mirror of https://github.com/trailofbits/algo
parent
f0d0e91be0
commit
5fc738ba8b
@ -1,41 +1,25 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
set -euxo pipefail
|
set -eux
|
||||||
|
|
||||||
readonly user='algo'
|
which sudo || until \
|
||||||
|
apt-get update -y && \
|
||||||
export DEBIAN_FRONTEND='noninteractive'
|
apt-get install sudo -yf --install-suggests; do
|
||||||
|
|
||||||
until which sudo; do
|
|
||||||
apt-get update -qq
|
|
||||||
apt-get install -qqf --install-suggests sudo
|
|
||||||
sleep 3
|
sleep 3
|
||||||
done
|
done
|
||||||
|
|
||||||
getent passwd "${user}" \
|
getent passwd algo || useradd -m -d /home/algo -s /bin/bash -G adm -p '!' algo
|
||||||
|| useradd -m -d "/home/${user}" -s /bin/bash -G adm -p '!' "${user}"
|
|
||||||
|
|
||||||
(
|
|
||||||
umask 0337 \
|
|
||||||
&& printf '%s\n' "${user} ALL=(ALL) NOPASSWD:ALL" \
|
|
||||||
>"/etc/sudoers.d/10-algo-user"
|
|
||||||
)
|
|
||||||
|
|
||||||
printf "{{ lookup('template', 'files/cloud-init/sshd_config') }}\n" \
|
|
||||||
>/etc/ssh/sshd_config
|
|
||||||
|
|
||||||
# This should be idempotent; correct permsission on .ssh dir if exists
|
(umask 337 && echo "algo ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/10-algo-user)
|
||||||
install -o "${user}" -g "${user}" -m 0700 -d "/home/${user}/.ssh"
|
|
||||||
|
|
||||||
# umask does not reliably work with sudo
|
cat <<EOF >/etc/ssh/sshd_config
|
||||||
install -o "${user}" -g "${user}" -m 0600 \
|
{{ lookup('template', 'files/cloud-init/sshd_config') }}
|
||||||
/dev/null "/home/${user}/.ssh/authorized_keys"
|
EOF
|
||||||
|
|
||||||
printf "{{ lookup('file', '{{ SSH_keys.public }}') }}\n" \
|
test -d /home/algo/.ssh || (umask 077 && sudo -u algo mkdir -p /home/algo/.ssh/)
|
||||||
>"/home/${user}/.ssh/authorized_keys"
|
echo "{{ lookup('file', '{{ SSH_keys.public }}') }}" | (umask 177 && sudo -u algo tee /home/algo/.ssh/authorized_keys)
|
||||||
|
|
||||||
until ! dpkg -l sshguard; do
|
dpkg -l sshguard && until apt-get remove -y --purge sshguard; do
|
||||||
apt-get remove -qq --purge sshguard
|
|
||||||
sleep 3
|
sleep 3
|
||||||
done || :
|
done || true
|
||||||
|
|
||||||
systemctl restart sshd.service
|
systemctl restart sshd.service
|
||||||
|
Loading…
Reference in New Issue