vesta/bin/v-add-user
Ryan Harvey 395c471021 Update v-add-user
More stricter permissions, the current setup allows any user on the system to read other users web files as long as they know the path, the only users which should  be allow to access $HOMEDIR/$user/web is owner of sites and nginx user to be able to serve static files.

 I also locked down access $HOMEDIR/$user/tmp to the user, its gets used in the hosting template for tmp files, i don't see why another user would need access to it as apache runs as the user.
2016-02-18 02:12:53 +00:00

215 lines
5.3 KiB
Bash
Executable file

#!/bin/bash
# info: add system user
# options: USER PASSWORD EMAIL [PACKAGE] [FNAME] [LNAME]
#
# The function creates new user account.
#----------------------------------------------------------#
# Variable&Function #
#----------------------------------------------------------#
# Argument definition
user=$1
password=$2; HIDE=2
email=$3
package=${4-default}
fname=$5
lname=$6
# Includes
source $VESTA/func/main.sh
source $VESTA/conf/vesta.conf
is_user_free() {
check_sysuser=$(cut -f 1 -d : /etc/passwd | grep -w "$user" )
if [ ! -z "$check_sysuser" ] || [ -e "$USER_DATA" ]; then
echo "Error: user $user exists"
log_event "$E_EXISTS" "$EVENT"
exit $E_EXISTS
fi
}
#----------------------------------------------------------#
# Verifications #
#----------------------------------------------------------#
check_args '3' "$#" 'USER PASSWORD EMAIL [PACKAGE] [FNAME] [LNAME]'
validate_format 'user' 'email' 'package'
if [ ! -z "$fname" ]; then
validate_format 'fname' 'lname'
fi
is_user_free "$user"
is_password_valid
is_package_valid
#----------------------------------------------------------#
# Action #
#----------------------------------------------------------#
# Parsing package data
pkg_data=$(cat $VESTA/data/packages/$package.pkg |grep -v TIME |grep -v DATE)
# Checking shell
shell_conf=$(echo "$pkg_data" | grep 'SHELL' | cut -f 2 -d \')
shell=$(grep -w "$shell_conf" /etc/shells |head -n1)
# Adding user
/usr/sbin/useradd "$user" -s "$shell" -c "$email" -m -d "$HOMEDIR/$user"
check_result $? "user creation failed" $E_INVALID
# Adding password
echo "$user:$password" | /usr/sbin/chpasswd
# Building directory tree
mkdir $HOMEDIR/$user/conf
if [ ! -z "$WEB_SYSTEM" ]; then
nginxuser=$(ps -eo user,comm|grep nginx|uniq|grep -v "root"|awk '{ print $1}')
mkdir $HOMEDIR/$user/conf/web $HOMEDIR/$user/web $HOMEDIR/$user/tmp
chmod 751 $HOMEDIR/$user/conf/web
chmod 710 $HOMEDIR/$user/web
chmod 700 $HOMEDIR/$user/tmp
chown $user:$nginxuser $HOMEDIR/$user/web
chown $user:$user $HOMEDIR/$user/tmp
fi
if [ ! -z "$MAIL_SYSTEM" ]; then
mkdir $HOMEDIR/$user/conf/mail $HOMEDIR/$user/mail
chmod 751 $HOMEDIR/$user/mail $HOMEDIR/$user/conf/mail
fi
if [ ! -z "$DNS_SYSTEM" ]; then
mkdir $HOMEDIR/$user/conf/dns
chmod 751 $HOMEDIR/$user/conf/dns
fi
# Set permissions
chmod a+x $HOMEDIR/$user
chattr +i $HOMEDIR/$user/conf
#----------------------------------------------------------#
# Vesta #
#----------------------------------------------------------#
# Adding user dir
mkdir -p $USER_DATA/ssl $USER_DATA/dns $USER_DATA/mail
# Creating configuration files and pipes
touch $USER_DATA/backup.conf \
$USER_DATA/history.log \
$USER_DATA/stats.log \
$USER_DATA/web.conf \
$USER_DATA/dns.conf \
$USER_DATA/mail.conf \
$USER_DATA/db.conf \
$USER_DATA/cron.conf
chmod 770 $USER_DATA \
$USER_DATA/ssl \
$USER_DATA/dns \
$USER_DATA/mail
chmod 660 $USER_DATA/backup.conf \
$USER_DATA/history.log \
$USER_DATA/stats.log \
$USER_DATA/web.conf \
$USER_DATA/dns.conf \
$USER_DATA/mail.conf \
$USER_DATA/db.conf \
$USER_DATA/cron.conf
# Updating queue pipes
echo "$BIN/v-update-user-disk $user" >> $VESTA/data/queue/disk.pipe
if [ ! -z "$WEB_SYSTEM" ]; then
echo "$BIN/v-update-web-domains-traff $user" \
>> $VESTA/data/queue/traffic.pipe
echo "$BIN/v-update-web-domains-disk $user" >> $VESTA/data/queue/disk.pipe
fi
if [ ! -z "$MAIL_SYSTEM" ]; then
echo "$BIN/v-update-mail-domains-disk $user" >> $VESTA/data/queue/disk.pipe
fi
if [ ! -z "$DB_SYSTEM" ]; then
echo "$BIN/v-update-databases-disk $user" >> $VESTA/data/queue/disk.pipe
fi
# Filling user config
if [ "$user" != 'admin' ]; then
ip_avail=$($BIN/v-list-user-ips admin plain |grep -w shared|wc -l)
u_users=0
else
ip_avail=0
u_users=1
fi
echo "FNAME='$fname'
LNAME='$lname'
PACKAGE='$package'
$pkg_data
CONTACT='$email'
CRON_REPORTS='yes'
MD5='$(awk -v user=$user -F : 'user == $1 {print $2}' /etc/shadow)'
RKEY='$(gen_password)'
SUSPENDED='no'
SUSPENDED_USERS='0'
SUSPENDED_WEB='0'
SUSPENDED_DNS='0'
SUSPENDED_MAIL='0'
SUSPENDED_DB='0'
SUSPENDED_CRON='0'
IP_AVAIL='$ip_avail'
IP_OWNED='0'
U_USERS='$u_users'
U_DISK='0'
U_DISK_DIRS='0'
U_DISK_WEB='0'
U_DISK_MAIL='0'
U_DISK_DB='0'
U_BANDWIDTH='0'
U_WEB_DOMAINS='0'
U_WEB_SSL='0'
U_WEB_ALIASES='0'
U_DNS_DOMAINS='0'
U_DNS_RECORDS='0'
U_MAIL_DOMAINS='0'
U_MAIL_DKIM='0'
U_MAIL_ACCOUNTS='0'
U_DATABASES='0'
U_CRON_JOBS='0'
U_BACKUPS='0'
LANGUAGE=''
NOTIFICATIONS='no'
TIME='$TIME'
DATE='$DATE'" > $USER_DATA/user.conf
chmod 660 $USER_DATA/user.conf
# Updating quota
if [ "$DISK_QUOTA" = 'yes' ]; then
$BIN/v-update-user-quota "$user"
fi
# Updating admin counter
if [ "$user" != 'admin' ]; then
increase_user_value 'admin' '$U_USERS'
fi
# Run template trigger
if [ -x "$VESTA/data/packages/$package.sh" ]; then
$VESTA/data/packages/$package.sh "$user" "$email" "$fname" "$lname"
fi
# Adding jailed sftp env
if [ ! -z "$SFTPJAIL_KEY" ]; then
$BIN/v-add-user-sftp-jail $user
fi
# Logging
log_history "added system user $user" '' 'admin'
log_event "$OK" "$EVENT"
exit