55 rindas
1.9 KiB
Bash
Izpildāmais fails
55 rindas
1.9 KiB
Bash
Izpildāmais fails
#!/bin/bash
|
|
set -e
|
|
|
|
export PATH="/usr/bin:/bin:/usr/sbin:/sbin"
|
|
|
|
dest=/var/run/foodoor-keys
|
|
temp_outfile=$dest.tmp
|
|
|
|
if [ ! -e "$dest/.git/config" ]; then
|
|
#echo "Repo does not exist, trying to clone..."
|
|
git -C "$dest" clone --quiet --single-branch --depth=1 ssh://git.chaospott.de/Keyverwaltung/foodoor-keys.git "$dest"
|
|
else
|
|
#echo "Repo exists, updating..."
|
|
git -C "$dest" fetch --quiet && git -C "$dest" merge --quiet origin/master master
|
|
fi
|
|
|
|
rm -f "$temp_outfile"
|
|
find "$dest/keys" -type f -name '*.pub' | sort |
|
|
while read -r keyfile; do
|
|
if ssh-keygen -l -f "$keyfile" &> /dev/null; then
|
|
keyinfo=$(ssh-keygen -l -f "$keyfile") # The whole key information
|
|
crypto=$(echo "$keyinfo" | sed 's/.*(\(.*\))/\1/') # Looks like "RSA" or "ED25519"
|
|
key_length=$(echo "$keyinfo" | cut -d" " -f1)
|
|
|
|
if [ "$crypto" == "RSA" ]; then
|
|
if [ "$key_length" -lt 4096 ]; then
|
|
echo "Key size of key $keyfile less than 4096. Not adding it to key database." >&2
|
|
continue
|
|
fi
|
|
# valid
|
|
elif [ "$crypto" == "ED25519" ]; then
|
|
: # valid
|
|
else
|
|
continue
|
|
fi
|
|
|
|
echo "command=\"/usr/sbin/foodoor \$action \",no-port-forwarding,no-X11-forwarding,no-agent-forwarding $(sed 's/\r//g' "$keyfile") $keyfile" >> $temp_outfile
|
|
fi
|
|
done
|
|
|
|
for appendix in open close door; do
|
|
action=$appendix
|
|
if [ "$appendix" = "door" ]; then
|
|
action=""
|
|
fi
|
|
export action
|
|
|
|
outfile=$dest/authorized_keys.$appendix
|
|
envsubst < "$temp_outfile" > "$outfile"
|
|
|
|
# Oben und unten
|
|
install -d -o "$appendix" -g nogroup -m 0700 "/var/lib/foodoor/$appendix/.ssh"
|
|
install -b -S .last -o "$appendix" -g nogroup -m 0600 "$outfile" "/var/lib/foodoor/$appendix/.ssh/authorized_keys"
|
|
done
|