This reverts commit 01bc3762b2.
Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>
Reviewed-on: #87
This commit was merged in pull request #87.
This commit is contained in:
@@ -1,21 +1,21 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
tmp_path="/tmp/authorized_keys"
|
||||
dest_path="/home/ssh/.ssh/authorized_keys"
|
||||
echo "# This file is autoly generated. Changes here will not work." > "$tmp_path"
|
||||
|
||||
for file in $(find "$THIS_DIR/../authorized_keys" -type f); do
|
||||
(echo "# key file: ${file#*authorized_keys/}";cat "$file"; echo) >> "$tmp_path"
|
||||
done
|
||||
|
||||
if [[ ! -d "/home/ssh/.ssh" ]]; then
|
||||
mkdir -p "/home/ssh/.ssh"
|
||||
chown ssh:ssh "/home/ssh/.ssh"
|
||||
chmod 700 "/home/ssh/.ssh"
|
||||
fi
|
||||
cat "$tmp_path" > "$dest_path"
|
||||
rm "$tmp_path"
|
||||
chown ssh:ssh "$dest_path"
|
||||
chmod 600 "$dest_path"
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
tmp_path="/tmp/authorized_keys"
|
||||
dest_path="/home/ssh/.ssh/authorized_keys"
|
||||
echo "# This file is autoly generated. Changes here will not work." > "$tmp_path"
|
||||
|
||||
for file in $(find "$THIS_DIR/../authorized_keys" -type f); do
|
||||
(echo "# key file: ${file#*authorized_keys/}";cat "$file"; echo) >> "$tmp_path"
|
||||
done
|
||||
|
||||
if [[ ! -d "/home/ssh/.ssh" ]]; then
|
||||
mkdir -p "/home/ssh/.ssh"
|
||||
chown ssh:ssh "/home/ssh/.ssh"
|
||||
chmod 700 "/home/ssh/.ssh"
|
||||
fi
|
||||
cat "$tmp_path" > "$dest_path"
|
||||
rm "$tmp_path"
|
||||
chown ssh:ssh "$dest_path"
|
||||
chmod 600 "$dest_path"
|
||||
|
||||
@@ -1,25 +1,25 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
adduser \
|
||||
--disabled-password \
|
||||
--home /home/ssh \
|
||||
--gecos "jumpserver user ssh" \
|
||||
ssh
|
||||
|
||||
usermod -p '*' ssh
|
||||
|
||||
insert_if_not_exist()
|
||||
{
|
||||
filename=$1
|
||||
line=$2
|
||||
if [ ! -f "$filename" ]; then
|
||||
touch $filename
|
||||
fi
|
||||
grep -qxF -- "$line" "$filename" || echo "$line" >> "$filename"
|
||||
}
|
||||
|
||||
insert_if_not_exist "/etc/crontabs/root" "*/5 * * * * cd \"$THIS_DIR\" && git pull && \"$THIS_DIR\"/jumpserver_cron.sh"
|
||||
|
||||
"$THIS_DIR"/jumpserver_cron.sh
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
adduser \
|
||||
--disabled-password \
|
||||
--home /home/ssh \
|
||||
--gecos "jumpserver user ssh" \
|
||||
ssh
|
||||
|
||||
usermod -p '*' ssh
|
||||
|
||||
insert_if_not_exist()
|
||||
{
|
||||
filename=$1
|
||||
line=$2
|
||||
if [ ! -f "$filename" ]; then
|
||||
touch $filename
|
||||
fi
|
||||
grep -qxF -- "$line" "$filename" || echo "$line" >> "$filename"
|
||||
}
|
||||
|
||||
insert_if_not_exist "/etc/crontabs/root" "*/5 * * * * cd \"$THIS_DIR\" && git pull && \"$THIS_DIR\"/jumpserver_cron.sh"
|
||||
|
||||
"$THIS_DIR"/jumpserver_cron.sh
|
||||
|
||||
14
scripts/nasp
14
scripts/nasp
@@ -1,7 +1,7 @@
|
||||
%nasp ALL = (root) NOPASSWD: /usr/bin/docker
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/reboot
|
||||
%nasp ALL = (root) NOPASSWD: /usr/bin/whoami
|
||||
%nasp ALL = (root) NOPASSWD: /usr/bin/nvidia-smi
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/shutdown
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/ufw
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/ip
|
||||
%nasp ALL = (root) NOPASSWD: /usr/bin/docker
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/reboot
|
||||
%nasp ALL = (root) NOPASSWD: /usr/bin/whoami
|
||||
%nasp ALL = (root) NOPASSWD: /usr/bin/nvidia-smi
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/shutdown
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/ufw
|
||||
%nasp ALL = (root) NOPASSWD: /usr/sbin/ip
|
||||
|
||||
@@ -1,64 +1,64 @@
|
||||
#!/usr/bin/env bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
check_username() {
|
||||
( echo $1 | grep -qxE "^[a-z][-a-z0-9_]*\$" ) || return 1
|
||||
return 0
|
||||
}
|
||||
|
||||
touch_user() {
|
||||
test -n "$1"
|
||||
check_username $1 || { echo "Invalid user name $1 !"; exit -1; }
|
||||
if id -u $1 1>/dev/null 2>&1; then
|
||||
return
|
||||
fi
|
||||
if ! getent group nasp ; then
|
||||
echo "Group 'nasp' does not exist\!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
useradd -m --groups nasp $1
|
||||
su - $1 -c "true"
|
||||
|
||||
mkdir -p /home2/$1
|
||||
chown $1:nasp /home2/$1
|
||||
}
|
||||
|
||||
update_key() {
|
||||
tmp_path="/tmp/authorized_keys_$1"
|
||||
dest_path="/home/$1/.ssh/authorized_keys"
|
||||
dest_dir=$(dirname "$dest_path")
|
||||
|
||||
echo "# This file is autoly generated. Changes here will not work." > "$tmp_path"
|
||||
for file in $(find "$THIS_DIR/../authorized_keys/$1" -type f); do
|
||||
(echo "# key file: ${file#*authorized_keys/}";cat "$file"; echo) >> "$tmp_path"
|
||||
done
|
||||
|
||||
if [[ ! -d "$dest_dir" ]]; then
|
||||
mkdir -p "$dest_dir"
|
||||
chown $1:nasp "$dest_dir"
|
||||
chmod 700 "$dest_dir"
|
||||
fi
|
||||
cat "$tmp_path" > "$dest_path"
|
||||
rm "$tmp_path"
|
||||
chown $1:nasp "$dest_path"
|
||||
chmod 600 "$dest_path"
|
||||
}
|
||||
|
||||
main() {
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
test "$ID" = "nixos" || cp "$THIS_DIR/nasp" "/etc/sudoers.d/nasp"
|
||||
fi
|
||||
for file in "$THIS_DIR"/../authorized_keys/* ; do
|
||||
if [[ ! -d "$file" ]]; then
|
||||
continue
|
||||
fi
|
||||
username=$(basename $file)
|
||||
touch_user $username
|
||||
update_key $username
|
||||
done
|
||||
}
|
||||
|
||||
main
|
||||
#!/usr/bin/env bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
check_username() {
|
||||
( echo $1 | grep -qxE "^[a-z][-a-z0-9_]*\$" ) || return 1
|
||||
return 0
|
||||
}
|
||||
|
||||
touch_user() {
|
||||
test -n "$1"
|
||||
check_username $1 || { echo "Invalid user name $1 !"; exit -1; }
|
||||
if id -u $1 1>/dev/null 2>&1; then
|
||||
return
|
||||
fi
|
||||
if ! getent group nasp ; then
|
||||
echo "Group 'nasp' does not exist\!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
useradd -m --groups nasp $1
|
||||
su - $1 -c "true"
|
||||
|
||||
mkdir -p /home2/$1
|
||||
chown $1:nasp /home2/$1
|
||||
}
|
||||
|
||||
update_key() {
|
||||
tmp_path="/tmp/authorized_keys_$1"
|
||||
dest_path="/home/$1/.ssh/authorized_keys"
|
||||
dest_dir=$(dirname "$dest_path")
|
||||
|
||||
echo "# This file is autoly generated. Changes here will not work." > "$tmp_path"
|
||||
for file in $(find "$THIS_DIR/../authorized_keys/$1" -type f); do
|
||||
(echo "# key file: ${file#*authorized_keys/}";cat "$file"; echo) >> "$tmp_path"
|
||||
done
|
||||
|
||||
if [[ ! -d "$dest_dir" ]]; then
|
||||
mkdir -p "$dest_dir"
|
||||
chown $1:nasp "$dest_dir"
|
||||
chmod 700 "$dest_dir"
|
||||
fi
|
||||
cat "$tmp_path" > "$dest_path"
|
||||
rm "$tmp_path"
|
||||
chown $1:nasp "$dest_path"
|
||||
chmod 600 "$dest_path"
|
||||
}
|
||||
|
||||
main() {
|
||||
if [ -f /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
test "$ID" = "nixos" || cp "$THIS_DIR/nasp" "/etc/sudoers.d/nasp"
|
||||
fi
|
||||
for file in "$THIS_DIR"/../authorized_keys/* ; do
|
||||
if [[ ! -d "$file" ]]; then
|
||||
continue
|
||||
fi
|
||||
username=$(basename $file)
|
||||
touch_user $username
|
||||
update_key $username
|
||||
done
|
||||
}
|
||||
|
||||
main
|
||||
|
||||
@@ -1,20 +1,20 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
apt update && apt install sudo
|
||||
addgroup nasp
|
||||
|
||||
insert_if_not_exist()
|
||||
{
|
||||
filename=$1
|
||||
line=$2
|
||||
if [ ! -f "$filename" ]; then
|
||||
touch $filename
|
||||
fi
|
||||
grep -qxF -- "$line" "$filename" || echo "$line" >> "$filename"
|
||||
}
|
||||
|
||||
insert_if_not_exist "/etc/crontab" "*/5 * * * * root cd \"$THIS_DIR\" && git pull && \"$THIS_DIR\"/testbed_cron.sh"
|
||||
|
||||
"$THIS_DIR"/testbed_cron.sh
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
|
||||
|
||||
apt update && apt install sudo
|
||||
addgroup nasp
|
||||
|
||||
insert_if_not_exist()
|
||||
{
|
||||
filename=$1
|
||||
line=$2
|
||||
if [ ! -f "$filename" ]; then
|
||||
touch $filename
|
||||
fi
|
||||
grep -qxF -- "$line" "$filename" || echo "$line" >> "$filename"
|
||||
}
|
||||
|
||||
insert_if_not_exist "/etc/crontab" "*/5 * * * * root cd \"$THIS_DIR\" && git pull && \"$THIS_DIR\"/testbed_cron.sh"
|
||||
|
||||
"$THIS_DIR"/testbed_cron.sh
|
||||
|
||||
Reference in New Issue
Block a user