myvesta/bin/v-add-sys-sftp-jail
Rick Bakker e757dc408a Force a new line, to prevent syntax errors.
When I enabled SFTP chroot, "Subsystem sftp internal-sftp" was put directly after "UsePAM yes" (Ubuntu 16.04.1), which made "UsePAM yesSubsystem sftp internal-sftp", which obviously caused a syntax error. I fixed this by manually dividing those two options.
2016-12-18 14:16:38 +01:00

107 lines
3.1 KiB
Bash
Executable File

#!/bin/bash
# info: add system sftp jail
# options: NONE
#
# The script enables sftp jailed environment
#----------------------------------------------------------#
# Variable&Function #
#----------------------------------------------------------#
# Importing system environment as we run this script
# mostly by cron which do not read it by itself
source /etc/profile
# Includes
source $VESTA/func/main.sh
source $VESTA/conf/vesta.conf
#----------------------------------------------------------#
# Verifications #
#----------------------------------------------------------#
if [ -z "$SFTPJAIL_KEY" ]; then
exit
fi
#----------------------------------------------------------#
# Action #
#----------------------------------------------------------#
# Checking sshd directives
config='/etc/ssh/sshd_config'
sftp_n=$(grep -n "Subsystem.*sftp" $config |grep -v internal |grep -v ":#")
sftp_i=$(grep -n "Subsystem.*sftp" $config |grep internal |grep -v ":#")
# Disabling normal sftp
if [ ! -z "$sftp_n" ]; then
fline=$(echo $sftp_n |cut -f 1 -d :)
sed -i "${fline}s/Subsystem.*sftp/#Subsystem sftp/" $config
restart='yes'
fi
# Enabling jailed sftp
if [ -z "$sftp_i" ]; then
echo " " >> $config
echo "Subsystem sftp internal-sftp" >> $config
echo "Match Group sftp-only" >> $config
echo "ChrootDirectory /chroot/%u" >> $config
echo " AllowTCPForwarding no" >> $config
echo " X11Forwarding no" >> $config
echo " ForceCommand internal-sftp" >> $config
restart='yes'
fi
# Validating opensshd config
if [ "$restart" = 'yes' ]; then
subj="OpenSSH restart failed"
email=$(grep CONTACT $VESTA/data/users/admin/user.conf |cut -f 2 -d \')
/usr/sbin/sshd -t >/dev/null 2>&1
if [ "$?" -ne 0 ]; then
mail_text="OpenSSH can not be restarted. Please check config:
\n\n$(/usr/sbin/sshd -t)"
echo -e "$mail_text" |$SENDMAIL -s "$subj" $email
else
service ssh restart >/dev/null 2>&1
service sshd restart >/dev/null 2>&1
fi
fi
# Adding sftp group
groupadd sftp-only 2>/dev/null
# Checking users
shells="rssh|nologin"
for user in $(grep "$HOMEDIR" /etc/passwd |egrep "$shells" |cut -f 1 -d:); do
$BIN/v-add-user-sftp-jail $user
done
# Adding v-add-sys-sftp-jail to startup
if [ -e "/etc/rc.local" ]; then
check_sftp=$(grep $0 /etc/rc.local)
check_exit=$(grep ^exit /etc/rc.local)
if [ -z "$check_sftp" ]; then
if [ -z "$check_exit" ]; then
echo "$BIN/v-add-sys-sftp-jail" >> /etc/rc.local
else
sed -i "s|^exit|$BIN/v-add-sys-sftp-jail\nexit|" /etc/rc.local
fi
fi
chmod +x /etc/rc.local
else
echo "$BIN/v-add-sys-sftp-jail" > /etc/rc.local
chmod +x /etc/rc.local
fi
#----------------------------------------------------------#
# Vesta #
#----------------------------------------------------------#
# Logging
log_event "$OK" "$ARGUMENTS"
exit