1#!/bin/bash
2#
3# ssh-user-config, Copyright 2000-2008 Red Hat Inc.
4#
5# This file is part of the Cygwin port of OpenSSH.
6#
7# Permission to use, copy, modify, and distribute this software for any
8# purpose with or without fee is hereby granted, provided that the above
9# copyright notice and this permission notice appear in all copies.
10#
11# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS  
12# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF               
13# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.   
14# IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,   
15# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR    
16# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR    
17# THE USE OR OTHER DEALINGS IN THE SOFTWARE.                               
18
19# ======================================================================
20# Initialization
21# ======================================================================
22PROGNAME=$(basename -- $0)
23_tdir=$(dirname -- $0)
24PROGDIR=$(cd $_tdir && pwd)
25
26CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh
27
28# Subdirectory where the new package is being installed
29PREFIX=/usr
30
31# Directory where the config files are stored
32SYSCONFDIR=/etc
33
34source ${CSIH_SCRIPT}
35
36auto_passphrase="no"
37passphrase=""
38pwdhome=
39with_passphrase=
40
41# ======================================================================
42# Routine: create_identity
43#   optionally create identity of type argument in ~/.ssh
44#   optionally add result to ~/.ssh/authorized_keys
45# ======================================================================
46create_identity() {
47  local file="$1"
48  local type="$2"
49  local name="$3"
50  if [ ! -f "${pwdhome}/.ssh/${file}" ]
51  then
52    if csih_request "Shall I create a ${name} identity file for you?"
53    then
54      csih_inform "Generating ${pwdhome}/.ssh/${file}"
55      if [ "${with_passphrase}" = "yes" ]
56      then
57        ssh-keygen -t "${type}" -N "${passphrase}" -f "${pwdhome}/.ssh/${file}" > /dev/null
58      else
59        ssh-keygen -t "${type}" -f "${pwdhome}/.ssh/${file}" > /dev/null
60      fi
61      if csih_request "Do you want to use this identity to login to this machine?"
62      then
63        csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys"
64        cat "${pwdhome}/.ssh/${file}.pub" >> "${pwdhome}/.ssh/authorized_keys"
65      fi
66    fi
67  fi
68} # === End of create_ssh1_identity() === #
69readonly -f create_identity
70
71# ======================================================================
72# Routine: check_user_homedir
73#   Perform various checks on the user's home directory
74# SETS GLOBAL VARIABLE:
75#   pwdhome
76# ======================================================================
77check_user_homedir() {
78  local uid=$(id -u)
79  pwdhome=$(awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd)
80  if [ "X${pwdhome}" = "X" ]
81  then
82    csih_error_multi \
83      "There is no home directory set for you in ${SYSCONFDIR}/passwd." \
84      'Setting $HOME is not sufficient!'
85  fi
86  
87  if [ ! -d "${pwdhome}" ]
88  then
89    csih_error_multi \
90      "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" \
91      'but it is not a valid directory. Cannot create user identity files.'
92  fi
93  
94  # If home is the root dir, set home to empty string to avoid error messages
95  # in subsequent parts of that script.
96  if [ "X${pwdhome}" = "X/" ]
97  then
98    # But first raise a warning!
99    csih_warning "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!"
100    if csih_request "Would you like to proceed anyway?"
101    then
102      pwdhome=''
103    else
104      csih_warning "Exiting. Configuration is not complete"
105      exit 1
106    fi
107  fi
108  
109  if [ -d "${pwdhome}" -a csih_is_nt -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ]
110  then
111    echo
112    csih_warning 'group and other have been revoked write permission to your home'
113    csih_warning "directory ${pwdhome}."
114    csih_warning 'This is required by OpenSSH to allow public key authentication using'
115    csih_warning 'the key files stored in your .ssh subdirectory.'
116    csih_warning 'Revert this change ONLY if you know what you are doing!'
117    echo
118  fi
119} # === End of check_user_homedir() === #
120readonly -f check_user_homedir
121
122# ======================================================================
123# Routine: check_user_dot_ssh_dir
124#   Perform various checks on the ~/.ssh directory
125# PREREQUISITE:
126#   pwdhome -- check_user_homedir()
127# ======================================================================
128check_user_dot_ssh_dir() {
129  if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ]
130  then
131    csih_error "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files."
132  fi
133  
134  if [ ! -e "${pwdhome}/.ssh" ]
135  then
136    mkdir "${pwdhome}/.ssh"
137    if [ ! -e "${pwdhome}/.ssh" ]
138    then
139      csih_error "Creating users ${pwdhome}/.ssh directory failed"
140    fi
141  fi
142} # === End of check_user_dot_ssh_dir() === #
143readonly -f check_user_dot_ssh_dir
144
145# ======================================================================
146# Routine: fix_authorized_keys_perms
147#   Corrects the permissions of ~/.ssh/authorized_keys
148# PREREQUISITE:
149#   pwdhome   -- check_user_homedir()
150# ======================================================================
151fix_authorized_keys_perms() {
152  if [ csih_is_nt -a -e "${pwdhome}/.ssh/authorized_keys" ]
153  then
154    if ! setfacl -m "u::rw-,g::---,o::---" "${pwdhome}/.ssh/authorized_keys"
155    then
156      csih_warning "Setting correct permissions to ${pwdhome}/.ssh/authorized_keys"
157      csih_warning "failed.  Please care for the correct permissions.  The minimum requirement"
158      csih_warning "is, the owner needs read permissions."
159      echo
160    fi
161  fi
162} # === End of fix_authorized_keys_perms() === #
163readonly -f fix_authorized_keys_perms
164
165
166# ======================================================================
167# Main Entry Point
168# ======================================================================
169
170# Check how the script has been started.  If
171#   (1) it has been started by giving the full path and
172#       that path is /etc/postinstall, OR
173#   (2) Otherwise, if the environment variable
174#       SSH_USER_CONFIG_AUTO_ANSWER_NO is set
175# then set auto_answer to "no".  This allows automatic
176# creation of the config files in /etc w/o overwriting
177# them if they already exist.  In both cases, color
178# escape sequences are suppressed, so as to prevent
179# cluttering setup's logfiles.
180if [ "$PROGDIR" = "/etc/postinstall" ]
181then
182  csih_auto_answer="no"
183  csih_disable_color
184fi
185if [ -n "${SSH_USER_CONFIG_AUTO_ANSWER_NO}" ]
186then
187  csih_auto_answer="no"
188  csih_disable_color
189fi
190
191# ======================================================================
192# Parse options
193# ======================================================================
194while :
195do
196  case $# in
197  0)
198    break
199    ;;
200  esac
201
202  option=$1
203  shift
204
205  case "$option" in
206  -d | --debug )
207    set -x
208    csih_trace_on
209    ;;
210
211  -y | --yes )
212    csih_auto_answer=yes
213    ;;
214
215  -n | --no )
216    csih_auto_answer=no
217    ;;
218
219  -p | --passphrase )
220    with_passphrase="yes"
221    passphrase=$1
222    shift
223    ;;
224
225  --privileged )
226    csih_FORCE_PRIVILEGED_USER=yes
227    ;;
228
229  *)
230    echo "usage: ${PROGNAME} [OPTION]..."
231    echo
232    echo "This script creates an OpenSSH user configuration."
233    echo
234    echo "Options:"
235    echo "    --debug      -d        Enable shell's debug output."
236    echo "    --yes        -y        Answer all questions with \"yes\" automatically."
237    echo "    --no         -n        Answer all questions with \"no\" automatically."
238    echo "    --passphrase -p word   Use \"word\" as passphrase automatically."
239    echo "    --privileged           On Windows NT/2k/XP, assume privileged user"
240    echo "                           instead of LocalSystem for sshd service."
241    echo
242    exit 1
243    ;;
244
245  esac
246done
247
248# ======================================================================
249# Action!
250# ======================================================================
251
252# Check passwd file
253if [ ! -f ${SYSCONFDIR}/passwd ]
254then
255  csih_error_multi \
256    "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" \
257    'first using mkpasswd. Check if it contains an entry for you and' \
258    'please care for the home directory in your entry as well.'
259fi
260
261check_user_homedir
262check_user_dot_ssh_dir
263create_identity id_rsa rsa "SSH2 RSA"
264create_identity id_dsa dsa "SSH2 DSA"
265create_identity id_ecdsa ecdsa "SSH2 ECDSA"
266create_identity identity rsa1 "(deprecated) SSH1 RSA"
267fix_authorized_keys_perms
268
269echo
270csih_inform "Configuration finished. Have fun!"
271
272
273