mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-09-11 12:06:24 +00:00
fix(remoteshell): write sshd settings to the drop-in directory
Keep administrator-owned sshd policy intact when a usable Include directory exists, including the existing MaxStartups value. Fall back safely when a drop-in cannot be used and fail explicitly if the required configuration helper cannot run.
This commit is contained in:
Vinícius Ferrão
@@ -54,31 +54,15 @@ if [ "$USEFLOWCONTROL" = "YES" ] || [ "$USEFLOWCONTROL" = "yes" ] || [ "$USEFLOW
|
||||
useflowcontrol=1
|
||||
fi
|
||||
|
||||
if [ -r /etc/ssh/sshd_config ]
|
||||
then
|
||||
logger -t $log_label -p local4.info "remoteshell: setup /etc/ssh/sshd_config and ssh_config"
|
||||
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG
|
||||
#delete all occurance of the attribute and then add xCAT settings
|
||||
sed -i '/X11Forwarding /'d /etc/ssh/sshd_config
|
||||
echo "X11Forwarding yes" >>/etc/ssh/sshd_config
|
||||
# delete all MaxStartups settings and use default value
|
||||
sed -i '/MaxStartups /'d /etc/ssh/sshd_config
|
||||
|
||||
if [ "$SETUPFORPCM" = "1" ]; then
|
||||
if [[ $OSVER == sle* ]];then
|
||||
sed -i '/PasswordAuthentication /'d /etc/ssh/sshd_config
|
||||
echo "PasswordAuthentication yes" >>/etc/ssh/sshd_config
|
||||
elif [[ $OSVER == ubuntu* ]];then
|
||||
sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
|
||||
fi
|
||||
sshd_config_helper="$(dirname "$0")/remoteshell-sshd-config"
|
||||
if [ -x "$sshd_config_helper" ]; then
|
||||
if ! "$sshd_config_helper" "${SETUPFORPCM:-0}" "${OSVER:-}" "$log_label"; then
|
||||
logger -t $log_label -p local4.err "remoteshell: failed to configure sshd with $sshd_config_helper"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -r /etc/ssh/ssh_config ]
|
||||
then
|
||||
sed -i '/StrictHostKeyChecking /'d /etc/ssh/ssh_config
|
||||
echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config
|
||||
|
||||
else
|
||||
logger -t $log_label -p local4.err "remoteshell: required sshd configuration helper not found: $sshd_config_helper"
|
||||
exit 1
|
||||
fi
|
||||
xcatpost="xcatpost"
|
||||
if [ -d /xcatpost/_ssh ]
|
||||
|
||||
Executable
+139
@@ -0,0 +1,139 @@
|
||||
#!/bin/sh
|
||||
# IBM(c) 2007 EPL license http://www.eclipse.org/legal/epl-v10.html
|
||||
|
||||
setup_for_pcm=${1:-0}
|
||||
osver=${2:-}
|
||||
log_label=${3:-xcat}
|
||||
ssh_etc=${XCAT_SSH_ETC:-/etc/ssh}
|
||||
logger_command=${XCAT_LOGGER:-logger}
|
||||
sshd_config="$ssh_etc/sshd_config"
|
||||
ssh_config="$ssh_etc/ssh_config"
|
||||
|
||||
xcat_log() {
|
||||
priority=$1
|
||||
shift
|
||||
"$logger_command" -t "$log_label" -p "$priority" "$@"
|
||||
}
|
||||
|
||||
# Write a drop-in fragment atomically: scratch file then rename, the leading dot
|
||||
# keeping the scratch out of sshd's *.conf glob. Returns nonzero without
|
||||
# touching anything if the write fails or the file is not ours.
|
||||
XCATSSHDDROPINMARKER="# Written by the xCAT remoteshell postscript."
|
||||
xcat_write_dropin() {
|
||||
xcat_dir=$1
|
||||
xcat_file=$2
|
||||
shift 2
|
||||
xcat_dest="$xcat_dir/$xcat_file"
|
||||
if [ -e "$xcat_dest" ] && \
|
||||
! head -n 1 "$xcat_dest" 2>/dev/null | grep -qF "$XCATSSHDDROPINMARKER"; then
|
||||
return 1
|
||||
fi
|
||||
xcat_tmp="$xcat_dir/.$xcat_file.xcatnew.$$"
|
||||
mkdir -p "$xcat_dir" 2>/dev/null || return 1
|
||||
( : >"$xcat_tmp" ) 2>/dev/null || return 1
|
||||
chmod 600 "$xcat_tmp" 2>/dev/null
|
||||
(
|
||||
echo "$XCATSSHDDROPINMARKER Do not edit."
|
||||
for xcat_line in "$@"; do
|
||||
echo "$xcat_line"
|
||||
done
|
||||
) 2>/dev/null >>"$xcat_tmp" || { rm -f "$xcat_tmp"; return 1; }
|
||||
mv -f "$xcat_tmp" "$xcat_dest" 2>/dev/null || { rm -f "$xcat_tmp"; return 1; }
|
||||
return 0
|
||||
}
|
||||
|
||||
# sshd keeps the first value it finds for a keyword, so a setting ahead of the
|
||||
# Include line or in an earlier fragment still wins over ours; log it.
|
||||
xcat_warn_if_overridden() {
|
||||
xcat_kw=$1
|
||||
xcat_own="$XCATSSHDDROPINDIR/$2"
|
||||
if sed -n '/^[[:space:]]*[Mm][Aa][Tt][Cc][Hh][[:space:]]/q; /^[[:space:]]*[Ii][Nn][Cc][Ll][Uu][Dd][Ee][[:space:]]\{1,\}[^[:space:]]\{1,\}\/\*\.conf[[:space:]]*$/q; p' "$sshd_config" 2>/dev/null | \
|
||||
grep -i "^[[:space:]]*${xcat_kw}[[:space:]]" >/dev/null 2>&1; then
|
||||
xcat_log local4.warning "remoteshell: $xcat_kw is set before the Include line in $sshd_config and overrides $xcat_own"
|
||||
fi
|
||||
for xcat_frag in "$XCATSSHDDROPINDIR"/*.conf; do
|
||||
[ "$xcat_frag" = "$xcat_own" ] && break
|
||||
[ -r "$xcat_frag" ] || continue
|
||||
if grep -i "^[[:space:]]*${xcat_kw}[[:space:]]" "$xcat_frag" >/dev/null 2>&1; then
|
||||
xcat_log local4.warning "remoteshell: $xcat_frag sets $xcat_kw and is read before $xcat_own"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
xcat_warn_if_fragment_overrides_fallback() {
|
||||
xcat_kw=$1
|
||||
[ -n "$XCATSSHDDIR" ] || return 0
|
||||
for xcat_frag in "$XCATSSHDDIR"/*.conf; do
|
||||
[ -r "$xcat_frag" ] || continue
|
||||
if grep -i "^[[:space:]]*${xcat_kw}[[:space:]]" "$xcat_frag" >/dev/null 2>&1; then
|
||||
xcat_log local4.warning "remoteshell: $xcat_frag sets $xcat_kw before the fallback value appended to $sshd_config"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
if [ -r "$sshd_config" ]; then
|
||||
xcat_log local4.info "remoteshell: setup $sshd_config and ssh_config"
|
||||
|
||||
# Take a single *.conf Include ahead of the first Match block. An Include
|
||||
# inside Match does not apply to every connection.
|
||||
XCATSSHDDIR=`sed -n '/^[[:space:]]*[Mm][Aa][Tt][Cc][Hh][[:space:]]/q; s|^[[:space:]]*[Ii][Nn][Cc][Ll][Uu][Dd][Ee][[:space:]]\{1,\}\([^[:space:]]\{1,\}\)/\*\.conf[[:space:]]*$|\1|p' "$sshd_config" | head -n 1`
|
||||
case "$XCATSSHDDIR" in
|
||||
""|/*) ;;
|
||||
*) XCATSSHDDIR="$ssh_etc/$XCATSSHDDIR" ;;
|
||||
esac
|
||||
case "$XCATSSHDDIR" in
|
||||
*[][*?]*) XCATSSHDDIR="" ;;
|
||||
esac
|
||||
|
||||
XCATSSHDDROPINDIR=""
|
||||
if [ -n "$XCATSSHDDIR" ]; then
|
||||
if xcat_write_dropin "$XCATSSHDDIR" "01-xcat.conf" "X11Forwarding yes"; then
|
||||
XCATSSHDDROPINDIR="$XCATSSHDDIR"
|
||||
xcat_warn_if_overridden "X11Forwarding" "01-xcat.conf"
|
||||
else
|
||||
xcat_log local4.err "remoteshell: could not write $XCATSSHDDIR/01-xcat.conf, editing $sshd_config instead"
|
||||
fi
|
||||
fi
|
||||
if [ -z "$XCATSSHDDROPINDIR" ]; then
|
||||
cp "$sshd_config" "$sshd_config.ORIG"
|
||||
sed -i '/X11Forwarding /'d "$sshd_config"
|
||||
echo "X11Forwarding yes" >>"$sshd_config"
|
||||
xcat_warn_if_fragment_overrides_fallback "X11Forwarding"
|
||||
fi
|
||||
|
||||
if [ "$setup_for_pcm" = "1" ]; then
|
||||
case "$osver" in
|
||||
sle*)
|
||||
if [ -n "$XCATSSHDDROPINDIR" ] && \
|
||||
xcat_write_dropin "$XCATSSHDDROPINDIR" "02-xcat-pcm.conf" "PasswordAuthentication yes"; then
|
||||
xcat_warn_if_overridden "PasswordAuthentication" "02-xcat-pcm.conf"
|
||||
else
|
||||
[ -e "$sshd_config.ORIG" ] || cp "$sshd_config" "$sshd_config.ORIG"
|
||||
sed -i '/PasswordAuthentication /'d "$sshd_config"
|
||||
echo "PasswordAuthentication yes" >>"$sshd_config"
|
||||
xcat_warn_if_fragment_overrides_fallback "PasswordAuthentication"
|
||||
fi
|
||||
;;
|
||||
ubuntu*)
|
||||
if grep -q '^PermitRootLogin' "$sshd_config"; then
|
||||
if [ -n "$XCATSSHDDROPINDIR" ] && \
|
||||
xcat_write_dropin "$XCATSSHDDROPINDIR" "02-xcat-pcm.conf" "PermitRootLogin yes"; then
|
||||
xcat_warn_if_overridden "PermitRootLogin" "02-xcat-pcm.conf"
|
||||
else
|
||||
[ -e "$sshd_config.ORIG" ] || cp "$sshd_config" "$sshd_config.ORIG"
|
||||
sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/' "$sshd_config"
|
||||
xcat_warn_if_fragment_overrides_fallback "PermitRootLogin"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -r "$ssh_config" ]; then
|
||||
sed -i '/StrictHostKeyChecking /'d "$ssh_config"
|
||||
echo "StrictHostKeyChecking no" >>"$ssh_config"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
Reference in New Issue
Block a user