Skip to content

Commit b79d240

Browse files
falkotimmefalkotimme
committed
- Make sure puser is bigger than min_uid of 499 for jailkit users.
1 parent d195e39 commit b79d240

File tree

1 file changed

+73
-52
lines changed

1 file changed

+73
-52
lines changed

‎server/plugins-available/shelluser_jailkit_plugin.inc.php‎

Lines changed: 73 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ class shelluser_jailkit_plugin {
3333
//* $plugin_name and $class_name have to be the same then the name of this class
3434
var $plugin_name = 'shelluser_jailkit_plugin';
3535
var $class_name = 'shelluser_jailkit_plugin';
36+
var $min_uid = 499;
3637

3738
//* This function is called during ispconfig installation to determine
3839
// if a symlink shall be created for this plugin.
@@ -73,50 +74,60 @@ function insert($event_name, $data) {
7374
$app->uses('system');
7475
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
7576

76-
if($app->system->is_user($data['new']['username'])) {
77+
if($app->system->is_user($data['new']['puser'])) {
78+
// Get the UID of the parent user
79+
$uid = intval($app->system->getuid($data['new']['puser']));
80+
if($uid > $this->min_uid) {
81+
82+
if($app->system->is_user($data['new']['username'])) {
7783

78-
/**
79-
* Setup Jailkit Chroot System If Enabled
80-
*/
84+
/**
85+
* Setup Jailkit Chroot System If Enabled
86+
*/
8187

88+
if ($data['new']['chroot'] == "jailkit")
89+
{
8290

83-
if ($data['new']['chroot'] == "jailkit")
84-
{
8591

92+
// load the server configuration options
93+
$app->uses("getconf");
94+
$this->data = $data;
95+
$this->app = $app;
96+
$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
8697

87-
// load the server configuration options
88-
$app->uses("getconf");
89-
$this->data = $data;
90-
$this->app = $app;
91-
$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
98+
$this->_update_website_security_level();
9299

93-
$this->_update_website_security_level();
100+
$app->system->web_folder_protection($web['document_root'], false);
94101

95-
$app->system->web_folder_protection($web['document_root'], false);
102+
$this->_setup_jailkit_chroot();
96103

97-
$this->_setup_jailkit_chroot();
104+
$this->_add_jailkit_user();
98105

99-
$this->_add_jailkit_user();
106+
//* call the ssh-rsa update function
107+
$this->_setup_ssh_rsa();
100108

101-
//* call the ssh-rsa update function
102-
$this->_setup_ssh_rsa();
109+
//$command .= 'usermod -s /usr/sbin/jk_chrootsh -U '.escapeshellcmd($data['new']['username']);
110+
//exec($command);
111+
$app->system->usermod($data['new']['username'], 0, 0, '', '/usr/sbin/jk_chrootsh', '', '');
103112

104-
//$command .= 'usermod -s /usr/sbin/jk_chrootsh -U '.escapeshellcmd($data['new']['username']);
105-
//exec($command);
106-
$app->system->usermod($data['new']['username'], 0, 0, '', '/usr/sbin/jk_chrootsh', '', '');
113+
//* Unlock user
114+
$command = 'usermod -U '.escapeshellcmd($data['new']['username']).' 2>/dev/null';
115+
exec($command);
107116

108-
//* Unlock user
109-
$command = 'usermod -U '.escapeshellcmd($data['new']['username']).' 2>/dev/null';
110-
exec($command);
111-
112-
$this->_update_website_security_level();
113-
$app->system->web_folder_protection($web['document_root'], true);
114-
}
117+
$this->_update_website_security_level();
118+
$app->system->web_folder_protection($web['document_root'], true);
119+
}
115120

116-
$app->log("Jailkit Plugin -> insert username:".$data['new']['username'], LOGLEVEL_DEBUG);
121+
$app->log("Jailkit Plugin -> insert username:".$data['new']['username'], LOGLEVEL_DEBUG);
117122

123+
} else {
124+
$app->log("Jailkit Plugin -> insert username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
125+
}
126+
} else {
127+
$app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
128+
}
118129
} else {
119-
$app->log("Jailkit Plugin -> insert username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
130+
$app->log("Skipping insertion of user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
120131
}
121132

122133
}
@@ -128,41 +139,51 @@ function update($event_name, $data) {
128139
$app->uses('system');
129140
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
130141

131-
if($app->system->is_user($data['new']['username'])) {
142+
if($app->system->is_user($data['new']['puser'])) {
143+
// Get the UID of the parent user
144+
$uid = intval($app->system->getuid($data['new']['puser']));
145+
if($uid > $this->min_uid) {
146+
147+
148+
if($app->system->is_user($data['new']['username'])) {
132149

150+
/**
151+
* Setup Jailkit Chroot System If Enabled
152+
*/
153+
if ($data['new']['chroot'] == "jailkit")
154+
{
133155

156+
// load the server configuration options
157+
$app->uses("getconf");
158+
$this->data = $data;
159+
$this->app = $app;
160+
$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
134161

135-
/**
136-
* Setup Jailkit Chroot System If Enabled
137-
*/
138-
if ($data['new']['chroot'] == "jailkit")
139-
{
162+
$this->_update_website_security_level();
140163

141-
// load the server configuration options
142-
$app->uses("getconf");
143-
$this->data = $data;
144-
$this->app = $app;
145-
$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
164+
$app->system->web_folder_protection($web['document_root'], false);
146165

147-
$this->_update_website_security_level();
166+
$this->_setup_jailkit_chroot();
167+
$this->_add_jailkit_user();
148168

149-
$app->system->web_folder_protection($web['document_root'], false);
169+
//* call the ssh-rsa update function
170+
$this->_setup_ssh_rsa();
150171

151-
$this->_setup_jailkit_chroot();
152-
$this->_add_jailkit_user();
172+
$this->_update_website_security_level();
153173

154-
//* call the ssh-rsa update function
155-
$this->_setup_ssh_rsa();
174+
$app->system->web_folder_protection($web['document_root'], true);
175+
}
156176

157-
$this->_update_website_security_level();
177+
$app->log("Jailkit Plugin -> update username:".$data['new']['username'], LOGLEVEL_DEBUG);
158178

159-
$app->system->web_folder_protection($web['document_root'], true);
179+
} else {
180+
$app->log("Jailkit Plugin -> update username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
181+
}
182+
} else {
183+
$app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
160184
}
161-
162-
$app->log("Jailkit Plugin -> update username:".$data['new']['username'], LOGLEVEL_DEBUG);
163-
164185
} else {
165-
$app->log("Jailkit Plugin -> update username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
186+
$app->log("Skipping update for user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
166187
}
167188

168189
}

0 commit comments

Comments
 (0)