You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
100 lines
2.9 KiB
100 lines
2.9 KiB
2 years ago
|
#!/bin/bash
|
||
|
|
# info: add system sftp jail
|
||
|
|
# options: [RESTART]
|
||
|
|
#
|
||
|
|
# example: v-add-sys-sftp-jail yes
|
||
|
|
#
|
||
|
|
# This function enables sftp jailed environment.
|
||
|
|
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
# Variables & Functions #
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
|
||
|
|
# Includes
|
||
|
|
# shellcheck source=/etc/hestiacp/hestia.conf
|
||
|
|
source /etc/hestiacp/hestia.conf
|
||
|
|
# shellcheck source=/usr/local/hestia/func/main.sh
|
||
|
|
source $HESTIA/func/main.sh
|
||
|
|
# load config file
|
||
|
|
source_conf "$HESTIA/conf/hestia.conf"
|
||
|
|
|
||
|
|
restart=$1
|
||
|
|
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
# Verifications #
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
|
||
|
|
# Perform verification if read-only mode is enabled
|
||
|
|
check_hestia_demo_mode
|
||
|
|
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
# Action #
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
|
||
|
|
# Checking sshd directives
|
||
|
|
config='/etc/ssh/sshd_config'
|
||
|
|
sftp_n=$(grep -n "Subsystem.*sftp" $config | grep -v internal | grep -v ":#")
|
||
|
|
sftp_i=$(grep -n "^# Hestia SFTP Chroot" $config)
|
||
|
|
|
||
|
|
# Disabling normal sftp
|
||
|
|
if [ -n "$sftp_n" ]; then
|
||
|
|
fline=$(echo $sftp_n | cut -f 1 -d :)
|
||
|
|
sed -i "${fline}s/Subsystem.*sftp/#Subsystem sftp/" $config
|
||
|
|
restart='yes'
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Enabling jailed sftp
|
||
|
|
if [ -z "$sftp_i" ]; then
|
||
|
|
echo " " >> $config
|
||
|
|
echo "# Hestia SFTP Chroot" >> $config
|
||
|
|
echo "Match User sftp_dummy99" >> $config
|
||
|
|
echo "ChrootDirectory %h" >> $config
|
||
|
|
echo " X11Forwarding no" >> $config
|
||
|
|
echo " AllowTCPForwarding no" >> $config
|
||
|
|
echo " ForceCommand internal-sftp" >> $config
|
||
|
|
restart='yes'
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Validating opensshd config
|
||
|
|
if [ "$restart" = 'yes' ]; then
|
||
|
|
subj="OpenSSH restart failed"
|
||
|
|
email=$(grep CONTACT $HESTIA/data/users/admin/user.conf | cut -f 2 -d \')
|
||
|
|
/usr/sbin/sshd -t > /dev/null 2>&1
|
||
|
|
if [ "$?" -ne 0 ]; then
|
||
|
|
mail_text="OpenSSH can not be restarted. Please check config:
|
||
|
|
\n\n$(/usr/sbin/sshd -t)"
|
||
|
|
echo -e "$mail_text" | $SENDMAIL -s "$subj" $email
|
||
|
|
else
|
||
|
|
service ssh restart > /dev/null 2>&1
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Checking users
|
||
|
|
shells="rssh|nologin"
|
||
|
|
for user in $(grep "$HOMEDIR" /etc/passwd | egrep "$shells" | cut -f 1 -d:); do
|
||
|
|
# Include all users v-add-user-sftp-jail will handle it
|
||
|
|
$BIN/v-add-user-sftp-jail "$user" "no"
|
||
|
|
done
|
||
|
|
|
||
|
|
# Restart ssh service
|
||
|
|
if [ "$restart" = 'no' ]; then
|
||
|
|
# Skip restart of SSH daemon
|
||
|
|
echo "" > /dev/null 2>&1
|
||
|
|
else
|
||
|
|
service ssh restart > /dev/null 2>&1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Add v-add-sys-sftp-jail to startup
|
||
|
|
if [ ! -e "/etc/cron.d/hestia-sftp" ]; then
|
||
|
|
echo "@reboot root sleep 60 && /usr/local/hestia/bin/v-add-sys-sftp-jail > /dev/null" > /etc/cron.d/hestia-sftp
|
||
|
|
fi
|
||
|
|
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
# Hestia #
|
||
|
|
#----------------------------------------------------------#
|
||
|
|
|
||
|
|
# Logging
|
||
|
|
log_event "$OK" "$ARGUMENTS"
|
||
|
|
|
||
|
|
exit
|