jailsetup.sh

   1 #!/bin/sh
   2 # The Girocco jail setup script
   3 #
   4 # If the first parameter is "dbonly", setup the database only
   5 #
   6 # We are designed to set up the chroot based on the output of
   7 # `uname -s` by sourcing a suitable system-specific script.
   8 # Unrecognized systems will generate an error.  When using
   9 # "dbonly" the setup of the chroot binaries is skipped so the
  10 # output of `uname -s` does not matter in that case.
  11
  12 set -e
  13
  14 curdir="$(pwd)"
  15 srcdir="$curdir/src"
  16 getent="$srcdir/getent"
  17 . ./shlib.sh
  18
  19 # find_std_utility should always come up with the full path to the standard
  20 # version of the utility whose name is passed as "$1"
  21 getconf="/usr/bin/getconf"
  22 [ -x "$getconf" ] || getconf="/bin/getconf"
  23 [ -x "$getconf" ] || getconf="getconf"
  24 stdpath="$("unset" -f command; "command" "$getconf" "PATH" 2>/dev/null)" || :
  25 ":" "${stdpath:=/bin:/usr/bin}"
  26 stdpath="$stdpath:/sbin:/usr/sbin"
  27 find_std_utility() (
  28         "unset" -f unalias command "$1" >/dev/null 2>&1 || :
  29         "unalias" -a >/dev/null 2>&1 || :
  30         PATH="$stdpath" && "export" PATH || :
  31         "command" -v "$1"
  32 ) 2>/dev/null
  33
  34 dbonly=
  35 [ "$1" != "dbonly" ] || dbonly=1
  36
  37 reserved_users="root sshd _sshd mob git lock bundle nobody everyone $cfg_cgi_user $cfg_mirror_user"
  38
  39 # Require either sshd or _sshd user unless "dbonly"
  40 sshd_user=sshd
  41 if ! "$getent" passwd sshd >/dev/null && ! "$getent" passwd _sshd >/dev/null; then
  42         if [ -n "$dbonly" ]; then
  43                 if ! [ -s etc/passwd ]; then
  44                         # Only complain on initial etc/passwd creation
  45                         echo "WARNING: no sshd or _sshd user, omitting entries from chroot etc/passwd"
  46                 fi
  47                 sshd_user=
  48         else
  49                 echo "*** Error: You do not have required sshd or _sshd user in system." >&2
  50                 exit 1
  51         fi
  52 else
  53         "$getent" passwd sshd >/dev/null || sshd_user=_sshd
  54 fi
  55
  56 # Verify we have all we need
  57 if ! "$getent" passwd "$cfg_mirror_user" >/dev/null; then
  58         echo "*** Error: You do not have \"$cfg_mirror_user\" user in system yet." >&2
  59         exit 1
  60 fi
  61 if ! "$getent" passwd "$cfg_cgi_user" >/dev/null; then
  62         echo "*** Error: You do not have \"$cfg_cgi_user\" user in system yet." >&2
  63         exit 1
  64 fi
  65 if [ -n "$dbonly" ] && [ -z "$cfg_owning_group" ]; then
  66         cfg_owning_group="$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 4)"
  67 elif ! "$getent" group "$cfg_owning_group" >/dev/null; then
  68         echo "*** Error: You do not have \"$cfg_owning_group\" group in system yet." >&2
  69         exit 1
  70 fi
  71
  72 # One last paranoid check before we go writing all over everything
  73 if [ -z "$cfg_chroot" ] || [ "$cfg_chroot" = "/" ]; then
  74         echo "*** Error: chroot location is not set or is invalid." >&2
  75         echo "*** Error: perhaps you have an incorrect Config.pm?" >&2
  76         exit 1
  77 fi
  78
  79 umask 022
  80 mkdir -p "$cfg_chroot"
  81 cd "$cfg_chroot"
  82 chmod 755 "$cfg_chroot" ||
  83         echo "WARNING: Cannot chmod $cfg_chroot"
  84
  85 mkdir -p var/empty
  86 chmod 0555 var/empty ||
  87         echo "WARNING: Cannot chmod a=rx $cfg_chroot/var/empty"
  88
  89 # Set up basic user/group configuration; if there isn't any already
  90 mobpass=
  91 [ -n "$cfg_mob" ] || mobpass='x'
  92 mkdir -p etc
  93 if ! [ -s etc/passwd ]; then
  94         cat >etc/passwd <<EOT
  95 root:x:0:0:system administrator:/var/empty:/bin/false
  96 nobody:x:$("$getent" passwd nobody | cut -d : -f 3-4):unprivileged user:/var/empty:/bin/false
  97 EOT
  98         [ -z "$sshd_user" ] || cat >>etc/passwd <<EOT
  99 sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
 100 _sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
 101 EOT
 102         [ "$cfg_cgi_user" = "$cfg_mirror_user" ] || cat >>etc/passwd <<EOT
 103 $cfg_cgi_user:x:$("$getent" passwd "$cfg_cgi_user" | cut -d : -f 3-5):/:/bin/true
 104 EOT
 105         cat >>etc/passwd <<EOT
 106 $cfg_mirror_user:x:$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 3-5):/:/bin/true
 107 everyone:x:65537:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):every user:/:/bin/false
 108 mob:$mobpass:65538:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):the mob:/:/bin/git-shell-verify
 109 git::65539:$("$getent" passwd nobody | cut -d : -f 4):read-only access:/:/bin/git-shell-verify
 110 EOT
 111 elif [ -z "$dbonly" ]; then
 112         # Make sure an sshd entry is present
 113         if ! grep -q '^sshd:' etc/passwd; then
 114                 echo "*** Error: chroot etc/passwd exists but lacks sshd entry." >&2
 115                 exit 1
 116         fi
 117 fi
 118
 119 if ! [ -s etc/group ]; then
 120         cat >etc/group <<EOT
 121 _repo:x:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):$cfg_mirror_user
 122 EOT
 123 fi
 124
 125 # Create backups area
 126 mkdir -p etc/backups
 127
 128 # Set up basic default Git configuration
 129 # Initialize one if none exists or update critical variables for an existing one
 130 mkdir -p etc/girocco
 131 didchmod=
 132 if [ -e etc/girocco/.gitconfig ] && ! [ -f etc/girocco/.gitconfig ]; then
 133         echo "*** Error: chroot etc/girocco/.gitconfig exists but is not a file." >&2
 134         exit 1
 135 fi
 136 if [ -f etc/girocco/.gitconfig ]; then
 137         gcerr=0
 138         x="$(git config --file etc/girocco/.gitconfig --get "no--such--section.no  such  subsection.no--such--key")" || gcerr=$?
 139         if [ $gcerr -gt 1 ]; then
 140                 echo "*** Error: chroot etc/girocco/.gitconfig exists but is corrupt." >&2
 141                 echo "*** Error: either remove it or edit it to correct the problem." >&2
 142                 exit 1
 143         fi
 144 fi
 145 if ! [ -s etc/girocco/.gitconfig ]; then
 146         chmod u+w etc/girocco
 147         didchmod=1
 148         cat >etc/girocco/.gitconfig <<EOT
 149 # Any values set here will take effect whenever Girocco runs a git command
 150
 151 EOT
 152 fi
 153 # $1 => name, $2 => value, $3 => overwrite_flag
 154 # if $3 is "2" and $2 is "" value will be unset
 155 update_config_item() {
 156         _existsnot=
 157         _oldval=
 158         _oldval="$(git config --file etc/girocco/.gitconfig --get "$1")" || _existsnot=1
 159         if [ -n "$_existsnot" ]; then
 160                 [ -n "$2" ] || [ "$3" != "2" ] || return 0
 161         else
 162                 [ -n "$3" ] || return 0
 163                 [ "$_oldval" != "$2" ] || { [ "$3" = "2" ] && [ -z "$2" ]; } || return 0
 164         fi
 165         [ -n "$didchmod" ] || { chmod u+w etc/girocco; didchmod=1; }
 166         if [ "$3" = "2" ] && [ -z "$2" ]; then
 167                 git config --file etc/girocco/.gitconfig --unset "$1"
 168         else
 169                 git config --file etc/girocco/.gitconfig "$1" "$2"
 170         fi
 171         if [ -n "$_existsnot" ]; then
 172                 echo "chroot: etc/girocco/.gitconfig: config $1: (created) \"$2\""
 173         elif [ "$3" = "2" ] && [ -z "$2" ]; then
 174                 echo "chroot: etc/girocco/.gitconfig: config $1: (removed)"
 175         else
 176                 echo "chroot: etc/girocco/.gitconfig: config $1: \"$_oldval\" -> \"$2\""
 177         fi
 178 }
 179 if [ -n "$cfg_git_no_mmap" ]; then
 180         update_config_item core.packedGitWindowSize 1m 1
 181 else
 182         update_config_item core.packedGitWindowSize 32m 1
 183 fi
 184 update_config_item core.packedGitLimit 256m 1
 185 if [ -n "$var_window_memory" ]; then
 186         update_config_item pack.windowMemory "$var_window_memory" 1
 187 fi
 188 if [ -n "$cfg_jgit_compatible_bitmaps" ]; then
 189         update_config_item pack.writeBitmapHashCache false 1
 190 else
 191         update_config_item pack.writeBitmapHashCache true 1
 192 fi
 193 update_config_item core.pager "cat" 1
 194 update_config_item core.compression 5
 195 update_config_item diff.renameLimit 250
 196 update_config_item transfer.unpackLimit 1 1
 197 update_config_item http.lowSpeedLimit 1
 198 update_config_item http.lowSpeedTime 600
 199 update_config_item receive.advertisePushOptions false 1
 200 update_config_item receive.maxInputSize "${cfg_max_receive_size:-0}" 1
 201 update_config_item girocco.notifyHook "${cfg_default_notifyhook}" 2
 202 if [ -n "$defined_cfg_git_client_ua" ]; then
 203         update_config_item http.userAgent "$cfg_git_client_ua" 1
 204 else
 205         update_config_item http.userAgent "" 2
 206 fi
 207
 208 # set up some default ssh client config just in case
 209 if [ -e etc/girocco/.ssh ] && ! [ -d etc/girocco/.ssh ]; then
 210         echo "*** Error: chroot etc/girocco/.ssh exists but is not a directory." >&2
 211         exit 1
 212 fi
 213 if [ -e etc/girocco/.ssh/config ] && ! [ -f etc/girocco/.ssh/config ]; then
 214         echo "*** Error: chroot etc/girocco/.ssh/config exists but is not a file." >&2
 215         exit 1
 216 fi
 217 if ! [ -s etc/girocco/.ssh/config ]; then
 218         chmod u+w etc/girocco
 219         didchmod=1
 220         [ -d etc/girocco/.ssh ] || mkdir etc/girocco/.ssh
 221         cat >etc/girocco/.ssh/config <<EOT
 222 # Any values set here will take effect whenever Girocco runs an ssh client command
 223 BatchMode yes
 224 StrictHostKeyChecking no
 225 CheckHostIP no
 226 UserKnownHostsFile /dev/null
 227 EOT
 228 fi
 229
 230 [ -z "$didchmod" ] || chmod a-w etc/girocco
 231
 232 mkdir -p etc/sshkeys etc/sshcerts etc/sshactive
 233 for ruser in $reserved_users; do
 234         touch etc/sshkeys/$ruser
 235 done
 236 chgrp $cfg_owning_group etc etc/sshkeys etc/sshcerts etc/sshactive ||
 237         echo "WARNING: Cannot chgrp $cfg_owning_group the etc directories"
 238 chgrp $cfg_owning_group etc/passwd ||
 239         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/passwd"
 240 chgrp $cfg_owning_group etc/group ||
 241         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/group"
 242 chgrp $cfg_owning_group etc/backups ||
 243         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/backups"
 244 chgrp $cfg_owning_group etc/girocco etc/girocco/.gitconfig ||
 245         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/girocco"
 246 chgrp $cfg_owning_group etc/girocco/.ssh etc/girocco/.ssh/config ||
 247         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/.ssh"
 248 chmod g+s etc etc/sshkeys etc/sshcerts etc/sshactive ||
 249         echo "WARNING: Cannot chmod g+s the etc directories"
 250 chmod g+w etc etc/sshkeys etc/sshcerts etc/sshactive ||
 251         echo "WARNING: Cannot chmod g+w the etc directories"
 252 chmod g+w etc/passwd etc/group ||
 253         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 254 chmod go-w etc/passwd etc/girocco etc/girocco/.gitconfig ||
 255         echo "WARNING: Cannot chmod go-w etc/girocco and/or etc/girocco/.gitconfig"
 256 chmod go-w etc/girocco/.ssh etc/girocco/.ssh/config ||
 257         echo "WARNING: Cannot chmod go-w etc/girocco/.ssh and/or etc/girocco/.ssh/config"
 258 chmod go-rwx etc/girocco/.ssh/config ||
 259         echo "WARNING: Cannot chmod go-rwx etc/girocco/.ssh/config"
 260 chmod a-w etc/girocco/.ssh ||
 261         echo "WARNING: Cannot chmod a-w etc/girocco/.ssh"
 262 chmod a-w etc/girocco ||
 263         echo "WARNING: Cannot chmod a-w etc/girocco"
 264 chmod -R g+w etc/sshkeys etc/sshcerts etc/sshactive 2>/dev/null ||
 265         echo "WARNING: Cannot chmod g+w the sshkeys, sshcerts and/or sshactive files"
 266
 267 # Note time of last install
 268 >etc/sshactive/_install
 269
 270 [ -z "$dbonly" ] || exit 0
 271
 272 # Make sure the system type is supported for chroot
 273 sysname="$(uname -s | tr A-Z a-z)" || :
 274 : ${sysname:=linux}
 275 nosshdir=
 276 # These equivalents may need to be expanded at some point
 277 case "$sysname" in
 278         *kfreebsd*)
 279                 sysname=linux;;
 280         *darwin*)
 281                 sysname=darwin;;
 282         *dragonfly*)
 283                 sysname=dragonfly;;
 284         *freebsd*)
 285                 sysname=freebsd;;
 286         *linux*)
 287                 sysname=linux;;
 288 esac
 289
 290 chrootsetup="$curdir/chrootsetup_$sysname.sh"
 291 if ! [ -f "$chrootsetup" ] || ! [ -r "$chrootsetup" ] || ! [ -s "$chrootsetup" ]; then
 292         echo "*** Error: $chrootsetup not found" >&2
 293         echo "*** Error: creating a chroot for a $(uname -s) system is not supported" >&2
 294         exit 1
 295 fi
 296
 297 # validate reporoot, chroot, jailreporoot and sshd_bin before doing anything more
 298
 299 # validates the passed in dir if a second argument is not empty dir must NOT
 300 # start with / otherwise it must.  A trailing '/' is removed and any duplicated
 301 # // are removed and a sole / or empty is disallowed.
 302 make_valid_dir() {
 303         _check="$(echo "$1" | tr -s /)"
 304         _check="${_check%/}"
 305         [ -n "$_check" ] && [ "$_check" != "/" ] || return 1
 306         if [ -z "$2" ]; then
 307                 # must start with '/'
 308                 case "$_check" in /*) :;; *) return 1; esac
 309         else
 310                 # must NOT start with '/'
 311                 case "$_check" in /*) return 1; esac
 312         fi
 313         echo "$_check"
 314 }
 315
 316 if ! reporoot="$(make_valid_dir "$cfg_reporoot")"; then
 317         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 318         echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
 319         exit 1
 320 fi
 321 if ! chroot="$(make_valid_dir "$cfg_chroot")"; then
 322         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 323         echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
 324         exit 1
 325 fi
 326 if ! jailreporoot="$(make_valid_dir "$cfg_jailreporoot" 1)"; then
 327         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 328         echo "*** Error: MUST NOT start with '/' and MUST NOT be ''" >&2
 329         exit 1
 330 fi
 331
 332 # chroot MUST NOT be reporoot
 333 if [ "$chroot" = "$reporoot" ]; then
 334         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 335         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 336         echo "*** Error: reporoot and chroot MUST NOT be the same" >&2
 337         exit 1
 338 fi
 339
 340 # chroot MUST NOT be a subdirectory of reporoot
 341 case "$chroot" in "$reporoot"/*)
 342         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 343         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 344         echo "*** Error: chroot MUST NOT be a subdirectory of reporoot" >&2
 345         exit 1
 346 esac
 347
 348 # chroot/jailreporoot MUST NOT be a subdirectory of reporoot
 349 case "$chroot/$jailreporoot" in "$reporoot"/*)
 350         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 351         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 352         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 353         echo "*** Error: chroot/jailreporoot MUST NOT be a subdirectory of reporoot" >&2
 354         exit 1
 355 esac
 356
 357 # reporoot MUST NOT be a subdirectory of chroot/jailreporoot
 358 case "$reporoot" in "$chroot/$jailreporoot"/*)
 359         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 360         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 361         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 362         echo "*** Error: reporoot MUST NOT be a subdirectory of chroot/jailreporoot" >&2
 363         exit 1
 364 esac
 365
 366 # sshd_bin MUST be undef (or empty) or a full absolute path
 367 sshd_bin_bad=
 368 case "$cfg_sshd_bin" in *"/../"*) sshd_bin_bad=1;; ""|/?*) :;; *) sshd_bin_bad=1;; esac
 369 [ -z "$sshd_bin_bad" ] || {
 370         echo "*** Error: invalid Config::sshd_bin $cfg_sshd_bin" >&2
 371         echo "*** Error: if set, sshd_bin must be an absolute path" >&2
 372         exit 1
 373 }
 374 sshd_bin="$cfg_sshd_bin"
 375 [ -n "$sshd_bin" ] || sshd_bin="$(find_std_utility "sshd")" || {
 376         echo "*** Error: Config::sshd_bin is not set and no sshd could be found" >&2
 377         echo "*** Error: please set Config::sshd_bin to an absolute path to sshd" >&2
 378         exit 1
 379 }
 380 [ -x "$sshd_bin" ] && [ -r "$sshd_bin" ] && [ -f "$sshd_bin" ] || {
 381         echo "*** Error: the selected sshd ('$sshd_bin') was not found, not readable or not executable" >&2
 382         exit 1
 383 }
 384
 385 # Set the user and group on the top of the chroot before creating anything else
 386 chown 0:0 "$chroot"
 387
 388 # When we create a fork, the alternates always have an absolute path.
 389 # If reporoot is not --bind mounted at the same location in chroot we must
 390 # create a suitable symlink so the absolute path alternates continue to work
 391 # in the ssh chroot or else forks will be broken in there.
 392 if [ "$reporoot" != "/$jailreporoot" ]; then
 393         mkdirp="$(dirname "${reporoot#/}")"
 394         [ "$mkdirp" = "." ] && mkdirp=
 395         lnback=
 396         [ -z "$mkdirp" ] || lnback="$(echo "$mkdirp/" | sed -e 's,[^/]*/,../,g')"
 397         [ -z "$mkdirp" ] || mkdir -p "$chroot/$mkdirp"
 398         (umask 0; ln -s -f -n "$lnback$jailreporoot" "$chroot$reporoot")
 399         [ $? -eq 0 ] || exit 1
 400 fi
 401
 402 # First, setup basic platform-independent directory structure
 403 mkdir -p bin dev etc lib sbin var/empty var/run "$jailreporoot"
 404 chmod 0555 var/empty
 405 rm -rf usr local
 406 ln -s . usr
 407 ln -s . local
 408
 409 # Now source the platform-specific script that is responsible for dev device
 410 # setup, proc setup (if needed), lib64 setup (if needed) and basic library
 411 # installation to make a chroot operational.  Additionally it will define a
 412 # pull_in_bin function that can be used to add executables and their library
 413 # dependencies to the chroot and finally will install a suitable nc.openbsd
 414 # compatible version of netcat that supports connections to unix sockets.
 415 . "$chrootsetup"
 416
 417 # Now, bring in sshd, sh etc.
 418 # The $chrootsetup script should have already provided a suitable nc.openbsd
 419 install -p "$cfg_basedir/bin/git-shell-verify" bin/git-shell-verify.new
 420 install -p "$cfg_basedir/bin/git-askpass-password" bin/git-askpass-password.new
 421 perl -i -p \
 422         -e 's|^#!.*|#!/bin/sh| if $. == 1;' \
 423         -e 'close ARGV if eof;' \
 424         bin/git-shell-verify.new bin/git-askpass-password.new
 425 mv -f bin/git-askpass-password.new bin/git-askpass-password
 426 mv -f bin/git-shell-verify.new bin/git-shell-verify
 427 pull_in_bin "$cfg_basedir/bin/can_user_push" bin
 428 pull_in_bin "$cfg_basedir/bin/list_packs" bin
 429 pull_in_bin "$cfg_basedir/bin/strftime" bin
 430 pull_in_bin "$cfg_basedir/bin/ulimit512" bin
 431 pull_in_bin "$var_sh_bin" bin/sh
 432 # be paranoid since these are going into the chroot and make sure
 433 # that we get the "standard" versions of them (they are all standard "POSIX"
 434 # utilities) not some wayward version picked up by a haphazard PATH
 435 pull_in_bin "$(find_std_utility cat     )" bin
 436 pull_in_bin "$(find_std_utility chmod   )" bin
 437 pull_in_bin "$(find_std_utility date    )" bin
 438 pull_in_bin "$(find_std_utility find    )" bin
 439 pull_in_bin "$(find_std_utility logger  )" bin
 440 pull_in_bin "$(find_std_utility mkdir   )" bin
 441 pull_in_bin "$(find_std_utility mv      )" bin
 442 pull_in_bin "$(find_std_utility rm      )" bin
 443 pull_in_bin "$(find_std_utility sleep   )" bin
 444 pull_in_bin "$(find_std_utility sort    )" bin
 445 pull_in_bin "$(find_std_utility touch   )" bin
 446 pull_in_bin "$(find_std_utility tr      )" bin
 447 pull_in_bin "$(find_std_utility wc      )" bin
 448 # this one's already been validated and might be in a non-standard location
 449 pull_in_bin "$sshd_bin" sbin
 450
 451 # ...and the bits of git we need,
 452 # being sure to use the configured git and its --exec-path to find the pieces
 453 for i in git git-index-pack git-receive-pack git-shell git-update-server-info \
 454         git-upload-archive git-upload-pack git-unpack-objects git-config \
 455         git-for-each-ref git-rev-list git-rev-parse git-symbolic-ref; do
 456         pull_in_bin "$var_git_exec_path/$i" bin git
 457 done
 458
 459 # ...and any extras identified by install.sh
 460 # these are also all standard "POSIX" utilities
 461 # ones that a decent sh implementation would have built-in already...
 462 if [ -n "$GIROCCO_CHROOT_EXTRA_INSTALLS" ]; then
 463         for i in $GIROCCO_CHROOT_EXTRA_INSTALLS; do
 464                 pull_in_bin "$(find_std_utility "$(basename "$i")")" bin
 465         done
 466 fi
 467
 468 # Note time of last jailsetup
 469 >etc/sshactive/_jailsetup
 470
 471 # Update permissions on the database files
 472 chown $cfg_cgi_user:$cfg_owning_group etc/passwd etc/group
 473 chown -R $cfg_cgi_user:$cfg_owning_group etc/sshkeys etc/sshcerts etc/sshactive
 474 chown $cfg_mirror_user:$cfg_owning_group etc etc/backups etc/girocco etc/girocco/.gitconfig
 475 chown $cfg_mirror_user:$cfg_owning_group etc/girocco/.ssh etc/girocco/.ssh/config
 476
 477 # Set up basic sshd configuration:
 478 if [ -n "$nosshdir" ]; then
 479         rm -rf etc/ssh
 480         ln -s . etc/ssh
 481         ! [ -f /etc/moduli ] || { cp -p /etc/moduli etc/; chown 0:0 etc/moduli; }
 482 else
 483         ! [ -e etc/ssh ] || [ -d etc/ssh ] || rm -rf etc/ssh
 484         mkdir -p etc/ssh
 485         ! [ -f /etc/ssh/moduli ] || { cp -p /etc/ssh/moduli etc/ssh/; chown 0:0 etc/ssh/moduli; }
 486 fi
 487 mkdir -p var/run/sshd
 488 if ! [ -s etc/ssh/sshd_config ]; then
 489         cat >etc/ssh/sshd_config <<EOT
 490 Protocol                2
 491 Port                    $cfg_sshd_jail_port
 492 UsePAM                  no
 493 X11Forwarding           no
 494 AllowAgentForwarding    no
 495 AllowTcpForwarding      no
 496 PermitTunnel            no
 497 IgnoreUserKnownHosts    yes
 498 PrintLastLog            no
 499 PrintMotd               no
 500 UseDNS                  no
 501 PermitRootLogin         no
 502 UsePrivilegeSeparation  yes
 503
 504 HostKey                 /etc/ssh/ssh_host_rsa_key
 505 EOT
 506 if [ -z "$cfg_disable_dsa" ]; then
 507         cat >>etc/ssh/sshd_config <<EOT
 508 HostKey                 /etc/ssh/ssh_host_dsa_key
 509 EOT
 510 fi
 511         cat >>etc/ssh/sshd_config <<EOT
 512 AuthorizedKeysFile      /etc/sshkeys/%u
 513 StrictModes             no
 514
 515 # mob and git users:
 516 PermitEmptyPasswords    yes
 517 ChallengeResponseAuthentication no
 518 PasswordAuthentication  yes
 519 EOT
 520 fi
 521 if ! [ -s etc/ssh/ssh_host_rsa_key ]; then
 522         bits=2048
 523         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 524                 bits="$cfg_rsakeylength"
 525         fi
 526         yes | ssh-keygen -b "$bits" -t rsa -N "" -C Girocco -f etc/ssh/ssh_host_rsa_key
 527 fi
 528 if [ -z "$cfg_disable_dsa" ] && ! [ -s etc/ssh/ssh_host_dsa_key ]; then
 529         # ssh-keygen can only create 1024 bit DSA keys
 530         yes | ssh-keygen -b 1024 -t dsa -N "" -C Girocco -f etc/ssh/ssh_host_dsa_key
 531 fi
 532
 533 # Set the final permissions on the binaries and perform any final twiddling
 534 chroot_update_permissions
 535
 536 # Change the owner of the sshd-related files
 537 chown 0:0 etc/ssh/ssh_* etc/ssh/sshd_*
 538
 539 echo "--- Add to your boot scripts: mount --bind $reporoot $chroot/$jailreporoot"
 540 echo "--- Add to your boot scripts: mount --bind /proc $chroot/proc"
 541 echo "--- Add to your syslog configuration: listening on socket $chroot/dev/log"
 542 echo "--- To restart a running jail's sshd: sudo kill -HUP \$(cat $chroot/var/run/sshd.pid)"