iankelling.org Git - distro-setup/blob - rootsshsync

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 set -eE -o pipefail
  17 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  18
  19 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
  20
  21 # leftover
  22 if [[ -L /root/.ssh ]]; then
  23   rm /root/.ssh
  24 fi
  25 mkdir -p /root/.ssh
  26 chmod 700 /root/.ssh
  27
  28 user=$(id -un 1000)
  29
  30 user_ssh_dir=$(eval echo ~$user)/.ssh
  31 if [[ ! -s $user_ssh_dir/authorized_keys ]]; then
  32   echo missing $user_ssh_dir/authorized_keys. bad sign. bailing >&2
  33   exit 1
  34 fi
  35
  36 # remove broken links, or else rsync has error about them.
  37 find $user_ssh_dir -xtype l -exec rm '{}' \;
  38 # -t times, so it won't rewrite the file every time,
  39 # -L resolve links
  40 rsync --exclude=/h --exclude=/h.pub \
  41  --exclude=/hrsa --exclude=/hrsa.pub \
  42       --exclude /config --exclude /confighome -rtL --delete $user_ssh_dir/ /root/.ssh
  43 if [[ -e /q/root/h ]]; then
  44   cp -a /q/root/{h,hrsa}{,.pub} /root/.ssh
  45 fi
  46
  47 if [[ -e $user_ssh_dir/config ]]; then
  48   ### The h key is like the home key, but only a whitelist of commands allowed, and
  49   # not encrypted, so cron and whatnot can use it.
  50   # For any interactive ssh command we want to run as root that is not in that
  51   # whitelist, we need to ssh -F $HOME/.ssh/confighome
  52   ### I run a separate ssh-agent for root where I add keys without
  53   # confirm. This the root ssh-agent is only available
  54   # to root, and it allows us to have a working ssh when X isnt available,
  55   # eg, in an ssh shell. confirm for regular user provides some protection
  56   # that a rouge user program cant use my ssh key.
  57   sed 's,^AddKeysToAgent confirm,AddKeysToAgent yes,;/^UserKnownHostsFile /d' $user_ssh_dir/config >/root/.ssh/confighome
  58   sed 's,^IdentityFile ~/\.ssh/home$,IdentityFile ~/\.ssh/h,' /root/.ssh/confighome >/root/.ssh/config
  59 fi
  60 chown -R root:root /root/.ssh
  61
  62 rsync -t --chmod=755 --chown=root:root /b/ds/hssh /usr/local/bin
  63
  64 if [[ -e /a/opt/btrbk/ssh_filter_btrbk.sh ]]; then
  65   install /a/opt/btrbk/ssh_filter_btrbk.sh /usr/local/bin
  66 fi
  67
  68 if [[ -e /etc/systemd/system/ssh-agent-root.service ]]; then
  69   systemctl enable --now ssh-agent-root
  70 fi
  71
  72 d=/etc/initramfs-tools
  73 if [[ -e $d ]] && ! diff -q /root/.ssh/authorized_keys $d/root/.ssh/authorized_keys &>/dev/null; then
  74   mkdir -p $d/root/.ssh /etc/dropbear-initramfs
  75   chmod 700 $d/root $d/root/.ssh
  76   cp -p /root/.ssh/authorized_keys $d/root/.ssh/authorized_keys
  77   cp -p /root/.ssh/authorized_keys /etc/dropbear-initramfs
  78   if [[ -e /root/.ssh/authorized_keys2 ]]; then
  79     cat /root/.ssh/authorized_keys2 >>/etc/dropbear-initramfs
  80   fi
  81   update-initramfs -u -k all
  82 fi