From 1e4ffbe3a1239ec234da2e7fb060d3596be72f04 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Thu, 10 Jun 2021 12:21:47 -0600 Subject: [PATCH] ssh-adduser: fix permissions & ssh password vuln --- ssh-utils/ssh-adduser.sh | 89 +++++++++++++++++++++++++++++----------- 1 file changed, 64 insertions(+), 25 deletions(-) diff --git a/ssh-utils/ssh-adduser.sh b/ssh-utils/ssh-adduser.sh index e14efb8..99a1586 100644 --- a/ssh-utils/ssh-adduser.sh +++ b/ssh-utils/ssh-adduser.sh @@ -1,50 +1,89 @@ #!/bin/bash -{ +function __run_ssh_adduser() { set -e set -u - # TODO: a more complete VPS setup - # TODO would $EUID be better? - if [ "root" != "$(whoami)" ]; then + if [[ "root" != "$(whoami)" ]]; then echo "webi adduser: running user is already a non-root user" exit 0 fi - #apt-get -y update - #apt-get -y install curl wget rsync git + if [[ ! -e ~/.ssh/authorized_keys ]] || ! grep -v '#' ~/.ssh/authorized_keys; then + echo "" + echo "Error:" + echo " You must add a key to ~/.ssh/authorized_keys before adding a new ssh user." + echo "" + echo "To fix:" + echo " Run 'curl https://webinstall.dev/ssh-pubkey | bash' on your local system, " + echo " then add that key to ~/.ssh/authorized_keys on this (the remote) system. " + echo "" + exit 1 + fi - # Add User app - # Picking 'app' because that seems to be what the # Docker/Vagrant - # crowd is doing. TODO: Other ideas? me, user, tron - my_name="${1:-"app"}" - adduser --disabled-password --gecos '' "$my_name" + # Add User 'app' + # Picking 'app' by common convention (what Docker & Vagrant use). + my_new_user="${1:-"app"}" + #my_existing_user="${2:-"root"}" + adduser --disabled-password --gecos '' "$my_new_user" my_password=$(openssl rand -hex 16) - printf "$my_password"'\n'"$my_password" | passwd "$my_name" + printf '%s\n%s' "${my_password}" "${my_password}" | passwd "${my_new_user}" # make 'app' a sudo-er (admin) - adduser "$my_name" sudo - echo "$my_name ALL=(ALL:ALL) NOPASSWD: ALL" | tee "/etc/sudoers.d/$my_name" + adduser "$my_new_user" sudo + echo "$my_new_user ALL=(ALL:ALL) NOPASSWD: ALL" | tee "/etc/sudoers.d/$my_new_user" # allow users who can already login as 'root' to login as 'app' - mkdir -p "/home/$my_name/.ssh/" - chmod 0700 "/home/$my_name/.ssh/" - cp -r "$HOME/.ssh/authorized_keys" "/home/$my_name/.ssh/" - chmod 0600 "/home/$my_name/.ssh/authorized_keys" - touch "/home/$my_name/.ssh/config" - chmod 0644 "/home/$my_name/.ssh/config" - chown -R "$my_name":"$my_name" "/home/$my_name/.ssh/" + mkdir -p "/home/$my_new_user/.ssh/" + chmod 0700 "/home/$my_new_user/.ssh/" + cp -r "${HOME}/.ssh/authorized_keys" "/home/$my_new_user/.ssh/" + chmod 0600 "/home/$my_new_user/.ssh/authorized_keys" + touch "/home/$my_new_user/.ssh/config" + chmod 0644 "/home/$my_new_user/.ssh/config" + chown -R "$my_new_user":"$my_new_user" "/home/$my_new_user/.ssh/" # ensure that 'app' has an SSH Keypair - sudo -i -u "$my_name" bash -c "ssh-keygen -b 2048 -t rsa -f '/home/$my_name/.ssh/id_rsa' -q -N ''" + sudo -i -u "$my_new_user" bash -c "ssh-keygen -b 2048 -t rsa -f '/home/$my_new_user/.ssh/id_rsa' -q -N ''" + chown -R "$my_new_user":"$my_new_user" "/home/$my_new_user/.ssh/" # Install webi for the new 'app' user WEBI_HOST=${WEBI_HOST:-"https://webinstall.dev"} - sudo -i -u "$my_name" bash -c "curl -fsSL '$WEBI_HOST/webi' | bash" || - sudo -i -u "$my_name" bash -c "wget -q -O - '$WEBI_HOST/webi' | bash" + sudo -i -u "$my_new_user" bash -c "curl -fsSL '$WEBI_HOST/webi' | bash" || + sudo -i -u "$my_new_user" bash -c "wget -q -O - '$WEBI_HOST/webi' | bash" # TODO ensure that ssh-password login is off + my_user="$(grep 'PasswordAuthentication yes' /etc/ssh/sshd_config)" + if [[ -n ${my_user} ]]; then + + echo "######################################################################" + echo "# #" + echo "# WARNING #" + echo "# #" + echo "# Found /etc/ssh/sshd_config: PasswordAuthentication yes #" + echo "# #" + echo "# This is EXTREMELY DANGEROUS and insecure. #" + echo "# We'll attempt to fix this now... #" + echo "# #" + + sed -i 's/#\?PasswordAuthentication \(yes\|no\)/PasswordAuthentication no/' \ + /etc/ssh/sshd_config - echo "Created user '$my_name' with password '$my_password'" + if grep "PasswordAuthentication yes" /etc/ssh/sshd_config; then + echo "# FAILED. Please check /etc/ssh/sshd_config manually. #" + else + echo "# Fixed... HOWEVER, you'll need to manually restart ssh: #" + echo "# #" + echo "# sudo systemctl restart ssh #" + echo "# #" + echo "# (you may want to make sure you can login as the new user first) #" + fi + echo "# #" + echo "######################################################################" + fi + + echo "Created user '${my_new_user}' as sudoer with a random password." + echo "(set a new password with 'password ${my_new_user}')" } + +__run_ssh_adduser app -- 2.25.1