140 lines
4.5 KiB
Bash
Executable File
140 lines
4.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
script_dir=$(dirname "$0")
|
|
|
|
# ----------------------------------------------------------
|
|
|
|
echo 'WARNING: This script is designed to make a "git" user on your system to allow SSH Passthrough into a docker container, such as Gitea. If you proceed and already have a git user, this will edit it.'
|
|
echo ''
|
|
|
|
read -p 'Setup "git" user as a SSH Passthrough to a docker container? [y/N]: ' response
|
|
case "$response" in
|
|
[Yy]* )
|
|
# continuing
|
|
;;
|
|
* )
|
|
echo 'Stopping'
|
|
exit 0
|
|
;;
|
|
esac
|
|
echo ''
|
|
|
|
# ----------------------------------------------------------
|
|
|
|
read -p 'What is the name of the docker container "git" should passthrough to? [gitea]: ' dockerContainer
|
|
echo ''
|
|
|
|
# ----------------------------------------------------------
|
|
|
|
echo 'default command for gitea: ""/usr/local/bin/gitea keys -e git -u %u -t %t -k %k""'
|
|
read -p 'What is the command within the docker container that will return list of authorized keys? [gitea-default]: ' dockerCommand
|
|
echo ''
|
|
|
|
# ----------------------------------------------------------
|
|
|
|
# check if "git" user already exists
|
|
groups git > /dev/null
|
|
userExists="$?"
|
|
|
|
# we need that directory to exist, if we are going to make the shell file
|
|
sudo mkdir -p /home/git
|
|
|
|
# create shell for git user, put in /usr/local/bin/git-shell
|
|
echo 'creating custom git-shell'
|
|
( cat << 'TERM'
|
|
#!/bin/sh
|
|
/usr/bin/docker exec -i --env SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" 'gitea' sh "$@"
|
|
|
|
TERM
|
|
) | sudo tee '/home/git/git-shell' > /dev/null
|
|
|
|
# make it executable
|
|
echo 'making custom git-shell executable'
|
|
sudo chmod +x /home/git/git-shell
|
|
|
|
# user doesn't exist yet, so create it, just the way we want it
|
|
if [[ "$userExists" -ne "0" ]]; then
|
|
echo 'create git user (locked password, custom shell, docker group)'
|
|
|
|
sudo useradd -d /home/git -s /home/git/git-shell -m -U -G docker git
|
|
else
|
|
# user exists, make sure it matches our expectations
|
|
echo 'git user already exists'
|
|
|
|
userHome=$(grep '^git:' /etc/passwd | cut -f 6 -d :)
|
|
if [[ "/home/git" != "$userHome" ]]; then
|
|
echo 'moving home directory of git user to standard location'
|
|
sudo usermod -m -d /home/git git
|
|
fi
|
|
|
|
userGroups=$(groups git | cut -f 2 -d :)
|
|
if [[ "$userGroups" != *"docker"* ]]; then
|
|
echo 'adding docker group to git user'
|
|
sudo usermod -aG git
|
|
fi
|
|
|
|
userShell=$(grep '^git:' /etc/passwd | cut -f 7 -d :)
|
|
if [[ "/home/git/git-shell" != "$userShell" ]]; then
|
|
echo 'setting custom shell to git user'
|
|
sudo chsh -s /home/git/git-shell git
|
|
fi
|
|
|
|
echo 'checking if git user is password locked'
|
|
userStatus=$(sudo passwd -S git | cut -f 2 -d " ")
|
|
if [[ "$userStatus" != *"L"* ]]; then
|
|
echo 'locking password to git user'
|
|
sudo usermod -L
|
|
fi
|
|
fi
|
|
|
|
# use custom docker container name, if provided one
|
|
if [[ ! -z "$dockerContainer" ]]; then
|
|
sudo sed -i "s/gitea/${dockerContainer}/g" /home/git/git-shell
|
|
fi
|
|
|
|
# update sshd config to allow the docker container to specify the list of authorized keys
|
|
echo 'configuring sshd to check docker container for authorized keys for git user'
|
|
sudo mkdir -p '/etc/ssh/sshd_config.d'
|
|
( cat << 'CONF'
|
|
Match User git
|
|
AuthorizedKeysCommandUser git
|
|
AuthorizedKeysCommand /usr/bin/docker exec -i gitea /usr/local/bin/gitea keys -e git -u %u -t %t -k %k
|
|
|
|
CONF
|
|
) | sudo tee '/etc/ssh/sshd_config.d/git-passthru.conf' > /dev/null
|
|
|
|
# use custom docker container name and command, if provided one
|
|
if [[ ! -z "$dockerContainer" ]] || [[ ! -z "$dockerCommand" ]]; then
|
|
echo 'use custom container config provided'
|
|
|
|
# comment out normal line
|
|
sudo sed -i 's/ AuthorizedKeysCommand / #AuthorizedKeysCommand /g' /etc/ssh/sshd_config.d/git-passthru.conf
|
|
|
|
# fallback to defaults if not given both
|
|
if [[ -z "$dockerContainer" ]]; then
|
|
dockerContainer='gitea'
|
|
fi
|
|
if [[ -z "$dockerCommand" ]]; then
|
|
dockerCommand='/usr/local/bin/gitea keys -e git -u %u -t %t -k %k'
|
|
fi
|
|
|
|
# append new line
|
|
echo " AuthorizedKeysCommand /usr/bin/docker exec -i $dockerContainer $dockerCommand" | sudo tee -a /etc/ssh/sshd_config.d/git-passthru.conf
|
|
fi
|
|
echo ''
|
|
|
|
# ----------------------------------------------------------
|
|
|
|
read -p 'Restart SSH to use updated config? [y/N]: ' response
|
|
case "${response}" in
|
|
[Yy]* )
|
|
sudo systemctl restart ssh.service
|
|
echo -e "\e[33mremember to test ssh, ensure root login block, ensure user enabled, git gets sent into docker container"
|
|
;;
|
|
* )
|
|
echo 'Skipping'
|
|
;;
|
|
esac
|
|
echo ''
|
|
|