scponly_unison/setup_chroot.sh

   1 #!/bin/sh
   2 #
   3 # handy functions:
   4 #
   5 # a function to display a failure message and then exit
   6 fail ( ) {
   7         echo -e $@
   8         exit 1
   9 }
  10
  11 # "get with default" function
  12 # this function prompts the user with a query and default reply
  13 # it returns the user reply
  14 getwd ( ) {
  15         query="$1"
  16         default="$2"
  17         echo -en "$query [$default]" | cat >&2
  18         read response
  19         if [ x$response = "x" ]; then
  20                 response=$default
  21         fi
  22         echo $response
  23 }
  24
  25 # "get yes no" function
  26 # this function prompts the user with a query and will continue to do so
  27 # until they reply with either "y" or "n"
  28 getyn ( ) {
  29         query="$@"
  30         echo -en $query | cat >&2
  31         read response
  32         while [ x$response != "xy" -a x$response != "xn" ]; do
  33                 echo -e "\n'y' or 'n' only please...\n" | cat >&2
  34                 echo -en $query | cat >&2
  35                 read response
  36         done
  37         echo $response
  38 }
  39
  40 # configuration
  41 #
  42 # set defaults
  43 defaultusername="scponly"
  44 defaulthomedirprefix="/home"
  45 defaultwriteabledir="incoming"
  46
  47 osname=`uname -s | tr ' ' '_'`
  48 # pathname to platform/OS specific setup scripts
  49 prescript="build_extras/arch/$osname.pre.sh"
  50 postscript="build_extras/arch/$osname.post.sh"
  51
  52 # the following is a list of binaries that will be staged in the target dir
  53 BINARIES=`grep '#define PROG_' config.h | cut -f2 -d\" | grep -v ^cd$`
  54
  55 # we set the install path in a variable so the presetup script can overwrite it on systems
  56 # which require it
  57 INSTALL_PATHNAME="install -c"
  58
  59 # attempt a best guess at required libs, we can append things in the presetup script if we need to
  60 LDSOFOUND=0
  61
  62 # default to useradd, not pw
  63 USE_PW=0
  64
  65 if [ x/usr/bin/ldd = x ]; then
  66         echo "this script requires the program ldd to determine which"
  67         fail "shared libraries to copy into your chrooted dir..."
  68 fi
  69
  70 if [ x`uname -s` = "xOpenBSD" ]; then
  71         for bin in $BINARIES; do
  72                 GREP_LIST="$GREP_LIST -e $bin"
  73         done
  74         LIB_LIST=`ldd $BINARIES 2> /dev/null | /usr/bin/tr -s " " | cut -f5 -d" " | /usrgrep -v "^Name" | /usrgrep -v $GREP_LIST | /usr/bin/sort -u`
  75 else
  76         LIB_LIST=`ldd $BINARIES 2> /dev/null | cut -f2 -d\> | cut -f1 -d\( | grep "^ " | sort -u`
  77 fi
  78
  79 #
  80 #       we also need to add some form of ld.so, here are some good guesses.
  81 #
  82 LDSO_LIST="/lib/ld.so /libexec/ld-elf.so /libexec/ld-elf.so.1 /usr/libexec/ld.so /lib64/ld-linux-x86-64.so.2 /lib/ld-linux.so.2 /usr/libexec/ld-elf.so.1"
  83 for lib in $LDSO_LIST; do
  84         if [ -f $lib ]; then
  85                 LDSOFOUND=1;
  86                 LIB_LIST="$LIB_LIST $lib"
  87         fi
  88 done
  89
  90 #
  91 #       TODO - i've since forgotten which OS this is for, it should be relocated to a presetup script
  92 #
  93 ls /lib/libnss_compat* > /dev/null 2>&1
  94 if [ $? -eq 0 ]; then
  95         LIB_LIST="$LIB_LIST /lib/libnss_compat*"
  96 fi
  97
  98 # check that the configure options are correct for chrooted operation:
  99
 100 if [ x/usr/sbin/useradd = x ]; then
 101     if [ x = x ]; then
 102                 echo "this script requires the program useradd or pw to add your"
 103                 fail "chrooted scponly user."
 104         else
 105                 USE_PW=1;
 106     fi
 107 fi
 108
 109 # we need to be root
 110 if [ `id -u` != "0" ]; then
 111         fail "you must be root to run this script\n"
 112 fi
 113
 114 echo
 115 echo Next we need to set the home directory for this scponly user.
 116 echo please note that the user\'s home directory MUST NOT be writeable
 117 echo by the scponly user.  this is important so that the scponly user
 118 echo cannot subvert the .ssh configuration parameters.
 119 echo
 120 echo for this reason, a writeable subdirectory will be created that
 121 echo the scponly user can write into.
 122 echo
 123
 124 if [ "$2" != "" ] ; then
 125         targetuser=$2
 126 else
 127 targetuser=`getwd "Username to install" "$defaultusername"`
 128 fi
 129 username_collision=`id $targetuser > /dev/null 2> /dev/null; echo $?`
 130 if [ $username_collision -eq 0 ] ; then
 131         fail "the user $targetuser already exists.  please remove this user and their home directory and try again."
 132 fi
 133
 134 if [ "$1" != "" ] ; then
 135         targetdir=$1
 136 else
 137 targetdir=`getwd "home directory you wish to set for this user" "$defaulthomedirprefix/$targetuser"`
 138 fi
 139
 140 if [ "$3" != "" ] ; then
 141         writeabledir=$3
 142 else
 143 writeabledir=`getwd "name of the writeable subdirectory" "$defaultwriteabledir"`
 144 fi
 145
 146 #
 147 #       if you would like to overwrite/extend any of the variables above, do so in the system specific
 148 #       presetup script.
 149 #
 150 if [ -f "$prescript" ]; then
 151 #
 152 #       this system has a pre-chroot setup script, lets run it
 153 #
 154         . "$prescript"
 155 fi
 156
 157 # if neither the presetup script or the best guess could find ld.so, we have to bail here
 158 if [ $LDSOFOUND -eq 0 ]; then
 159         fail i cant find your equivalent of ld.so
 160 fi
 161
 162 #
 163 #       ACTUAL MODIFICATIONS BEGIN HERE
 164 #
 165
 166 # this part shouldnt strictly be requried, but i'll leave it in until i'm sure of it
 167 if [ ! -d $targetdir ]; then
 168         $INSTALL_PATHNAME -d $targetdir
 169         chmod 755 $targetdir
 170 fi
 171
 172 if [ ! -d $targetdir/etc ]; then
 173         $INSTALL_PATHNAME -d $targetdir/etc
 174         chown 0:0 $targetdir/etc
 175         chmod 755 $targetdir/etc
 176 fi
 177
 178 # add all our binaries
 179 for bin in $BINARIES; do
 180         $INSTALL_PATHNAME -d $targetdir/`/usr/bin/dirname $bin`
 181         $INSTALL_PATHNAME $bin $targetdir$bin
 182 done
 183
 184 # and the libs they require
 185 if [ "x$LIB_LIST" != "x" ]; then
 186         for lib in $LIB_LIST; do
 187                 $INSTALL_PATHNAME -d $targetdir/`/usr/bin/dirname $lib`
 188                 $INSTALL_PATHNAME $lib $targetdir/$lib
 189         done
 190 fi
 191
 192 # /dev/null is needed inside the chroot
 193 mkdir -p $targetdir/dev
 194 mknod -m 666 $targetdir/dev/null c 1 3
 195
 196 if [ "x$USE_PW" = x0 ] ; then
 197     /usr/sbin/useradd -d "$targetdir" -s "/usr/sbin/scponlyc" $targetuser
 198     if [ $? -ne 0 ]; then
 199          fail "if this user exists, remove it and try again"
 200     fi
 201 else
 202      useradd -n $targetuser -s "/usr/sbin/scponlyc" -d "$targetdir"
 203     if [ $? -ne 0 ]; then
 204          fail "if this user exists, remove it and try again"
 205     fi
 206 fi
 207
 208 #
 209 #       we must ensure certain directories are root owned.
 210 #
 211 chown 0:0 $targetdir
 212 if [ -d $targetdir/.ssh ]; then
 213         chown 0:0 $targetdir/.ssh
 214 fi
 215
 216 if [ ! -d $targetdir/$writeabledir ]; then
 217         echo -e "\ncreating  $targetdir/$writeabledir directory for uploading files"
 218         $INSTALL_PATHNAME -o $targetuser -d $targetdir/$writeabledir
 219 fi
 220
 221 #
 222 #       set the perms on the writeable dir so that the new user owns it
 223 #
 224 newuid=`id -u $targetuser`
 225 newgid=`id -g $targetuser`
 226 chown $newuid:$newgid $targetdir/$writeabledir
 227
 228 if [ -f "$postscript" ]; then
 229 #
 230 #   this system has a post-chroot setup script, lets run it
 231 #
 232     . "$postscript"
 233 else
 234 #
 235 #       otherwise, revert to the old "best guess" system, which sucks
 236 #
 237         echo
 238         echo "Your platform ($osname) does not have a platform specific setup script."
 239         echo "This install script will attempt a best guess."
 240         echo "If you perform customizations, please consider sending me your changes."
 241         echo "Look to the templates in build_extras/arch."
 242         echo " - joe at sublimation dot org"
 243         echo
 244         if [ x = x ]; then
 245         #
 246         #       ok we dont have pwd_mkdb, lets improvise:
 247         #
 248                 grep $targetuser /etc/passwd > $targetdir/etc/passwd
 249                 # Debian: copy /etc/group into the jail, for /usr/bin/groups to work
 250                 cp /etc/group $targetdir/etc/group
 251
 252         else
 253         #
 254         #       this is for systems which do have pwd_mkdb
 255         #
 256                 grep $targetuser /etc/master.passwd > $targetdir/etc/master.passwd
 257                  -d "$targetdir/etc" $targetdir/etc/master.passwd
 258                 rm -rf $targetdir/etc/master.passwd $targetdir/etc/spwd.db
 259         fi
 260 fi
 261
 262 #
 263 #   the final step is setting the password
 264 #
 265 echo "please set the password for $targetuser:"
 266 passwd $targetuser
 267
 268 echo "if you experience a warning with winscp regarding groups, please install"
 269 echo "the provided hacked out fake groups program into your chroot, like so:"
 270 echo "cp groups $targetdir/bin/groups"