Initial

bin/v-add-sys-sftp-jail

@@ -0,0 +1,99 @@
+#!/bin/bash
+# info: add system sftp jail
+# options: [RESTART]
+#
+# example: v-add-sys-sftp-jail yes
+#
+# This function enables sftp jailed environment.
+
+#----------------------------------------------------------#
+#                Variables & Functions                     #
+#----------------------------------------------------------#
+
+# Includes
+# shellcheck source=/etc/hestiacp/hestia.conf
+source /etc/hestiacp/hestia.conf
+# shellcheck source=/usr/local/hestia/func/main.sh
+source $HESTIA/func/main.sh
+# load config file
+source_conf "$HESTIA/conf/hestia.conf"
+
+restart=$1
+
+#----------------------------------------------------------#
+#                    Verifications                         #
+#----------------------------------------------------------#
+
+# Perform verification if read-only mode is enabled
+check_hestia_demo_mode
+
+#----------------------------------------------------------#
+#                       Action                             #
+#----------------------------------------------------------#
+
+# Checking sshd directives
+config='/etc/ssh/sshd_config'
+sftp_n=$(grep -n "Subsystem.*sftp" $config | grep -v internal | grep -v ":#")
+sftp_i=$(grep -n "^# Hestia SFTP Chroot" $config)
+
+# Disabling normal sftp
+if [ -n "$sftp_n" ]; then
+	fline=$(echo $sftp_n | cut -f 1 -d :)
+	sed -i "${fline}s/Subsystem.*sftp/#Subsystem sftp/" $config
+	restart='yes'
+fi
+
+# Enabling jailed sftp
+if [ -z "$sftp_i" ]; then
+	echo " " >> $config
+	echo "# Hestia SFTP Chroot" >> $config
+	echo "Match User sftp_dummy99" >> $config
+	echo "ChrootDirectory %h" >> $config
+	echo "    X11Forwarding no" >> $config
+	echo "    AllowTCPForwarding no" >> $config
+	echo "    ForceCommand internal-sftp" >> $config
+	restart='yes'
+fi
+
+# Validating opensshd config
+if [ "$restart" = 'yes' ]; then
+	subj="OpenSSH restart failed"
+	email=$(grep CONTACT $HESTIA/data/users/admin/user.conf | cut -f 2 -d \')
+	/usr/sbin/sshd -t > /dev/null 2>&1
+	if [ "$?" -ne 0 ]; then
+		mail_text="OpenSSH can not be restarted. Please check config:
+            \n\n$(/usr/sbin/sshd -t)"
+		echo -e "$mail_text" | $SENDMAIL -s "$subj" $email
+	else
+		service ssh restart > /dev/null 2>&1
+	fi
+fi
+
+# Checking users
+shells="rssh|nologin"
+for user in $(grep "$HOMEDIR" /etc/passwd | egrep "$shells" | cut -f 1 -d:); do
+	# Include all users v-add-user-sftp-jail will handle it
+	$BIN/v-add-user-sftp-jail "$user" "no"
+done
+
+# Restart ssh service
+if [ "$restart" = 'no' ]; then
+	# Skip restart of SSH daemon
+	echo "" > /dev/null 2>&1
+else
+	service ssh restart > /dev/null 2>&1
+fi
+
+# Add v-add-sys-sftp-jail to startup
+if [ ! -e "/etc/cron.d/hestia-sftp" ]; then
+	echo "@reboot root sleep 60 && /usr/local/hestia/bin/v-add-sys-sftp-jail > /dev/null" > /etc/cron.d/hestia-sftp
+fi
+
+#----------------------------------------------------------#
+#                       Hestia                             #
+#----------------------------------------------------------#
+
+# Logging
+log_event "$OK" "$ARGUMENTS"
+
+exit