jailsetup.sh

   1 #!/bin/sh
   2 # The Girocco jail setup script
   3 #
   4 # If the first parameter is "dbonly", setup the database only
   5 #
   6 # We are designed to set up the chroot based on the output of
   7 # `uname -s` by sourcing a suitable system-specific script.
   8 # Unrecognized systems will generate an error.  When using
   9 # "dbonly" the setup of the chroot binaries is skipped so the
  10 # output of `uname -s` does not matter in that case.
  11
  12 set -e
  13
  14 curdir="$(pwd)"
  15 srcdir="$curdir/src"
  16 getent="$srcdir/getent"
  17 . ./shlib.sh
  18
  19 # find_std_utility should always come up with the full path to the standard
  20 # version of the utility whose name is passed as "$1"
  21 getconf="/usr/bin/getconf"
  22 [ -x "$getconf" ] || getconf="/bin/getconf"
  23 [ -x "$getconf" ] || getconf="getconf"
  24 stdpath="$("unset" -f command; "command" "$getconf" "PATH" 2>/dev/null)" || :
  25 ":" "${stdpath:=/bin:/usr/bin}"
  26 stdpath="$stdpath:/sbin:/usr/sbin"
  27 find_std_utility() (
  28         "unset" -f unalias command "$1" >/dev/null 2>&1 || :
  29         "unalias" -a >/dev/null 2>&1 || :
  30         PATH="$stdpath" && "export" PATH || :
  31         "command" -v "$1"
  32 ) 2>/dev/null
  33
  34 dbonly=
  35 [ "$1" != "dbonly" ] || dbonly=1
  36
  37 reserved_users="root sshd _sshd mob git lock bundle nobody everyone $cfg_cgi_user $cfg_mirror_user"
  38
  39 # Require either sshd or _sshd user unless "dbonly"
  40 sshd_user=sshd
  41 if ! "$getent" passwd sshd >/dev/null && ! "$getent" passwd _sshd >/dev/null; then
  42         if [ -n "$dbonly" ]; then
  43                 if ! [ -s etc/passwd ]; then
  44                         # Only complain on initial etc/passwd creation
  45                         echo "WARNING: no sshd or _sshd user, omitting entries from chroot etc/passwd"
  46                 fi
  47                 sshd_user=
  48         else
  49                 echo "*** Error: You do not have required sshd or _sshd user in system." >&2
  50                 exit 1
  51         fi
  52 else
  53         "$getent" passwd sshd >/dev/null || sshd_user=_sshd
  54 fi
  55
  56 # Verify we have all we need
  57 if ! "$getent" passwd "$cfg_mirror_user" >/dev/null; then
  58         echo "*** Error: You do not have \"$cfg_mirror_user\" user in system yet." >&2
  59         exit 1
  60 fi
  61 if ! "$getent" passwd "$cfg_cgi_user" >/dev/null; then
  62         echo "*** Error: You do not have \"$cfg_cgi_user\" user in system yet." >&2
  63         exit 1
  64 fi
  65 if [ -n "$dbonly" ] && [ -z "$cfg_owning_group" ]; then
  66         cfg_owning_group="$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 4)"
  67 elif ! "$getent" group "$cfg_owning_group" >/dev/null; then
  68         echo "*** Error: You do not have \"$cfg_owning_group\" group in system yet." >&2
  69         exit 1
  70 fi
  71
  72 # One last paranoid check before we go writing all over everything
  73 if [ -z "$cfg_chroot" ] || [ "$cfg_chroot" = "/" ]; then
  74         echo "*** Error: chroot location is not set or is invalid." >&2
  75         echo "*** Error: perhaps you have an incorrect Config.pm?" >&2
  76         exit 1
  77 fi
  78
  79 umask 022
  80 mkdir -p "$cfg_chroot"
  81 cd "$cfg_chroot"
  82 chmod 755 "$cfg_chroot" ||
  83         echo "WARNING: Cannot chmod $cfg_chroot"
  84
  85 mkdir -p var/empty
  86 chmod 0555 var/empty ||
  87         echo "WARNING: Cannot chmod a=rx $cfg_chroot/var/empty"
  88
  89 # Set up basic user/group configuration; if there isn't any already
  90 mobpass=
  91 [ -n "$cfg_mob" ] || mobpass='x'
  92 mkdir -p etc
  93 if ! [ -s etc/passwd ]; then
  94         cat >etc/passwd <<EOT
  95 root:x:0:0:system administrator:/var/empty:/bin/false
  96 nobody:x:$("$getent" passwd nobody | cut -d : -f 3-4):unprivileged user:/var/empty:/bin/false
  97 EOT
  98         [ -z "$sshd_user" ] || cat >>etc/passwd <<EOT
  99 sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
 100 _sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
 101 EOT
 102         [ "$cfg_cgi_user" = "$cfg_mirror_user" ] || cat >>etc/passwd <<EOT
 103 $cfg_cgi_user:x:$("$getent" passwd "$cfg_cgi_user" | cut -d : -f 3-5):/:/bin/true
 104 EOT
 105         cat >>etc/passwd <<EOT
 106 $cfg_mirror_user:x:$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 3-5):/:/bin/true
 107 everyone:x:65537:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):every user:/:/bin/false
 108 mob:$mobpass:65538:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):the mob:/:/bin/git-shell-verify
 109 git::65539:$("$getent" passwd nobody | cut -d : -f 4):read-only access:/:/bin/git-shell-verify
 110 EOT
 111 elif [ -z "$dbonly" ]; then
 112         # Make sure an sshd entry is present
 113         if ! grep -q '^sshd:' etc/passwd; then
 114                 echo "*** Error: chroot etc/passwd exists but lacks sshd entry." >&2
 115                 exit 1
 116         fi
 117 fi
 118
 119 if ! [ -s etc/group ]; then
 120         cat >etc/group <<EOT
 121 _repo:x:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):$cfg_mirror_user
 122 EOT
 123 fi
 124
 125 # Set up basic default Git configuration
 126 # Initialize one if none exists or update critical variables for an existing one
 127 mkdir -p etc/girocco
 128 didchmod=
 129 if [ -e etc/girocco/.gitconfig ] && ! [ -f etc/girocco/.gitconfig ]; then
 130         echo "*** Error: chroot etc/girocco/.gitconfig exists but is not a file." >&2
 131         exit 1
 132 fi
 133 if [ -f etc/girocco/.gitconfig ]; then
 134         gcerr=0
 135         x="$(git config --file etc/girocco/.gitconfig --get "no--such--section.no  such  subsection.no--such--key")" || gcerr=$?
 136         if [ $gcerr -gt 1 ]; then
 137                 echo "*** Error: chroot etc/girocco/.gitconfig exists but is corrupt." >&2
 138                 echo "*** Error: either remove it or edit it to correct the problem." >&2
 139                 exit 1
 140         fi
 141 fi
 142 if ! [ -s etc/girocco/.gitconfig ]; then
 143         chmod u+w etc/girocco
 144         didchmod=1
 145         cat >etc/girocco/.gitconfig <<EOT
 146 # Any values set here will take effect whenever Girocco runs a git command
 147
 148 EOT
 149 fi
 150 # $1 => name, $2 => value, $3 => overwrite_flag
 151 # if $3 is "2" and $2 is "" value will be unset
 152 update_config_item() {
 153         _existsnot=
 154         _oldval=
 155         _oldval="$(git config --file etc/girocco/.gitconfig --get "$1")" || _existsnot=1
 156         if [ -n "$_existsnot" ]; then
 157                 [ -n "$2" ] || [ "$3" != "2" ] || return 0
 158         else
 159                 [ -n "$3" ] || return 0
 160                 [ "$_oldval" != "$2" ] || { [ "$3" = "2" ] && [ -z "$2" ]; } || return 0
 161         fi
 162         [ -n "$didchmod" ] || { chmod u+w etc/girocco; didchmod=1; }
 163         if [ "$3" = "2" ] && [ -z "$2" ]; then
 164                 git config --file etc/girocco/.gitconfig --unset "$1"
 165         else
 166                 git config --file etc/girocco/.gitconfig "$1" "$2"
 167         fi
 168         if [ -n "$_existsnot" ]; then
 169                 echo "chroot: etc/girocco/.gitconfig: config $1: (created) \"$2\""
 170         elif [ "$3" = "2" ] && [ -z "$2" ]; then
 171                 echo "chroot: etc/girocco/.gitconfig: config $1: (removed)"
 172         else
 173                 echo "chroot: etc/girocco/.gitconfig: config $1: \"$_oldval\" -> \"$2\""
 174         fi
 175 }
 176 if [ -n "$cfg_git_no_mmap" ]; then
 177         update_config_item core.packedGitWindowSize 1m 1
 178 else
 179         update_config_item core.packedGitWindowSize 32m 1
 180 fi
 181 if [ -n "$var_window_memory" ]; then
 182         update_config_item pack.windowMemory "$var_window_memory" 1
 183 fi
 184 if [ -n "$cfg_jgit_compatible_bitmaps" ]; then
 185         update_config_item pack.writeBitmapHashCache false 1
 186 else
 187         update_config_item pack.writeBitmapHashCache true 1
 188 fi
 189 update_config_item core.pager "cat" 1
 190 update_config_item core.compression 5
 191 update_config_item transfer.unpackLimit 1 1
 192 update_config_item http.lowSpeedLimit 1
 193 update_config_item http.lowSpeedTime 600
 194 update_config_item receive.advertisePushOptions false 1
 195 update_config_item receive.maxInputSize "${cfg_max_receive_size:-0}" 1
 196 update_config_item girocco.notifyHook "${cfg_default_notifyhook}" 2
 197
 198 # set up some default ssh client config just in case (e.g. git-svn)
 199 if [ -e etc/girocco/.ssh ] && ! [ -d etc/girocco/.ssh ]; then
 200         echo "*** Error: chroot etc/girocco/.ssh exists but is not a directory." >&2
 201         exit 1
 202 fi
 203 if [ -e etc/girocco/.ssh/config ] && ! [ -f etc/girocco/.ssh/config ]; then
 204         echo "*** Error: chroot etc/girocco/.ssh/config exists but is not a file." >&2
 205         exit 1
 206 fi
 207 if ! [ -s etc/girocco/.ssh/config ]; then
 208         chmod u+w etc/girocco
 209         didchmod=1
 210         [ -d etc/girocco/.ssh ] || mkdir etc/girocco/.ssh
 211         cat >etc/girocco/.ssh/config <<EOT
 212 # Any values set here will take effect whenever Girocco svn runs an ssh client command
 213 BatchMode yes
 214 StrictHostKeyChecking no
 215 CheckHostIP no
 216 UserKnownHostsFile /dev/null
 217 EOT
 218 fi
 219
 220 [ -z "$didchmod" ] || chmod a-w etc/girocco
 221
 222 mkdir -p etc/sshkeys etc/sshcerts etc/sshactive
 223 for ruser in $reserved_users; do
 224         touch etc/sshkeys/$ruser
 225 done
 226 chgrp $cfg_owning_group etc etc/sshkeys etc/sshcerts etc/sshactive ||
 227         echo "WARNING: Cannot chgrp $cfg_owning_group the etc directories"
 228 chgrp $cfg_owning_group etc/passwd ||
 229         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/passwd"
 230 chgrp $cfg_owning_group etc/group ||
 231         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/group"
 232 chgrp $cfg_owning_group etc/girocco etc/girocco/.gitconfig ||
 233         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/girocco"
 234 chgrp $cfg_owning_group etc/girocco/.ssh etc/girocco/.ssh/config ||
 235         echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/.ssh"
 236 chmod g+s etc etc/sshkeys etc/sshcerts etc/sshactive ||
 237         echo "WARNING: Cannot chmod g+s the etc directories"
 238 chmod g+w etc etc/sshkeys etc/sshcerts etc/sshactive ||
 239         echo "WARNING: Cannot chmod g+w the etc directories"
 240 chmod g+w etc/passwd etc/group ||
 241         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 242 chmod go-w etc/passwd etc/girocco etc/girocco/.gitconfig ||
 243         echo "WARNING: Cannot chmod go-w etc/girocco and/or etc/girocco/.gitconfig"
 244 chmod go-w etc/girocco/.ssh etc/girocco/.ssh/config ||
 245         echo "WARNING: Cannot chmod go-w etc/girocco/.ssh and/or etc/girocco/.ssh/config"
 246 chmod go-rwx etc/girocco/.ssh/config ||
 247         echo "WARNING: Cannot chmod go-rwx etc/girocco/.ssh/config"
 248 chmod a-w etc/girocco/.ssh ||
 249         echo "WARNING: Cannot chmod a-w etc/girocco/.ssh"
 250 chmod a-w etc/girocco ||
 251         echo "WARNING: Cannot chmod a-w etc/girocco"
 252 chmod -R g+w etc/sshkeys etc/sshcerts etc/sshactive 2>/dev/null ||
 253         echo "WARNING: Cannot chmod g+w the sshkeys, sshcerts and/or sshactive files"
 254
 255 # Note time of last install
 256 >etc/sshactive/_install
 257
 258 [ -z "$dbonly" ] || exit 0
 259
 260 # Make sure the system type is supported for chroot
 261 sysname="$(uname -s | tr A-Z a-z)" || :
 262 : ${sysname:=linux}
 263 nosshdir=
 264 # These equivalents may need to be expanded at some point
 265 case "$sysname" in
 266         *kfreebsd*)
 267                 sysname=linux;;
 268         *darwin*)
 269                 sysname=darwin;;
 270         *dragonfly*)
 271                 sysname=dragonfly;;
 272         *freebsd*)
 273                 sysname=freebsd;;
 274         *linux*)
 275                 sysname=linux;;
 276 esac
 277
 278 chrootsetup="$curdir/chrootsetup_$sysname.sh"
 279 if ! [ -f "$chrootsetup" ] || ! [ -r "$chrootsetup" ] || ! [ -s "$chrootsetup" ]; then
 280         echo "*** Error: $chrootsetup not found" >&2
 281         echo "*** Error: creating a chroot for a $(uname -s) system is not supported" >&2
 282         exit 1
 283 fi
 284
 285 # validate reporoot, chroot, jailreporoot and sshd_bin before doing anything more
 286
 287 # validates the passed in dir if a second argument is not empty dir must NOT
 288 # start with / otherwise it must.  A trailing '/' is removed and any duplicated
 289 # // are removed and a sole / or empty is disallowed.
 290 make_valid_dir() {
 291         _check="$(echo "$1" | tr -s /)"
 292         _check="${_check%/}"
 293         [ -n "$_check" ] && [ "$_check" != "/" ] || return 1
 294         if [ -z "$2" ]; then
 295                 # must start with '/'
 296                 case "$_check" in /*) :;; *) return 1; esac
 297         else
 298                 # must NOT start with '/'
 299                 case "$_check" in /*) return 1; esac
 300         fi
 301         echo "$_check"
 302 }
 303
 304 if ! reporoot="$(make_valid_dir "$cfg_reporoot")"; then
 305         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 306         echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
 307         exit 1
 308 fi
 309 if ! chroot="$(make_valid_dir "$cfg_chroot")"; then
 310         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 311         echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
 312         exit 1
 313 fi
 314 if ! jailreporoot="$(make_valid_dir "$cfg_jailreporoot" 1)"; then
 315         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 316         echo "*** Error: MUST NOT start with '/' and MUST NOT be ''" >&2
 317         exit 1
 318 fi
 319
 320 # chroot MUST NOT be reporoot
 321 if [ "$chroot" = "$reporoot" ]; then
 322         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 323         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 324         echo "*** Error: reporoot and chroot MUST NOT be the same" >&2
 325         exit 1
 326 fi
 327
 328 # chroot MUST NOT be a subdirectory of reporoot
 329 case "$chroot" in "$reporoot"/*)
 330         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 331         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 332         echo "*** Error: chroot MUST NOT be a subdirectory of reporoot" >&2
 333         exit 1
 334 esac
 335
 336 # chroot/jailreporoot MUST NOT be a subdirectory of reporoot
 337 case "$chroot/$jailreporoot" in "$reporoot"/*)
 338         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 339         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 340         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 341         echo "*** Error: chroot/jailreporoot MUST NOT be a subdirectory of reporoot" >&2
 342         exit 1
 343 esac
 344
 345 # reporoot MUST NOT be a subdirectory of chroot/jailreporoot
 346 case "$reporoot" in "$chroot/$jailreporoot"/*)
 347         echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
 348         echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
 349         echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
 350         echo "*** Error: reporoot MUST NOT be a subdirectory of chroot/jailreporoot" >&2
 351         exit 1
 352 esac
 353
 354 # sshd_bin MUST be undef (or empty) or a full absolute path
 355 sshd_bin_bad=
 356 case "$cfg_sshd_bin" in *"/../"*) sshd_bin_bad=1;; ""|/?*) :;; *) sshd_bin_bad=1;; esac
 357 [ -z "$sshd_bin_bad" ] || {
 358         echo "*** Error: invalid Config::sshd_bin $cfg_sshd_bin" >&2
 359         echo "*** Error: if set, sshd_bin must be an absolute path" >&2
 360         exit 1
 361 }
 362 sshd_bin="$cfg_sshd_bin"
 363 [ -n "$sshd_bin" ] || sshd_bin="$(find_std_utility "sshd")" || {
 364         echo "*** Error: Config::sshd_bin is not set and no sshd could be found" >&2
 365         echo "*** Error: please set Config::sshd_bin to an absolute path to sshd" >&2
 366         exit 1
 367 }
 368 [ -x "$sshd_bin" ] && [ -r "$sshd_bin" ] && [ -f "$sshd_bin" ] || {
 369         echo "*** Error: the selected sshd ('$sshd_bin') was not found, not readable or not executable" >&2
 370         exit 1
 371 }
 372
 373 # Set the user and group on the top of the chroot before creating anything else
 374 chown 0:0 "$chroot"
 375
 376 # When we create a fork, the alternates always have an absolute path.
 377 # If reporoot is not --bind mounted at the same location in chroot we must
 378 # create a suitable symlink so the absolute path alternates continue to work
 379 # in the ssh chroot or else forks will be broken in there.
 380 if [ "$reporoot" != "/$jailreporoot" ]; then
 381         mkdirp="$(dirname "${reporoot#/}")"
 382         [ "$mkdirp" = "." ] && mkdirp=
 383         lnback=
 384         [ -z "$mkdirp" ] || lnback="$(echo "$mkdirp/" | sed -e 's,[^/]*/,../,g')"
 385         [ -z "$mkdirp" ] || mkdir -p "$chroot/$mkdirp"
 386         (umask 0; ln -s -f -n "$lnback$jailreporoot" "$chroot$reporoot")
 387         [ $? -eq 0 ] || exit 1
 388 fi
 389
 390 # First, setup basic platform-independent directory structure
 391 mkdir -p bin dev etc lib sbin var/empty var/run "$jailreporoot"
 392 chmod 0555 var/empty
 393 rm -rf usr local
 394 ln -s . usr
 395 ln -s . local
 396
 397 # Now source the platform-specific script that is responsible for dev device
 398 # setup, proc setup (if needed), lib64 setup (if needed) and basic library
 399 # installation to make a chroot operational.  Additionally it will define a
 400 # pull_in_bin function that can be used to add executables and their library
 401 # dependencies to the chroot and finally will install a suitable nc.openbsd
 402 # compatible version of netcat that supports connections to unix sockets.
 403 . "$chrootsetup"
 404
 405 # Now, bring in sshd, sh etc.
 406 # The $chrootsetup script should have already provided a suitable nc.openbsd
 407 install -p "$cfg_basedir/bin/git-shell-verify" bin/git-shell-verify.new
 408 install -p "$cfg_basedir/bin/git-askpass-password" bin/git-askpass-password.new
 409 perl -i -p \
 410         -e 's|^#!.*|#!/bin/sh| if $. == 1;' \
 411         -e 'close ARGV if eof;' \
 412         bin/git-shell-verify.new bin/git-askpass-password.new
 413 mv -f bin/git-askpass-password.new bin/git-askpass-password
 414 mv -f bin/git-shell-verify.new bin/git-shell-verify
 415 pull_in_bin "$cfg_basedir/bin/can_user_push" bin
 416 pull_in_bin "$cfg_basedir/bin/list_packs" bin
 417 pull_in_bin "$cfg_basedir/bin/strftime" bin
 418 pull_in_bin "$var_sh_bin" bin/sh
 419 # be paranoid since these are going into the chroot and make sure
 420 # that we get the "standard" versions of them (they are all standard "POSIX"
 421 # utilities) not some wayward version picked up by a haphazard PATH
 422 pull_in_bin "$(find_std_utility cat     )" bin
 423 pull_in_bin "$(find_std_utility chmod   )" bin
 424 pull_in_bin "$(find_std_utility date    )" bin
 425 pull_in_bin "$(find_std_utility find    )" bin
 426 pull_in_bin "$(find_std_utility mkdir   )" bin
 427 pull_in_bin "$(find_std_utility mv      )" bin
 428 pull_in_bin "$(find_std_utility rm      )" bin
 429 pull_in_bin "$(find_std_utility sleep   )" bin
 430 pull_in_bin "$(find_std_utility sort    )" bin
 431 pull_in_bin "$(find_std_utility touch   )" bin
 432 pull_in_bin "$(find_std_utility tr      )" bin
 433 pull_in_bin "$(find_std_utility wc      )" bin
 434 # this one's already been validated and might be in a non-standard location
 435 pull_in_bin "$sshd_bin" sbin
 436
 437 # ...and the bits of git we need,
 438 # being sure to use the configured git and its --exec-path to find the pieces
 439 for i in git git-index-pack git-receive-pack git-shell git-update-server-info \
 440         git-upload-archive git-upload-pack git-unpack-objects git-config \
 441         git-for-each-ref git-rev-list git-rev-parse git-symbolic-ref; do
 442         pull_in_bin "$var_git_exec_path/$i" bin git
 443 done
 444
 445 # ...and any extras identified by install.sh
 446 # these are also all standard "POSIX" utilities
 447 # ones that a decent sh implementation would have built-in already...
 448 if [ -n "$GIROCCO_CHROOT_EXTRA_INSTALLS" ]; then
 449         for i in $GIROCCO_CHROOT_EXTRA_INSTALLS; do
 450                 pull_in_bin "$(find_std_utility "$(basename "$i")")" bin
 451         done
 452 fi
 453
 454 # Note time of last jailsetup
 455 >etc/sshactive/_jailsetup
 456
 457 # Update permissions on the database files
 458 chown $cfg_cgi_user:$cfg_owning_group etc/passwd etc/group
 459 chown -R $cfg_cgi_user:$cfg_owning_group etc/sshkeys etc/sshcerts etc/sshactive
 460 chown $cfg_mirror_user:$cfg_owning_group etc etc/girocco etc/girocco/.gitconfig
 461
 462 # Set up basic sshd configuration:
 463 if [ -n "$nosshdir" ]; then
 464         rm -rf etc/ssh
 465         ln -s . etc/ssh
 466         ! [ -f /etc/moduli ] || { cp -p /etc/moduli etc/; chown 0:0 etc/moduli; }
 467 else
 468         ! [ -e etc/ssh ] || [ -d etc/ssh ] || rm -rf etc/ssh
 469         mkdir -p etc/ssh
 470         ! [ -f /etc/ssh/moduli ] || { cp -p /etc/ssh/moduli etc/ssh/; chown 0:0 etc/ssh/moduli; }
 471 fi
 472 mkdir -p var/run/sshd
 473 if ! [ -s etc/ssh/sshd_config ]; then
 474         cat >etc/ssh/sshd_config <<EOT
 475 Protocol                2
 476 Port                    $cfg_sshd_jail_port
 477 UsePAM                  no
 478 X11Forwarding           no
 479 AllowAgentForwarding    no
 480 AllowTcpForwarding      no
 481 PermitTunnel            no
 482 IgnoreUserKnownHosts    yes
 483 PrintLastLog            no
 484 PrintMotd               no
 485 UseDNS                  no
 486 PermitRootLogin         no
 487 UsePrivilegeSeparation  yes
 488
 489 HostKey                 /etc/ssh/ssh_host_rsa_key
 490 EOT
 491 if [ -z "$cfg_disable_dsa" ]; then
 492         cat >>etc/ssh/sshd_config <<EOT
 493 HostKey                 /etc/ssh/ssh_host_dsa_key
 494 EOT
 495 fi
 496         cat >>etc/ssh/sshd_config <<EOT
 497 AuthorizedKeysFile      /etc/sshkeys/%u
 498 StrictModes             no
 499
 500 # mob and git users:
 501 PermitEmptyPasswords    yes
 502 ChallengeResponseAuthentication no
 503 PasswordAuthentication  yes
 504 EOT
 505 fi
 506 if ! [ -s etc/ssh/ssh_host_rsa_key ]; then
 507         bits=2048
 508         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 509                 bits="$cfg_rsakeylength"
 510         fi
 511         yes | ssh-keygen -b "$bits" -t rsa -N "" -C Girocco -f etc/ssh/ssh_host_rsa_key
 512 fi
 513 if [ -z "$cfg_disable_dsa" ] && ! [ -s etc/ssh/ssh_host_dsa_key ]; then
 514         # ssh-keygen can only create 1024 bit DSA keys
 515         yes | ssh-keygen -b 1024 -t dsa -N "" -C Girocco -f etc/ssh/ssh_host_dsa_key
 516 fi
 517
 518 # Set the final permissions on the binaries and perform any final twiddling
 519 chroot_update_permissions
 520
 521 # Change the owner of the sshd-related files
 522 chown 0:0 etc/ssh/ssh_* etc/ssh/sshd_*
 523
 524 echo "--- Add to your boot scripts: mount --bind $reporoot $chroot/$jailreporoot"
 525 echo "--- Add to your boot scripts: mount --bind /proc $chroot/proc"
 526 echo "--- Add to your syslog configuration: listening on socket $chroot/dev/log"
 527 echo "--- To restart a running jail's sshd: sudo kill -HUP \$(cat $chroot/var/run/sshd.pid)"