jailsetup.sh

   1 #!/bin/sh
   2 # The Girocco jail setup script
   3 #
   4 # If the first parameter is "dbonly", setup the database only
   5 #
   6 # We are designed to set up the chroot based on the output of
   7 # `uname -s` by sourcing a suitable system-specific script.
   8 # Unrecognized systems will generate an error.  When using
   9 # "dbonly" the setup of the chroot binaries is skipped so the
  10 # output of `uname -s` does not matter in that case.
  11
  12 set -e
  13
  14 curdir="$(pwd)"
  15 srcdir="$curdir/src"
  16 getent="$srcdir/getent"
  17 . ./shlib.sh
  18
  19 # find_std_utility should always come up with the full path to the standard
  20 # version of the utility whose name is passed as "$1"
  21 getconf="/usr/bin/getconf"
  22 [ -x "$getconf" ] || getconf="/bin/getconf"
  23 [ -x "$getconf" ] || getconf="getconf"
  24 stdpath="$("unset" -f command; "command" "$getconf" "PATH" 2>/dev/null)" || :
  25 ":" "${stdpath:=/bin:/usr/bin}"
  26 stdpath="$stdpath:/sbin:/usr/sbin"
  27 find_std_utility() (
  28         "unset" -f unalias command "$1" >/dev/null 2>&1 || :
  29         "unalias" -a >/dev/null 2>&1 || :
  30         PATH="$stdpath" && "export" PATH || :
  31         "command" -v "$1"
  32 ) 2>/dev/null
  33
  34 dbonly=
  35 [ "$1" != "dbonly" ] || dbonly=1
  36
  37 reserved_users="root sshd _sshd mob git lock bundle nobody everyone $cfg_cgi_user $cfg_mirror_user"
  38
  39 # Require either sshd or _sshd user unless "dbonly"
  40 sshd_user=sshd
  41 if ! "$getent" passwd sshd >/dev/null && ! "$getent" passwd _sshd >/dev/null; then
  42         if [ -n "$dbonly" ]; then
  43                 if ! [ -s etc/passwd ]; then
  44                         # Only complain on initial etc/passwd creation
  45                         echo "WARNING: no sshd or _sshd user, omitting entries from chroot etc/passwd"
  46                 fi
  47                 sshd_user=
  48         else
  49                 echo "*** Error: You do not have required sshd or _sshd user in system." >&2
  50                 exit 1
  51         fi
  52 else
  53         "$getent" passwd sshd >/dev/null || sshd_user=_sshd
  54 fi
  55
  56 # Verify we have all we need
  57 if ! "$getent" passwd "$cfg_mirror_user" >/dev/null; then
  58         echo "*** Error: You do not have \"$cfg_mirror_user\" user in system yet." >&2
  59         exit 1
  60 fi
  61 if ! "$getent" passwd "$cfg_cgi_user" >/dev/null; then
  62         echo "*** Error: You do not have \"$cfg_cgi_user\" user in system yet." >&2
  63         exit 1
  64 fi
  65 if [ -n "$dbonly" ] && [ -z "$cfg_owning_group" ]; then
  66         cfg_owning_group="$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 4)"
  67 elif ! "$getent" group "$cfg_owning_group" >/dev/null; then
  68         echo "*** Error: You do not have \"$cfg_owning_group\" group in system yet." >&2
  69         exit 1
  70 fi
  71
  72 # One last paranoid check before we go writing all over everything
  73 if [ -z "$cfg_chroot" ] || [ "$cfg_chroot" = "/" ]; then
  74         echo "*** Error: chroot location is not set or is invalid." >&2
  75         echo "*** Error: perhaps you have an incorrect Config.pm?" >&2
  76         exit 1
  77 fi
  78
  79 umask 022
  80 mkdir -p "$cfg_chroot"
  81 cd "$cfg_chroot"
  82 chmod 755 "$cfg_chroot" ||
  83         echo "WARNING: Cannot chmod $cfg_chroot"
  84
  85 mkdir -p var/empty
  86 chmod 0555 var/empty ||
  87         echo "WARNING: Cannot chmod a=rx $cfg_chroot/var/empty"
  88
  89 # Set up basic user/group configuration; if there isn't any already
  90 mobpass=
  91 [ -n "$cfg_mob" ] || mobpass='x'
  92 mkdir -p etc
  93 if ! [ -s etc/passwd ]; then
  94         cat >etc/passwd <<EOT
  95 root:x:0:0:system administrator:/var/empty:/bin/false
  96 nobody:x:$("$getent" passwd nobody | cut -d : -f 3-4):unprivileged user:/var/empty:/bin/false
  97 EOT
  98         [ -z "$sshd_user" ] || cat >>etc/passwd <<EOT
  99 sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
 100 _sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
 101 EOT
 102         [ "$cfg_cgi_user" = "$cfg_mirror_user" ] || cat >>etc/passwd <<EOT
 103 $cfg_cgi_user:x:$("$getent" passwd "$cfg_cgi_user" | cut -d : -f 3-5):/:/bin/true
 104 EOT
 105         cat >>etc/passwd <<EOT
 106 $cfg_mirror_user:x:$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 3-5):/:/bin/true
 107 everyone:x:65537:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):every user:/:/bin/false
 108 mob:$mobpass:65538:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):the mob:/:/bin/git-shell-verify
 109 git::65539:$("$getent" passwd nobody | cut -d : -f 4):read-only access:/:/bin/git-shell-verify
 110 EOT
 111 elif [ -z "$dbonly" ]; then
 112         # Make sure an sshd entry is present
 113         if ! grep -q '^sshd:' etc/passwd; then
 114                 echo "*** Error: chroot etc/passwd exists but lacks sshd entry." >&2
 115                 exit 1
 116         fi
 117 fi
 118
 119 if ! [ -s etc/group ]; then
 120         cat >etc/group <<EOT
 121 _repo:x:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):$cfg_mirror_user
 122 EOT
 123 fi
 124
 125 # Set up basic default Git configuration
 126 # Initialize one if none exists or update critical variables for an existing one
 127 mkdir -p etc/girocco
 128 didchmod=
 129 if [ -e etc/girocco/.gitconfig ] && ! [ -f etc/girocco/.gitconfig ]; then
 130         echo "*** Error: chroot etc/girocco/.gitconfig exists but is not a file." >&2
 131         exit 1
 132 fi
 133 if [ -f etc/girocco/.gitconfig ]; then
 134         gcerr=0
 135         x="$(git config --file etc/girocco/.gitconfig --get "no--such--section.no  such  subsection.no--such--key")" || gcerr=$?
 136         if [ $gcerr -gt 1 ]; then
 137                 echo "*** Error: chroot etc/girocco/.gitconfig exists but is corrupt." >&2
 138                 echo "*** Error: either remove it or edit it to correct the problem." >&2
 139                 exit 1
 140         fi
 141 fi
 142 if ! [ -s etc/girocco/.gitconfig ]; then
 143         chmod u+w etc/girocco
 144         didchmod=1
 145         cat >etc/girocco/.gitconfig <<EOT
 146 # Any values set here will take effect whenever Girocco runs a git command
 147
 148 EOT
 149 fi
 150 # $1 => name, $2 => value, $3 => overwrite_flag
 151 # if $3 is "2" and $2 is "" value will be unset
 152 update_config_item() {
 153         _existsnot=
 154         _oldval=
 155         _oldval="$(git config --file etc/girocco/.gitconfig --get "$1")" || _existsnot=1
 156         if [ -n "$_existsnot" ]; then
 157                 [ -n "$2" ] || [ "$3" != "2" ] || return 0
 158         else
 159                 [ -n "$3" ] || return 0
 160                 [ "$_oldval" != "$2" ] || { [ "$3" = "2" ] && [ -z "$2" ]; } || return 0
 161         fi
 162         [ -n "$didchmod" ] || { chmod u+w etc/girocco; didchmod=1; }
 163         if [ "$3" = "2" ] && [ -z "$2" ]; then
 164                 git config --file etc/girocco/.gitconfig --unset "$1"
 165         else
 166                 git config --file etc/girocco/.gitconfig "$1" "$2"
 167         fi
 168         if [ -n "$_existsnot" ]; then
 169                 echo "chroot: etc/girocco/.gitconfig: config $1: (created) \"$2\""
 170         elif [ "$3" = "2" ] && [ -z "$2" ]; then
 171                 echo "chroot: etc/girocco/.gitconfig: config $1: (removed)"
 172         else
 173                 echo "chroot: etc/girocco/.gitconfig: config $1: \"$_oldval\" -> \"$2\""
 174         fi
 175 }
 176 if [ -n "$cfg_git_no_mmap" ]; then
 177         update_config_item core.packedGitWindowSize 1m 1
 178 else
 179         update_config_item core.packedGitWindowSize 32m 1
 180 fi
 181 if [ -n "$var_window_memory" ]; then
 182         update_config_item pack.windowMemory "$var_window_memory" 1
 183 fi
 184 if [ -n "$cfg_jgit_compatible_bitmaps" ]; then
 185         update_config_item pack.writeBitmapHashCache false 1
 186 else
 187         update_config_item pack.writeBitmapHashCache true 1
 188 fi
 189 update_config_item core.pager "cat" 1
 190 update_config_item core.compression 5
 191 update_config_item diff.renameLimit 250
 192 update_config_item transfer.unpackLimit 1 1
 193 update_config_item http.lowSpeedLimit 1
 194 update_config_item http.lowSpeedTime 600
 195 update_config_item receive.advertisePushOptions false 1
 196 update_config_item receive.maxInputSize "${cfg_max_receive_size:-0}" 1
 197 update_config_item girocco.notifyHook "${cfg_default_notifyhook}" 2
 198 if [ -n "$defined_cfg_git_client_ua" ]; then
 199         update_config_item http.userAgent "$cfg_git_client_ua" 1
 200 else
 201         update_config_item http.userAgent "" 2
 202 fi
 203
 204 # set up some default ssh client config just in case
 205 if [ -e etc/girocco/.ssh ] && ! [ -d etc/girocco/.ssh ]; then
 206         echo "*** Error: chroot etc/girocco/.ssh exists but is not a directory." >&2
 207         exit 1
 208 fi
 209 if [ -e etc/girocco/.ssh/config ] && ! [ -f etc/girocco/.ssh/config ]; then
 210         echo "*** Error: chroot etc/girocco/.ssh/config exists but is not a file." >&2
 211         exit 1
 212 fi
 213 if ! [ -s etc/girocco/.ssh/config ]; then
 214         chmod u+w etc/girocco
 215         didchmod=1
 216         [ -d etc/girocco/.ssh ] || mkdir etc/girocco/.ssh
 217         cat >etc/girocco/.ssh/config <<EOT
 218 # Any values set here will take effect whenever Girocco runs an ssh client command
 219 BatchMode yes
 220 StrictHostKeyChecking no
 221 CheckHostIP no
 222 UserKnownHostsFile /dev/null
 223 EOT
 224 fi
 225
 226 [ -z "$didchmod" ] || chmod a-w etc/girocco
 227
 228 mkdir -p etc/sshkeys etc/sshcerts etc/sshactive
 229 for ruser in $reserved_users; do
 230         touch etc/sshkeys/$ruser
 231 done
 232 chgrp $cfg_owning_group etc etc/sshkeys etc/sshcerts etc/sshactive ||
 233         echo "WARNING: Cannot chgrp $cfg_owning_group the etc directories"
 234 chgrp $cfg_owning_group etc/passwd ||
 235         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/passwd"
 236 chgrp $cfg_owning_group etc/group ||
 237         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/group"
 238 chgrp $cfg_owning_group etc/girocco etc/girocco/.gitconfig ||
 239         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/girocco"
 240 chgrp $cfg_owning_group etc/girocco/.ssh etc/girocco/.ssh/config ||
 241         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/.ssh"
 242 chmod g+s etc etc/sshkeys etc/sshcerts etc/sshactive ||
 243         echo "WARNING: Cannot chmod g+s the etc directories"
 244 chmod g+w etc etc/sshkeys etc/sshcerts etc/sshactive ||
 245         echo "WARNING: Cannot chmod g+w the etc directories"
 246 chmod g+w etc/passwd etc/group ||
 247         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 248 chmod go-w etc/passwd etc/girocco etc/girocco/.gitconfig ||
 249         echo "WARNING: Cannot chmod go-w etc/girocco and/or etc/girocco/.gitconfig"
 250 chmod go-w etc/girocco/.ssh etc/girocco/.ssh/config ||
 251         echo "WARNING: Cannot chmod go-w etc/girocco/.ssh and/or etc/girocco/.ssh/config"
 252 chmod go-rwx etc/girocco/.ssh/config ||
 253         echo "WARNING: Cannot chmod go-rwx etc/girocco/.ssh/config"
 254 chmod a-w etc/girocco/.ssh ||
 255         echo "WARNING: Cannot chmod a-w etc/girocco/.ssh"
 256 chmod a-w etc/girocco ||
 257         echo "WARNING: Cannot chmod a-w etc/girocco"
 258 chmod -R g+w etc/sshkeys etc/sshcerts etc/sshactive 2>/dev/null ||
 259         echo "WARNING: Cannot chmod g+w the sshkeys, sshcerts and/or sshactive files"
 260
 261 # Note time of last install
 262 >etc/sshactive/_install
 263
 264 [ -z "$dbonly" ] || exit 0
 265
 266 # Make sure the system type is supported for chroot
 267 sysname="$(uname -s | tr A-Z a-z)" || :
 268 : ${sysname:=linux}
 269 nosshdir=
 270 # These equivalents may need to be expanded at some point
 271 case "$sysname" in
 272         *kfreebsd*)
 273                 sysname=linux;;
 274         *darwin*)
 275                 sysname=darwin;;
 276         *dragonfly*)
 277                 sysname=dragonfly;;
 278         *freebsd*)
 279                 sysname=freebsd;;
 280         *linux*)
 281                 sysname=linux;;
 282 esac
 283
 284 chrootsetup="$curdir/chrootsetup_$sysname.sh"
 285 if ! [ -f "$chrootsetup" ] || ! [ -r "$chrootsetup" ] || ! [ -s "$chrootsetup" ]; then
 286         echo "*** Error: $chrootsetup not found" >&2
 287         echo "*** Error: creating a chroot for a $(uname -s) system is not supported" >&2
 288         exit 1
 289 fi
 290
 291 # validate reporoot, chroot, jailreporoot and sshd_bin before doing anything more
 292
 293 # validates the passed in dir if a second argument is not empty dir must NOT
 294 # start with / otherwise it must.  A trailing '/' is removed and any duplicated
 295 # // are removed and a sole / or empty is disallowed.
 296 make_valid_dir() {
 297         _check="$(echo "$1" | tr -s /)"
 298         _check="${_check%/}"
 299         [ -n "$_check" ] && [ "$_check" != "/" ] || return 1
 300         if [ -z "$2" ]; then
 301                 # must start with '/'
 302                 case "$_check" in /*) :;; *) return 1; esac
 303         else
 304                 # must NOT start with '/'
 305                 case "$_check" in /*) return 1; esac
 306         fi
 307         echo "$_check"
 308 }
 309
 310 if ! reporoot="$(make_valid_dir "$cfg_reporoot")"; then
 311         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 312         echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
 313         exit 1
 314 fi
 315 if ! chroot="$(make_valid_dir "$cfg_chroot")"; then
 316         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 317         echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
 318         exit 1
 319 fi
 320 if ! jailreporoot="$(make_valid_dir "$cfg_jailreporoot" 1)"; then
 321         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 322         echo "*** Error: MUST NOT start with '/' and MUST NOT be ''" >&2
 323         exit 1
 324 fi
 325
 326 # chroot MUST NOT be reporoot
 327 if [ "$chroot" = "$reporoot" ]; then
 328         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 329         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 330         echo "*** Error: reporoot and chroot MUST NOT be the same" >&2
 331         exit 1
 332 fi
 333
 334 # chroot MUST NOT be a subdirectory of reporoot
 335 case "$chroot" in "$reporoot"/*)
 336         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 337         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 338         echo "*** Error: chroot MUST NOT be a subdirectory of reporoot" >&2
 339         exit 1
 340 esac
 341
 342 # chroot/jailreporoot MUST NOT be a subdirectory of reporoot
 343 case "$chroot/$jailreporoot" in "$reporoot"/*)
 344         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 345         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 346         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 347         echo "*** Error: chroot/jailreporoot MUST NOT be a subdirectory of reporoot" >&2
 348         exit 1
 349 esac
 350
 351 # reporoot MUST NOT be a subdirectory of chroot/jailreporoot
 352 case "$reporoot" in "$chroot/$jailreporoot"/*)
 353         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 354         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 355         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 356         echo "*** Error: reporoot MUST NOT be a subdirectory of chroot/jailreporoot" >&2
 357         exit 1
 358 esac
 359
 360 # sshd_bin MUST be undef (or empty) or a full absolute path
 361 sshd_bin_bad=
 362 case "$cfg_sshd_bin" in *"/../"*) sshd_bin_bad=1;; ""|/?*) :;; *) sshd_bin_bad=1;; esac
 363 [ -z "$sshd_bin_bad" ] || {
 364         echo "*** Error: invalid Config::sshd_bin $cfg_sshd_bin" >&2
 365         echo "*** Error: if set, sshd_bin must be an absolute path" >&2
 366         exit 1
 367 }
 368 sshd_bin="$cfg_sshd_bin"
 369 [ -n "$sshd_bin" ] || sshd_bin="$(find_std_utility "sshd")" || {
 370         echo "*** Error: Config::sshd_bin is not set and no sshd could be found" >&2
 371         echo "*** Error: please set Config::sshd_bin to an absolute path to sshd" >&2
 372         exit 1
 373 }
 374 [ -x "$sshd_bin" ] && [ -r "$sshd_bin" ] && [ -f "$sshd_bin" ] || {
 375         echo "*** Error: the selected sshd ('$sshd_bin') was not found, not readable or not executable" >&2
 376         exit 1
 377 }
 378
 379 # Set the user and group on the top of the chroot before creating anything else
 380 chown 0:0 "$chroot"
 381
 382 # When we create a fork, the alternates always have an absolute path.
 383 # If reporoot is not --bind mounted at the same location in chroot we must
 384 # create a suitable symlink so the absolute path alternates continue to work
 385 # in the ssh chroot or else forks will be broken in there.
 386 if [ "$reporoot" != "/$jailreporoot" ]; then
 387         mkdirp="$(dirname "${reporoot#/}")"
 388         [ "$mkdirp" = "." ] && mkdirp=
 389         lnback=
 390         [ -z "$mkdirp" ] || lnback="$(echo "$mkdirp/" | sed -e 's,[^/]*/,../,g')"
 391         [ -z "$mkdirp" ] || mkdir -p "$chroot/$mkdirp"
 392         (umask 0; ln -s -f -n "$lnback$jailreporoot" "$chroot$reporoot")
 393         [ $? -eq 0 ] || exit 1
 394 fi
 395
 396 # First, setup basic platform-independent directory structure
 397 mkdir -p bin dev etc lib sbin var/empty var/run "$jailreporoot"
 398 chmod 0555 var/empty
 399 rm -rf usr local
 400 ln -s . usr
 401 ln -s . local
 402
 403 # Now source the platform-specific script that is responsible for dev device
 404 # setup, proc setup (if needed), lib64 setup (if needed) and basic library
 405 # installation to make a chroot operational.  Additionally it will define a
 406 # pull_in_bin function that can be used to add executables and their library
 407 # dependencies to the chroot and finally will install a suitable nc.openbsd
 408 # compatible version of netcat that supports connections to unix sockets.
 409 . "$chrootsetup"
 410
 411 # Now, bring in sshd, sh etc.
 412 # The $chrootsetup script should have already provided a suitable nc.openbsd
 413 install -p "$cfg_basedir/bin/git-shell-verify" bin/git-shell-verify.new
 414 install -p "$cfg_basedir/bin/git-askpass-password" bin/git-askpass-password.new
 415 perl -i -p \
 416         -e 's|^#!.*|#!/bin/sh| if $. == 1;' \
 417         -e 'close ARGV if eof;' \
 418         bin/git-shell-verify.new bin/git-askpass-password.new
 419 mv -f bin/git-askpass-password.new bin/git-askpass-password
 420 mv -f bin/git-shell-verify.new bin/git-shell-verify
 421 pull_in_bin "$cfg_basedir/bin/can_user_push" bin
 422 pull_in_bin "$cfg_basedir/bin/list_packs" bin
 423 pull_in_bin "$cfg_basedir/bin/strftime" bin
 424 pull_in_bin "$cfg_basedir/bin/ulimit512" bin
 425 pull_in_bin "$var_sh_bin" bin/sh
 426 # be paranoid since these are going into the chroot and make sure
 427 # that we get the "standard" versions of them (they are all standard "POSIX"
 428 # utilities) not some wayward version picked up by a haphazard PATH
 429 pull_in_bin "$(find_std_utility cat     )" bin
 430 pull_in_bin "$(find_std_utility chmod   )" bin
 431 pull_in_bin "$(find_std_utility date    )" bin
 432 pull_in_bin "$(find_std_utility find    )" bin
 433 pull_in_bin "$(find_std_utility mkdir   )" bin
 434 pull_in_bin "$(find_std_utility mv      )" bin
 435 pull_in_bin "$(find_std_utility rm      )" bin
 436 pull_in_bin "$(find_std_utility sleep   )" bin
 437 pull_in_bin "$(find_std_utility sort    )" bin
 438 pull_in_bin "$(find_std_utility touch   )" bin
 439 pull_in_bin "$(find_std_utility tr      )" bin
 440 pull_in_bin "$(find_std_utility wc      )" bin
 441 # this one's already been validated and might be in a non-standard location
 442 pull_in_bin "$sshd_bin" sbin
 443
 444 # ...and the bits of git we need,
 445 # being sure to use the configured git and its --exec-path to find the pieces
 446 for i in git git-index-pack git-receive-pack git-shell git-update-server-info \
 447         git-upload-archive git-upload-pack git-unpack-objects git-config \
 448         git-for-each-ref git-rev-list git-rev-parse git-symbolic-ref; do
 449         pull_in_bin "$var_git_exec_path/$i" bin git
 450 done
 451
 452 # ...and any extras identified by install.sh
 453 # these are also all standard "POSIX" utilities
 454 # ones that a decent sh implementation would have built-in already...
 455 if [ -n "$GIROCCO_CHROOT_EXTRA_INSTALLS" ]; then
 456         for i in $GIROCCO_CHROOT_EXTRA_INSTALLS; do
 457                 pull_in_bin "$(find_std_utility "$(basename "$i")")" bin
 458         done
 459 fi
 460
 461 # Note time of last jailsetup
 462 >etc/sshactive/_jailsetup
 463
 464 # Update permissions on the database files
 465 chown $cfg_cgi_user:$cfg_owning_group etc/passwd etc/group
 466 chown -R $cfg_cgi_user:$cfg_owning_group etc/sshkeys etc/sshcerts etc/sshactive
 467 chown $cfg_mirror_user:$cfg_owning_group etc etc/girocco etc/girocco/.gitconfig
 468 chown $cfg_mirror_user:$cfg_owning_group etc/girocco/.ssh etc/girocco/.ssh/config
 469
 470 # Set up basic sshd configuration:
 471 if [ -n "$nosshdir" ]; then
 472         rm -rf etc/ssh
 473         ln -s . etc/ssh
 474         ! [ -f /etc/moduli ] || { cp -p /etc/moduli etc/; chown 0:0 etc/moduli; }
 475 else
 476         ! [ -e etc/ssh ] || [ -d etc/ssh ] || rm -rf etc/ssh
 477         mkdir -p etc/ssh
 478         ! [ -f /etc/ssh/moduli ] || { cp -p /etc/ssh/moduli etc/ssh/; chown 0:0 etc/ssh/moduli; }
 479 fi
 480 mkdir -p var/run/sshd
 481 if ! [ -s etc/ssh/sshd_config ]; then
 482         cat >etc/ssh/sshd_config <<EOT
 483 Protocol                2
 484 Port                    $cfg_sshd_jail_port
 485 UsePAM                  no
 486 X11Forwarding           no
 487 AllowAgentForwarding    no
 488 AllowTcpForwarding      no
 489 PermitTunnel            no
 490 IgnoreUserKnownHosts    yes
 491 PrintLastLog            no
 492 PrintMotd               no
 493 UseDNS                  no
 494 PermitRootLogin         no
 495 UsePrivilegeSeparation  yes
 496
 497 HostKey                 /etc/ssh/ssh_host_rsa_key
 498 EOT
 499 if [ -z "$cfg_disable_dsa" ]; then
 500         cat >>etc/ssh/sshd_config <<EOT
 501 HostKey                 /etc/ssh/ssh_host_dsa_key
 502 EOT
 503 fi
 504         cat >>etc/ssh/sshd_config <<EOT
 505 AuthorizedKeysFile      /etc/sshkeys/%u
 506 StrictModes             no
 507
 508 # mob and git users:
 509 PermitEmptyPasswords    yes
 510 ChallengeResponseAuthentication no
 511 PasswordAuthentication  yes
 512 EOT
 513 fi
 514 if ! [ -s etc/ssh/ssh_host_rsa_key ]; then
 515         bits=2048
 516         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 517                 bits="$cfg_rsakeylength"
 518         fi
 519         yes | ssh-keygen -b "$bits" -t rsa -N "" -C Girocco -f etc/ssh/ssh_host_rsa_key
 520 fi
 521 if [ -z "$cfg_disable_dsa" ] && ! [ -s etc/ssh/ssh_host_dsa_key ]; then
 522         # ssh-keygen can only create 1024 bit DSA keys
 523         yes | ssh-keygen -b 1024 -t dsa -N "" -C Girocco -f etc/ssh/ssh_host_dsa_key
 524 fi
 525
 526 # Set the final permissions on the binaries and perform any final twiddling
 527 chroot_update_permissions
 528
 529 # Change the owner of the sshd-related files
 530 chown 0:0 etc/ssh/ssh_* etc/ssh/sshd_*
 531
 532 echo "--- Add to your boot scripts: mount --bind $reporoot $chroot/$jailreporoot"
 533 echo "--- Add to your boot scripts: mount --bind /proc $chroot/proc"
 534 echo "--- Add to your syslog configuration: listening on socket $chroot/dev/log"
 535 echo "--- To restart a running jail's sshd: sudo kill -HUP \$(cat $chroot/var/run/sshd.pid)"