@4 | 53 $(echo -e "\033[1m$(gettext "Commands:")\033[0m") |
| pankso@4 | 54 help $(gettext "Display this short usage.") |
| paul@12 | 55 users $(gettext "List user accounts and stats.") |
| pankso@4 | 56 adduser $(gettext "Add a user to the system with \$HOME in chroot.") |
| pankso@4 | 57 deluser $(gettext "Delete a user and remove \$HOME files.") |
| pankso@4 | 58 chroot $(gettext "Chroot to Ssfs storage root.") |
| pankso@13 | 59 gen-vdisk $(gettext "Create a vdisk with chroot for files storage.") |
| pankso@13 | 60 clean-vdisk $(gettext "Clean the vdisk but skip home and root.") |
| pankso@15 | 61 check-vdisk $(gettext "Check vdisk filesystem with e2fsck.") |
| pankso@13 | 62 mount-vdisk $(gettext "Mount ssfs virtual disk.") |
| pankso@13 | 63 umount-vdisk $(gettext "Unmount the vdisk and free loop device.") |
| pankso@4 | 64 |
| pankso@4 | 65 $(echo -e "\033[1m$(gettext "Options:")\033[0m") |
| pankso@4 | 66 --login= $(gettext "Login name for add or del an user.") |
| pankso@4 | 67 --id= $(gettext "User id for adduser command.") |
| pankso@4 | 68 --pass= $(gettext "User password for adduser.") |
| pankso@13 | 69 --root= $(gettext "The path to the Ssfs vdisk chroot.") |
| pankso@13 | 70 --vdisk= $(gettext "Set the Ssfs vdisk path and name.") |
| pankso@13 | 71 --size= $(gettext "Set the ext3 vdisk size in Gb.") |
| pankso@4 | 72 |
| pankso@4 | 73 EOT |
| pankso@4 | 74 } |
| pankso@4 | 75 |
| pankso@4 | 76 status() { |
| pankso@4 | 77 [ $? = 0 ] && echo " OK" |
| pankso@4 | 78 [ $? = 1 ] && echo -e " ERROR\n" && exit 1 |
| pankso@4 | 79 } |
| pankso@4 | 80 |
| pankso@13 | 81 separator() { |
| pankso@13 | 82 echo "================================================================================" |
| pankso@13 | 83 } |
| pankso@13 | 84 |
| pankso@13 | 85 # We have custom config when adding user to handle quota and user info. |
| pankso@4 | 86 user_paths() { |
| pankso@4 | 87 config=$SSFS_USERS/$login.conf |
| pankso@4 | 88 home=$root/./home/$login |
| pankso@4 | 89 } |
| pankso@4 | 90 |
| pankso@4 | 91 user_info() { |
| pankso@4 | 92 cat << EOT |
| pankso@4 | 93 |
| pankso@4 | 94 $(gettext "User login :") $login |
| pankso@4 | 95 $(gettext "User quota :") $QUOTA |
| pankso@4 | 96 $(gettext "Home usage :") $usage |
| pankso@4 | 97 |
| pankso@4 | 98 EOT |
| pankso@4 | 99 } |
| pankso@4 | 100 |
| pankso@4 | 101 user_config() { |
| pankso@4 | 102 gettext "Creating Ssfs user configuration file..." |
| pankso@4 | 103 cat > $config << EOT |
| pankso@4 | 104 # Ssfs user configuration file. |
| pankso@4 | 105 |
| pankso@4 | 106 LOGIN="$login" |
| pankso@4 | 107 QUOTA="$DEFAULT_QUOTA" |
| pankso@4 | 108 EOT |
| pankso@4 | 109 chmod 0600 $config && status |
| pankso@4 | 110 echo "" |
| pankso@4 | 111 } |
| pankso@4 | 112 |
| pankso@13 | 113 # Handle Ssfs virtual disk. |
| pankso@13 | 114 umount_vdisk() { |
| pankso@13 | 115 if mount | fgrep -q $root; then |
| pankso@13 | 116 loop=$(mount | fgrep $root | awk '{print $1}') |
| pankso@13 | 117 gettext "Unmounting Ssfs vdisk:"; echo " $vdisk" |
| pankso@13 | 118 umount $root && sleep 1 |
| pankso@13 | 119 gettext "Detaching loop device:"; echo " $loop" |
| pankso@13 | 120 losetup -d $loop |
| pankso@13 | 121 else |
| pankso@13 | 122 gettext "Ssfs vdisk is not mounted:"; echo " $vdisk" |
| pankso@13 | 123 fi |
| pankso@13 | 124 } |
| pankso@13 | 125 |
| pankso@13 | 126 mount_vdisk() { |
| pankso@15 | 127 if ! mount | fgrep -q $root; then |
| pankso@15 | 128 [ -d "$root" ] || mkdir -p $root |
| pankso@15 | 129 gettext "Mounting virtual disk:" |
| pankso@15 | 130 mount -o loop -t ext3 $vdisk $root |
| pankso@15 | 131 else |
| pankso@15 | 132 gettext "Ssfs vdisk is already mounted:" |
| pankso@15 | 133 fi |
| pankso@15 | 134 echo " $vdisk $root" |
| pankso@13 | 135 } |
| pankso@13 | 136 |
| pankso@4 | 137 # |
| pankso@4 | 138 # Commands |
| pankso@4 | 139 # |
| pankso@4 | 140 |
| pankso@4 | 141 case "$1" in |
| pankso@4 | 142 users) |
| pankso@4 | 143 gettext -e "\nChecking:"; echo " /etc/passwd" |
| pankso@4 | 144 fgrep "Ssfs User" /etc/passwd | while read line |
| pankso@4 | 145 do |
| pankso@4 | 146 login=$(echo $line | cut -d ":" -f 1) |
| pankso@4 | 147 home="$root/home/$login" |
| pankso@4 | 148 usage=$(du -sm $home | awk '{print $1}') |
| pankso@4 | 149 config=$SSFS_USERS/$login.conf |
| pankso@4 | 150 . $config || gettext -e "WARNING: No config file\n" |
| pankso@4 | 151 user_info |
| pankso@4 | 152 done |
| pankso@4 | 153 users=$(ls $SSFS_USERS | wc -l) |
| pankso@4 | 154 gettext "Users:"; echo -e " $users\n" ;; |
| pankso@4 | 155 adduser) |
| pankso@4 | 156 # Add a Ssfs user to the system with $HOME in chroot. |
| pankso@4 | 157 [ -z "$login" ] && gettext -e "Missing user login name.\n" && exit 0 |
| pankso@4 | 158 [ -z "$id" ] && gettext -e "Missing user id.\n" && exit 0 |
| pankso@4 | 159 [ -z "$pass" ] && gettext -e "Missing user password.\n" && exit 0 |
| pankso@4 | 160 user_paths |
| pankso@29 | 161 |
| pankso@29 | 162 # We need chroot command allowed for users to chroot them on SSH |
| pankso@29 | 163 # login. Ssfs user have /bin/ssfs-sh as SHell. |
| pankso@29 | 164 grep -q ^chroot /etc/busybox.conf || |
| pankso@29 | 165 echo 'chroot = ssx root.root' >> /etc/busybox.conf |
| pankso@4 | 166 |
| pankso@4 | 167 gettext -e "\nChecking:"; echo " /etc/passwd" |
| pankso@4 | 168 if grep ^$login: /etc/passwd; then |
| paul@12 | 169 gettext -e "Exiting, user already exists:" |
| pankso@4 | 170 echo -e " $login\n" && exit 0 |
| pankso@4 | 171 fi |
| pankso@29 | 172 |
| pankso@4 | 173 gettext "Creating user: $login..." |
| pankso@4 | 174 echo -e "$pass\n$pass" | \ |
| pankso@29 | 175 adduser -h "$home" -g "Ssfs User" -u $id \ |
| pankso@29 | 176 -s /bin/ssfs-sh $login >/dev/null |
| pankso@4 | 177 status |
| pankso@29 | 178 |
| pankso@29 | 179 # Add user to chroot /etc/passwd |
| pankso@29 | 180 gettext "Checking vdisk chroot:"; echo " $root/etc/passwd" |
| pankso@29 | 181 if ! grep -q ^$login: $root/etc/passwd; then |
| pankso@29 | 182 echo "$login:x:$id:$id:Ssfs User:/home/$login:/bin/sh" >> \ |
| pankso@29 | 183 $root/etc/passwd |
| pankso@29 | 184 fi |
| pankso@4 | 185 |
| paul@12 | 186 # We don't want any files from /etc/skel. |
| pankso@4 | 187 gettext "Cleaning home and creating: Sync/..." |
| pankso@15 | 188 rm -rf $home && mkdir -p $home/Sync $home/.ssh && status |
| pankso@4 | 189 gettext "Changing mode on user home: 0700..." |
| pankso@4 | 190 chown -R $login.$login $home |
| pankso@4 | 191 chmod 0700 $home && status |
| pankso@4 | 192 |
| paul@12 | 193 # Create a custom config per user in SSFS_USERS. |
| pankso@4 | 194 [ ! -d "$SSFS_USERS" ] && mkdir -p $SSFS_USERS |
| pankso@4 | 195 user_config ;; |
| pankso@4 | 196 deluser) |
| pankso@4 | 197 [ -z "$login" ] && gettext -e "Missing user login name.\n" && exit 0 |
| pankso@4 | 198 user_paths |
| pankso@4 | 199 gettext -e "\nDeleting user:"; echo -n " $login..." |
| pankso@29 | 200 sed -i /^$login:/d $root/etc/passwd |
| pankso@4 | 201 deluser $login || status && status |
| pankso@4 | 202 gettext "Removing all files in:"; echo -n " $home..." |
| pankso@4 | 203 rm -rf $home && status |
| pankso@4 | 204 gettext "Removing user config:"; echo -n " $login.conf..." |
| pankso@4 | 205 rm -rf $config && status |
| pankso@4 | 206 echo "" ;; |
| pankso@4 | 207 chroot) |
| pankso@4 | 208 gettext -e "\nChanging root to:"; echo -e " $root\n" |
| pankso@4 | 209 chroot $root |
| pankso@4 | 210 gettext -e "\nBack to the host system:" |
| pankso@4 | 211 echo -e " $(hostname)\n" ;; |
| pankso@13 | 212 gen-vdisk) |
| pankso@13 | 213 # Generated a virtual disk with a minimal chroot for Ssfs users home. |
| pankso@4 | 214 if [ -d "$root/bin" ]; then |
| paul@12 | 215 gettext -e "A chroot already exists in:"; echo " $root" |
| pankso@4 | 216 exit 0 |
| pankso@4 | 217 fi |
| pankso@13 | 218 echo "" |
| pankso@13 | 219 gettext "Creating chroot in:"; echo " $root" |
| pankso@13 | 220 separator |
| pankso@13 | 221 |
| pankso@13 | 222 # Create vdisk if missing. |
| pankso@13 | 223 if [ ! -f "$vdisk" ]; then |
| pankso@13 | 224 gettext "Creating virtual disk:"; echo " $vdisk ${size}Gb" |
| pankso@13 | 225 dd if=/dev/zero of=$vdisk bs=1G count=$size |
| pankso@23 | 226 chmod 0600 $vdisk && du -sh $vdisk |
| pankso@13 | 227 gettext "Creating ext3 filesystem..." |
| pankso@13 | 228 mkfs.ext3 -q -T ext3 -L "Ssfs" -F $vdisk |
| pankso@13 | 229 status |
| pankso@13 | 230 mount_vdisk |
| pankso@13 | 231 fi |
| pankso@13 | 232 |
| pankso@13 | 233 # Create a radicaly minimal chroot with all libs in /lib. |
| pankso@13 | 234 gettext "Creating base files..." |
| pankso@13 | 235 mkdir -p $root && cd $root |
| pankso@13 | 236 for d in etc tmp lib usr home root |
| pankso@13 | 237 do |
| pankso@13 | 238 mkdir -p $d |
| pankso@13 | 239 done && status |
| pankso@13 | 240 cp -a /etc/slitaz-release $root/etc |
| pankso@13 | 241 #cp -a /etc/nsswitch.conf $root/etc |
| pankso@13 | 242 echo "root:x:0:0:root:/root:/bin/sh" > etc/passwd |
| pankso@13 | 243 echo "root::13525:0:99999:7:::" > etc/shadow |
| pankso@13 | 244 echo "root:x:0:" > etc/group |
| pankso@13 | 245 echo "root:*::" > etc/gshadow |
| pankso@29 | 246 #mknod -m 666 $root/dev/null c 1 3 |
| pankso@13 | 247 |
| pankso@13 | 248 gettext "Setting files permissions..." |
| pankso@13 | 249 chmod 640 etc/shadow etc/gshadow |
| pankso@13 | 250 chmod 0700 root && chmod 1777 tmp |
| pankso@4 | 251 status |
| pankso@13 | 252 |
| pankso@13 | 253 # Busybox without deps (get && extract). No system comands are allowed |
| pankso@13 | 254 # in /etc/busybox.conf to restrict SSHed users. |
| pankso@4 | 255 gettext "Installing Busybox..." |
| pankso@13 | 256 cd $root/tmp |
| pankso@13 | 257 tazpkg get busybox >/dev/null |
| pankso@13 | 258 tazpkg extract busybox-* >/dev/null |
| pankso@13 | 259 rm -rf fs && mv -f busybox-*/fs . && rm -rf busybox-* |
| pankso@13 | 260 cp -a fs/bin fs/sbin $root |
| pankso@13 | 261 cp -a fs/usr/bin fs/usr/sbin $root/usr |
| pankso@29 | 262 rm -rf fs && chmod 4755 $root/bin/busybox |
| pankso@4 | 263 status |
| pankso@13 | 264 gettext "Creatin restrictive Busybox config file..." |
| pankso@13 | 265 echo '# /etc/busybox.conf: Ssfs Busybox configuration.' \ |
| pankso@13 | 266 > $root/etc/busybox.conf |
| pankso@29 | 267 echo -e "\n[SUID]" >> $root/etc/busybox.conf |
| pankso@29 | 268 echo -e "su = --- root.root" >> $root/etc/busybox.conf |
| pankso@13 | 269 chmod 0600 $root/etc/busybox.conf |
| pankso@13 | 270 status |
| pankso@13 | 271 |
| pankso@13 | 272 # Glib minimal libs, use host lib since package should be installed |
| pankso@13 | 273 # from same repo. |
| pankso@13 | 274 gettext "Installing Glibc libraries..." |
| pankso@13 | 275 for l in ld-*.*so* libc-*.*so libc.so.* libnss_files* |
| pankso@13 | 276 do |
| pankso@13 | 277 cp -a /lib/$l* $root/lib |
| pankso@13 | 278 done && status |
| pankso@13 | 279 size=$(du -sh $root | awk '{print $1}') |
| pankso@13 | 280 separator |
| pankso@13 | 281 gettext "Vdisk used space:"; echo -e " $size\n" ;; |
| pankso@13 | 282 mount-vdisk) |
| pankso@13 | 283 mount_vdisk ;; |
| pankso@13 | 284 umount-vdisk) |
| pankso@13 | 285 umount_vdisk ;; |
| pankso@15 | 286 check-vdisk) |
| pankso@15 | 287 # Check vdisk with e2fsck. |
| pankso@15 | 288 echo "" |
| pankso@15 | 289 gettext -e "Checking Ssfs virtual disk\n" |
| pankso@15 | 290 separator |
| pankso@15 | 291 gettext "Virtual disk : "; du -sh $vdisk |
| pankso@15 | 292 gettext "Filesystem usage : "; du -sh $root |
| pankso@15 | 293 gettext "Remounting vdisk read/only before e2fsck -p..." |
| pankso@15 | 294 mount -o remount,loop,ro $vdisk $root && status |
| pankso@15 | 295 e2fsck -p $vdisk |
| pankso@15 | 296 gettext "Remounting vdisk read/write..." |
| pankso@15 | 297 mount -o remount,loop,rw $vdisk $root && status |
| pankso@15 | 298 separator && echo "" ;; |
| pankso@13 | 299 clean-vdisk) |
| pankso@13 | 300 # clean up the vdisk storage chroot. |
| pankso@4 | 301 if [ ! -d "$root/bin" ] || [ ! -d "$root/usr" ]; then |
| pankso@4 | 302 gettext -e "No chroot found in:"; echo " $root" |
| pankso@4 | 303 exit 0 |
| pankso@4 | 304 fi |
| pankso@13 | 305 gettext -e "\nCleaning virtual disk\n" |
| pankso@13 | 306 separator |
| pankso@13 | 307 gettext "Changing directory to:"; echo " $root" |
| pankso@4 | 308 cd $root |
| pankso@4 | 309 for dir in * |
| pankso@4 | 310 do |
| pankso@4 | 311 size=$(du -sh $dir | awk '{print $1}') |
| pankso@4 | 312 case "$dir" in |
| pankso@13 | 313 home|root|lost*) |
| pankso@4 | 314 gettext "Skipping:"; echo " $dir $size *" ;; |
| pankso@4 | 315 *) |
| pankso@4 | 316 gettext "Removing:"; echo " $dir $size" |
| pankso@4 | 317 rm -rf $dir ;; |
| pankso@4 | 318 esac |
| pankso@13 | 319 done && separator && echo "" ;; |
| pankso@4 | 320 *) |
| pankso@4 | 321 help ;; |
| pankso@4 | 322 esac |
| pankso@4 | 323 exit 0 |