various improvements
[distro-setup] / rootsshsync
1 #!/bin/bash
2 # Copyright (C) 2016 Ian Kelling
3
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
7
8 # http://www.apache.org/licenses/LICENSE-2.0
9
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
15
16 set -eE -o pipefail
17 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
18
19 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
20
21 # leftover
22 if [[ -L /root/.ssh ]]; then
23 rm /root/.ssh
24 fi
25 mkdir -p /root/.ssh
26 chmod 700 /root/.ssh
27
28 user=$(id -un 1000)
29
30 user_ssh_dir=$(eval echo ~$user)/.ssh
31 if [[ ! -s $user_ssh_dir/authorized_keys ]]; then
32 echo missing $user_ssh_dir/authorized_keys. bad sign. bailing >&2
33 exit 1
34 fi
35
36 # remove broken links, or else rsync has error about them.
37 find $user_ssh_dir -xtype l -exec rm '{}' \;
38 # -t times, so it won't rewrite the file every time,
39 # -L resolve links
40 rsync --exclude=/h --exclude=/h.pub \
41 --exclude=/hrsa --exclude=/hrsa.pub \
42 --exclude /config --exclude /confighome -rtL --delete $user_ssh_dir/ /root/.ssh
43 if [[ -e /q/root/h ]]; then
44 cp -a /q/root/{h,hrsa}{,.pub} /root/.ssh
45 fi
46
47 if [[ -e $user_ssh_dir/config ]]; then
48 ### The h key is like the home key, but only a whitelist of commands allowed, and
49 # not encrypted, so cron and whatnot can use it.
50 # For any interactive ssh command we want to run as root that is not in that
51 # whitelist, we need to ssh -F $HOME/.ssh/confighome
52 ### I run a separate ssh-agent for root where I add keys without
53 # confirm. This the root ssh-agent is only available
54 # to root, and it allows us to have a working ssh when X isnt available,
55 # eg, in an ssh shell. confirm for regular user provides some protection
56 # that a rouge user program cant use my ssh key.
57 sed 's,^AddKeysToAgent confirm,AddKeysToAgent yes,;/^UserKnownHostsFile /d' $user_ssh_dir/config >/root/.ssh/confighome
58 sed 's,^IdentityFile ~/\.ssh/home$,IdentityFile ~/\.ssh/h,' /root/.ssh/confighome >/root/.ssh/config
59 fi
60 chown -R root:root /root/.ssh
61
62 rsync -tp --chmod=755 --chown=root:root /a/bin/fai/fai/config/files/usr/local/bin/hssh/IANK /usr/local/bin/hssh
63
64 if [[ -e /a/opt/btrbk/ssh_filter_btrbk.sh ]]; then
65 install /a/opt/btrbk/ssh_filter_btrbk.sh /usr/local/bin
66 fi
67
68 if [[ -e /etc/systemd/system/ssh-agent-root.service ]]; then
69 systemctl enable --now ssh-agent-root
70 fi
71
72
73 # note: i previously had $auth_dir/root/.ssh/authorized_keys
74 # but /usr/share/doc/dropbear-initramfs/README.initramfs
75 # says differently. not sure what is up.
76
77 auth_dir=/etc/dropbear/initramfs/
78 candidate=$(apt-cache policy dropbear-initramfs | awk '$1 == "Candidate:" { print $2 }' | head -n1 ||:)
79 if [[ $candidate ]] && dpkg --compare-versions "$candidate" lt 2020.81-4; then
80 auth_dir=/etc/dropbear-initramfs
81 fi
82 auth_file=$auth_dir/authorized_keys
83 mkdir -p $auth_dir
84 if [[ ! -e $auth_file ]] || ! diff -q /root/.ssh/authorized_keys $auth_file; then
85 cp -p /root/.ssh/authorized_keys $auth_file
86 update-initramfs -u -k all
87 fi