ssfs annotate ssfs-server @ rev 34
Samlls improvment to server tool Shell
| author | Christophe Lincoln <pankso@slitaz.org> |
|---|---|
| date | Sun Jun 12 13:31:26 2011 +0200 (2011-06-12) |
| parents | 95b88686a283 |
| children | 72c49d4cc4e9 |
| rev | line source |
|---|---|
| pankso@4 | 1 #!/bin/sh |
| pankso@4 | 2 # |
| pankso@4 | 3 # SliTaz Secure File Storage server side tool. |
| pankso@4 | 4 # |
| pankso@4 | 5 # Copyright (C) SliTaz GNU/Linux - BSD License |
| pankso@4 | 6 # Author: Christophe Lincoln <pankso@slitaz.org> |
| pankso@4 | 7 # |
| pankso@4 | 8 |
| pankso@4 | 9 app=$(basename $0) |
| pankso@4 | 10 [ -f "/etc/ssfs/$app.conf" ] && . /etc/ssfs/$app.conf |
| pankso@4 | 11 [ -f "./data/$app.conf" ] && . ./data/$app.conf |
| pankso@34 | 12 state=/var/lib/ssfs |
| pankso@34 | 13 share=/usr/share/ssfs |
| pankso@4 | 14 |
| pankso@4 | 15 # Be sure we're root. |
| pankso@4 | 16 [ $(id -u) != 0 ] && gettext "You must be root to run:" && \ |
| pankso@4 | 17 echo " $app" && exit 0 |
| pankso@4 | 18 |
| pankso@4 | 19 # Parse cmdline options. |
| pankso@4 | 20 for opt in $@ |
| pankso@4 | 21 do |
| pankso@4 | 22 case "$opt" in |
| pankso@4 | 23 --login=*) |
| pankso@4 | 24 login=${opt#--login=} ;; |
| pankso@4 | 25 --id=*) |
| pankso@4 | 26 id=${opt#--id=} ;; |
| pankso@4 | 27 --pass=*) |
| pankso@4 | 28 pass=${opt#--pass=} ;; |
| pankso@4 | 29 --root=*) |
| pankso@4 | 30 root=${opt#--root=} ;; |
| pankso@13 | 31 --vdisk=*) |
| pankso@13 | 32 vdisk=${opt#--vdisk=} ;; |
| pankso@13 | 33 --size=*) |
| pankso@13 | 34 size=${opt#--size=} ;; |
| pankso@4 | 35 *) |
| pankso@4 | 36 continue ;; |
| pankso@4 | 37 esac |
| pankso@4 | 38 done |
| pankso@4 | 39 |
| pankso@4 | 40 [ "$root" ] || root=${SSFS_CHROOT} |
| pankso@13 | 41 [ "$vdisk" ] || vdisk=${SSFS_VDISK} |
| pankso@13 | 42 [ "$size" ] || size=${SSFS_SIZE} |
| pankso@4 | 43 |
| pankso@4 | 44 # |
| pankso@4 | 45 # Functions |
| pankso@4 | 46 # |
| pankso@4 | 47 |
| pankso@4 | 48 # Built-in help usage. |
| pankso@4 | 49 help() { |
| pankso@4 | 50 cat << EOT |
| pankso@4 | 51 |
| pankso@4 | 52 $(echo -e "\033[1m$(gettext "Usage:")\033[0m") $app [command] [--option=] |
| pankso@4 | 53 |
| pankso@4 | 54 $(echo -e "\033[1m$(gettext "Commands:")\033[0m") |
| pankso@4 | 55 help $(gettext "Display this short usage.") |
| paul@12 | 56 users $(gettext "List user accounts and stats.") |
| pankso@4 | 57 adduser $(gettext "Add a user to the system with \$HOME in chroot.") |
| pankso@4 | 58 deluser $(gettext "Delete a user and remove \$HOME files.") |
| pankso@4 | 59 chroot $(gettext "Chroot to Ssfs storage root.") |
| pankso@13 | 60 gen-vdisk $(gettext "Create a vdisk with chroot for files storage.") |
| pankso@13 | 61 clean-vdisk $(gettext "Clean the vdisk but skip home and root.") |
| paul@33 | 62 check-vdisk $(gettext "Check the vdisk filesystem with e2fsck.") |
| paul@33 | 63 mount-vdisk $(gettext "Mount a ssfs virtual disk.") |
| pankso@13 | 64 umount-vdisk $(gettext "Unmount the vdisk and free loop device.") |
| pankso@4 | 65 |
| pankso@4 | 66 $(echo -e "\033[1m$(gettext "Options:")\033[0m") |
| paul@33 | 67 --login= $(gettext "Login name to add or del an user.") |
| pankso@4 | 68 --id= $(gettext "User id for adduser command.") |
| pankso@4 | 69 --pass= $(gettext "User password for adduser.") |
| pankso@13 | 70 --root= $(gettext "The path to the Ssfs vdisk chroot.") |
| pankso@13 | 71 --vdisk= $(gettext "Set the Ssfs vdisk path and name.") |
| pankso@13 | 72 --size= $(gettext "Set the ext3 vdisk size in Gb.") |
| pankso@4 | 73 |
| pankso@4 | 74 EOT |
| pankso@4 | 75 } |
| pankso@4 | 76 |
| pankso@4 | 77 status() { |
| pankso@4 | 78 [ $? = 0 ] && echo " OK" |
| pankso@4 | 79 [ $? = 1 ] && echo -e " ERROR\n" && exit 1 |
| pankso@4 | 80 } |
| pankso@4 | 81 |
| pankso@13 | 82 separator() { |
| pankso@13 | 83 echo "================================================================================" |
| pankso@13 | 84 } |
| pankso@13 | 85 |
| pankso@13 | 86 # We have custom config when adding user to handle quota and user info. |
| pankso@4 | 87 user_paths() { |
| pankso@4 | 88 config=$SSFS_USERS/$login.conf |
| pankso@4 | 89 home=$root/./home/$login |
| pankso@4 | 90 } |
| pankso@4 | 91 |
| pankso@4 | 92 user_info() { |
| pankso@4 | 93 cat << EOT |
| pankso@4 | 94 |
| pankso@4 | 95 $(gettext "User login :") $login |
| pankso@4 | 96 $(gettext "User quota :") $QUOTA |
| pankso@4 | 97 $(gettext "Home usage :") $usage |
| pankso@4 | 98 |
| pankso@4 | 99 EOT |
| pankso@4 | 100 } |
| pankso@4 | 101 |
| pankso@4 | 102 user_config() { |
| pankso@4 | 103 gettext "Creating Ssfs user configuration file..." |
| pankso@4 | 104 cat > $config << EOT |
| pankso@4 | 105 # Ssfs user configuration file. |
| pankso@4 | 106 |
| pankso@4 | 107 LOGIN="$login" |
| pankso@4 | 108 QUOTA="$DEFAULT_QUOTA" |
| pankso@4 | 109 EOT |
| pankso@4 | 110 chmod 0600 $config && status |
| pankso@4 | 111 echo "" |
| pankso@4 | 112 } |
| pankso@4 | 113 |
| pankso@13 | 114 # Handle Ssfs virtual disk. |
| pankso@13 | 115 umount_vdisk() { |
| pankso@13 | 116 if mount | fgrep -q $root; then |
| pankso@13 | 117 loop=$(mount | fgrep $root | awk '{print $1}') |
| pankso@13 | 118 gettext "Unmounting Ssfs vdisk:"; echo " $vdisk" |
| pankso@13 | 119 umount $root && sleep 1 |
| pankso@13 | 120 gettext "Detaching loop device:"; echo " $loop" |
| pankso@13 | 121 losetup -d $loop |
| pankso@13 | 122 else |
| pankso@13 | 123 gettext "Ssfs vdisk is not mounted:"; echo " $vdisk" |
| pankso@13 | 124 fi |
| pankso@13 | 125 } |
| pankso@13 | 126 |
| pankso@13 | 127 mount_vdisk() { |
| pankso@15 | 128 if ! mount | fgrep -q $root; then |
| pankso@15 | 129 [ -d "$root" ] || mkdir -p $root |
| pankso@15 | 130 gettext "Mounting virtual disk:" |
| pankso@15 | 131 mount -o loop -t ext3 $vdisk $root |
| pankso@15 | 132 else |
| pankso@15 | 133 gettext "Ssfs vdisk is already mounted:" |
| pankso@15 | 134 fi |
| pankso@15 | 135 echo " $vdisk $root" |
| pankso@13 | 136 } |
| pankso@13 | 137 |
| pankso@4 | 138 # |
| pankso@4 | 139 # Commands |
| pankso@4 | 140 # |
| pankso@4 | 141 |
| pankso@4 | 142 case "$1" in |
| pankso@4 | 143 users) |
| pankso@4 | 144 gettext -e "\nChecking:"; echo " /etc/passwd" |
| pankso@4 | 145 fgrep "Ssfs User" /etc/passwd | while read line |
| pankso@4 | 146 do |
| pankso@4 | 147 login=$(echo $line | cut -d ":" -f 1) |
| pankso@4 | 148 home="$root/home/$login" |
| pankso@4 | 149 usage=$(du -sm $home | awk '{print $1}') |
| pankso@4 | 150 config=$SSFS_USERS/$login.conf |
| pankso@4 | 151 . $config || gettext -e "WARNING: No config file\n" |
| pankso@4 | 152 user_info |
| pankso@4 | 153 done |
| pankso@4 | 154 users=$(ls $SSFS_USERS | wc -l) |
| pankso@4 | 155 gettext "Users:"; echo -e " $users\n" ;; |
| pankso@4 | 156 adduser) |
| pankso@4 | 157 # Add a Ssfs user to the system with $HOME in chroot. |
| pankso@4 | 158 [ -z "$login" ] && gettext -e "Missing user login name.\n" && exit 0 |
| pankso@4 | 159 [ -z "$id" ] && gettext -e "Missing user id.\n" && exit 0 |
| pankso@4 | 160 [ -z "$pass" ] && gettext -e "Missing user password.\n" && exit 0 |
| pankso@4 | 161 user_paths |
| pankso@29 | 162 |
| pankso@29 | 163 # We need chroot command allowed for users to chroot them on SSH |
| paul@33 | 164 # login. Ssfs users have /bin/ssfs-sh as SHell. |
| pankso@29 | 165 grep -q ^chroot /etc/busybox.conf || |
| pankso@29 | 166 echo 'chroot = ssx root.root' >> /etc/busybox.conf |
| pankso@4 | 167 |
| pankso@4 | 168 gettext -e "\nChecking:"; echo " /etc/passwd" |
| pankso@4 | 169 if grep ^$login: /etc/passwd; then |
| paul@12 | 170 gettext -e "Exiting, user already exists:" |
| pankso@4 | 171 echo -e " $login\n" && exit 0 |
| pankso@4 | 172 fi |
| pankso@29 | 173 |
| pankso@4 | 174 gettext "Creating user: $login..." |
| pankso@4 | 175 echo -e "$pass\n$pass" | \ |
| pankso@29 | 176 adduser -h "$home" -g "Ssfs User" -u $id \ |
| pankso@29 | 177 -s /bin/ssfs-sh $login >/dev/null |
| pankso@4 | 178 status |
| pankso@29 | 179 |
| pankso@29 | 180 # Add user to chroot /etc/passwd |
| pankso@29 | 181 gettext "Checking vdisk chroot:"; echo " $root/etc/passwd" |
| pankso@29 | 182 if ! grep -q ^$login: $root/etc/passwd; then |
| pankso@29 | 183 echo "$login:x:$id:$id:Ssfs User:/home/$login:/bin/sh" >> \ |
| pankso@29 | 184 $root/etc/passwd |
| pankso@29 | 185 fi |
| pankso@4 | 186 |
| paul@12 | 187 # We don't want any files from /etc/skel. |
| pankso@4 | 188 gettext "Cleaning home and creating: Sync/..." |
| pankso@15 | 189 rm -rf $home && mkdir -p $home/Sync $home/.ssh && status |
| pankso@4 | 190 gettext "Changing mode on user home: 0700..." |
| pankso@4 | 191 chown -R $login.$login $home |
| pankso@4 | 192 chmod 0700 $home && status |
| pankso@4 | 193 |
| paul@12 | 194 # Create a custom config per user in SSFS_USERS. |
| pankso@4 | 195 [ ! -d "$SSFS_USERS" ] && mkdir -p $SSFS_USERS |
| pankso@4 | 196 user_config ;; |
| pankso@4 | 197 deluser) |
| pankso@4 | 198 [ -z "$login" ] && gettext -e "Missing user login name.\n" && exit 0 |
| pankso@4 | 199 user_paths |
| pankso@4 | 200 gettext -e "\nDeleting user:"; echo -n " $login..." |
| pankso@29 | 201 sed -i /^$login:/d $root/etc/passwd |
| pankso@4 | 202 deluser $login || status && status |
| pankso@4 | 203 gettext "Removing all files in:"; echo -n " $home..." |
| pankso@4 | 204 rm -rf $home && status |
| pankso@4 | 205 gettext "Removing user config:"; echo -n " $login.conf..." |
| pankso@4 | 206 rm -rf $config && status |
| pankso@4 | 207 echo "" ;; |
| pankso@4 | 208 chroot) |
| pankso@4 | 209 gettext -e "\nChanging root to:"; echo -e " $root\n" |
| pankso@4 | 210 chroot $root |
| pankso@4 | 211 gettext -e "\nBack to the host system:" |
| pankso@4 | 212 echo -e " $(hostname)\n" ;; |
| pankso@13 | 213 gen-vdisk) |
| pankso@34 | 214 <<<<<<< local |
| pankso@34 | 215 # Generated a virtual disk with a minimal chroot for Ssfs users home. |
| pankso@34 | 216 rootfs=$share/rootfs |
| pankso@34 | 217 ======= |
| paul@33 | 218 # Generate a virtual disk with a minimal chroot for Ssfs users home. |
| pankso@34 | 219 >>>>>>> other |
| pankso@4 | 220 if [ -d "$root/bin" ]; then |
| pankso@34 | 221 gettext "A chroot already exists in:"; echo " $root" |
| pankso@34 | 222 exit 0 |
| pankso@34 | 223 fi |
| pankso@34 | 224 if [ ! -f "$rootfs/etc/busybox.conf" ]; then |
| pankso@34 | 225 gettext "Missing package ssfs-busybox"; echo |
| pankso@4 | 226 exit 0 |
| pankso@4 | 227 fi |
| pankso@13 | 228 echo "" |
| pankso@34 | 229 gettext "Creating Sshs vdisk minimal chroot"; echo |
| pankso@13 | 230 separator |
| pankso@34 | 231 echo "Chroot path: $root" |
| pankso@34 | 232 |
| pankso@13 | 233 # Create vdisk if missing. |
| pankso@13 | 234 if [ ! -f "$vdisk" ]; then |
| pankso@13 | 235 gettext "Creating virtual disk:"; echo " $vdisk ${size}Gb" |
| pankso@13 | 236 dd if=/dev/zero of=$vdisk bs=1G count=$size |
| pankso@23 | 237 chmod 0600 $vdisk && du -sh $vdisk |
| pankso@13 | 238 gettext "Creating ext3 filesystem..." |
| pankso@13 | 239 mkfs.ext3 -q -T ext3 -L "Ssfs" -F $vdisk |
| pankso@13 | 240 status |
| pankso@13 | 241 mount_vdisk |
| pankso@13 | 242 fi |
| pankso@13 | 243 |
| paul@33 | 244 # Create a radically minimal chroot with all libs in /lib. |
| pankso@13 | 245 gettext "Creating base files..." |
| pankso@13 | 246 mkdir -p $root && cd $root |
| pankso@34 | 247 for d in etc lib home root |
| pankso@13 | 248 do |
| pankso@13 | 249 mkdir -p $d |
| pankso@13 | 250 done && status |
| pankso@34 | 251 |
| pankso@34 | 252 # /etc files. |
| pankso@34 | 253 cp -f /etc/slitaz-release $root/etc |
| pankso@34 | 254 if [ ! -f "$root/etc/passwd" ]; then |
| pankso@34 | 255 echo "root:x:0:0:root:/root:/bin/sh" > $root/etc/passwd |
| pankso@34 | 256 echo "root::13525:0:99999:7:::" > $root/etc/shadow |
| pankso@34 | 257 echo "root:x:0:" > $root/etc/group |
| pankso@34 | 258 echo "root:*::" > $root/etc/gshadow |
| pankso@34 | 259 fi |
| pankso@34 | 260 |
| pankso@34 | 261 # /dev nodes. |
| pankso@29 | 262 #mknod -m 666 $root/dev/null c 1 3 |
| pankso@34 | 263 |
| pankso@34 | 264 # Ssfs Busybox package install files in $cache and allow easy vdisk |
| pankso@34 | 265 # upgrade folowing SliTaz repo. |
| pankso@34 | 266 gettext "Installing Ssfs Busybox..." |
| pankso@34 | 267 cp -a $rootfs/* $root |
| pankso@4 | 268 status |
| pankso@13 | 269 |
| pankso@34 | 270 <<<<<<< local |
| pankso@34 | 271 gettext "Setting files permissions..." |
| pankso@34 | 272 chmod 0640 $root/etc/*shadow |
| pankso@34 | 273 chmod 0700 $root/root && status |
| pankso@34 | 274 chmod 4755 $root/bin/busybox |
| pankso@34 | 275 ======= |
| pankso@13 | 276 # Busybox without deps (get && extract). No system comands are allowed |
| paul@33 | 277 # in /etc/busybox.conf to restrict SSH'd users. |
| pankso@4 | 278 gettext "Installing Busybox..." |
| pankso@13 | 279 cd $root/tmp |
| pankso@13 | 280 tazpkg get busybox >/dev/null |
| pankso@13 | 281 tazpkg extract busybox-* >/dev/null |
| pankso@13 | 282 rm -rf fs && mv -f busybox-*/fs . && rm -rf busybox-* |
| pankso@13 | 283 cp -a fs/bin fs/sbin $root |
| pankso@13 | 284 cp -a fs/usr/bin fs/usr/sbin $root/usr |
| pankso@29 | 285 rm -rf fs && chmod 4755 $root/bin/busybox |
| pankso@4 | 286 status |
| pankso@31 | 287 gettext "Creating restrictive Busybox config file..." |
| pankso@31 | 288 echo '# Ssfs Busybox configuration.' \ |
| pankso@13 | 289 > $root/etc/busybox.conf |
| pankso@29 | 290 echo -e "\n[SUID]" >> $root/etc/busybox.conf |
| pankso@29 | 291 echo -e "su = --- root.root" >> $root/etc/busybox.conf |
| pankso@34 | 292 >>>>>>> other |
| pankso@13 | 293 chmod 0600 $root/etc/busybox.conf |
| pankso@13 | 294 |
| pankso@13 | 295 # Glib minimal libs, use host lib since package should be installed |
| pankso@13 | 296 # from same repo. |
| pankso@13 | 297 gettext "Installing Glibc libraries..." |
| pankso@13 | 298 for l in ld-*.*so* libc-*.*so libc.so.* libnss_files* |
| pankso@13 | 299 do |
| pankso@13 | 300 cp -a /lib/$l* $root/lib |
| pankso@34 | 301 done && status |
| pankso@31 | 302 |
| pankso@31 | 303 # Ssfs chroot SHell |
| pankso@31 | 304 gettext "Installing Ssfs SHell..." |
| pankso@31 | 305 install -m 0755 /bin/ssfs-sh $root/bin |
| pankso@31 | 306 status |
| pankso@34 | 307 |
| pankso@34 | 308 # List of all system files. |
| pankso@34 | 309 cd $root |
| pankso@34 | 310 for d in bin etc lib sbin |
| pankso@34 | 311 do |
| pankso@34 | 312 find ./$d | sed s'/^.//' |
| pankso@34 | 313 done |
| pankso@31 | 314 |
| pankso@13 | 315 size=$(du -sh $root | awk '{print $1}') |
| pankso@13 | 316 separator |
| pankso@13 | 317 gettext "Vdisk used space:"; echo -e " $size\n" ;; |
| pankso@13 | 318 mount-vdisk) |
| pankso@13 | 319 mount_vdisk ;; |
| pankso@13 | 320 umount-vdisk) |
| pankso@13 | 321 umount_vdisk ;; |
| pankso@15 | 322 check-vdisk) |
| pankso@15 | 323 # Check vdisk with e2fsck. |
| pankso@15 | 324 echo "" |
| pankso@15 | 325 gettext -e "Checking Ssfs virtual disk\n" |
| pankso@15 | 326 separator |
| pankso@15 | 327 gettext "Virtual disk : "; du -sh $vdisk |
| pankso@15 | 328 gettext "Filesystem usage : "; du -sh $root |
| pankso@15 | 329 gettext "Remounting vdisk read/only before e2fsck -p..." |
| pankso@15 | 330 mount -o remount,loop,ro $vdisk $root && status |
| pankso@15 | 331 e2fsck -p $vdisk |
| pankso@15 | 332 gettext "Remounting vdisk read/write..." |
| pankso@15 | 333 mount -o remount,loop,rw $vdisk $root && status |
| pankso@15 | 334 separator && echo "" ;; |
| pankso@13 | 335 clean-vdisk) |
| pankso@13 | 336 # clean up the vdisk storage chroot. |
| pankso@34 | 337 if [ ! -d "$root/bin" ] || [ ! -d "$root/lib" ]; then |
| pankso@4 | 338 gettext -e "No chroot found in:"; echo " $root" |
| pankso@4 | 339 exit 0 |
| pankso@4 | 340 fi |
| pankso@13 | 341 gettext -e "\nCleaning virtual disk\n" |
| pankso@13 | 342 separator |
| pankso@34 | 343 echo "Chroot path: $root" |
| pankso@4 | 344 cd $root |
| pankso@4 | 345 for dir in * |
| pankso@4 | 346 do |
| pankso@4 | 347 size=$(du -sh $dir | awk '{print $1}') |
| pankso@4 | 348 case "$dir" in |
| pankso@34 | 349 etc|home|root|lost*) |
| pankso@4 | 350 gettext "Skipping:"; echo " $dir $size *" ;; |
| pankso@4 | 351 *) |
| pankso@4 | 352 gettext "Removing:"; echo " $dir $size" |
| pankso@4 | 353 rm -rf $dir ;; |
| pankso@4 | 354 esac |
| pankso@13 | 355 done && separator && echo "" ;; |
| pankso@4 | 356 *) |
| pankso@4 | 357 help ;; |
| pankso@4 | 358 esac |
| pankso@4 | 359 exit 0 |