Skip to content

Commit ff6a683

Browse files
tbrehmtbrehm
committed
Fixed: FS#2287 - Changing chroot shell option doesnt work
1 parent 816e7e4 commit ff6a683

File tree

5 files changed

+124
-10
lines changed

5 files changed

+124
-10
lines changed

‎server/lib/classes/monitor_tools.inc.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,6 @@ public function get_distname() {
117117
$relname = "UNKNOWN";
118118
}
119119
$distver = $ver.$lts." ".$relname;
120-
swriteln("Operating System: ".$distver."\n");
121120
} elseif(trim(file_get_contents('/etc/debian_version')) == '4.0') {
122121
$distname = 'Debian';
123122
$distver = '4.0';
@@ -1149,6 +1148,7 @@ public function monitorRaid() {
11491148
$data['output'] = shell_exec('tw_cli info c0');
11501149

11511150
$state = 'ok';
1151+
if(is_array($data['output'])) {
11521152
foreach ($data['output'] as $item) {
11531153
if (strpos($item, 'RAID') !== false) {
11541154
if (strpos($item, ' VERIFYING ') !== false) {
@@ -1192,6 +1192,7 @@ public function monitorRaid() {
11921192
}
11931193
}
11941194
}
1195+
}
11951196
}
11961197

11971198

‎server/lib/classes/system.inc.php‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,7 @@ function add_user_to_group($group, $user = 'admispconfig'){
737737
}
738738
}
739739

740+
/*
740741
function usermod($user, $groups){
741742
global $app;
742743
if($this->is_user($user)){
@@ -776,6 +777,7 @@ function usermod($user, $groups){
776777
return false;
777778
}
778779
}
780+
*/
779781

780782
/**boot autostart etc
781783
*
@@ -1396,6 +1398,102 @@ function web_folder_protection($document_root,$protect) {
13961398
if($document_root != '' && $document_root != '/' && strlen($document_root) > 6 && !stristr($document_root,'..')) exec('chattr -i '.escapeshellcmd($document_root));
13971399
}
13981400
}
1401+
1402+
function usermod($username, $uid = 0, $gid = 0, $home = '', $shell = '', $password = '', $login = '') {
1403+
global $app;
1404+
1405+
if($login == '') $login = $username;
1406+
1407+
//* Change values in /etc/passwd
1408+
$passwd_file_array = file('/etc/passwd');
1409+
if(is_array($passwd_file_array)) {
1410+
foreach($passwd_file_array as $line) {
1411+
$line = trim($line);
1412+
$parts = explode(':',$line);
1413+
if($parts[0] == $username) {
1414+
if(trim($login) != '' && trim($login) != trim($username)) $parts[0] = trim($login);
1415+
if(!empty($uid)) $parts[2] = trim($uid);
1416+
if(!empty($gid)) $parts[3] = trim($gid);
1417+
if(trim($home) != '') $parts[5] = trim($home);
1418+
if(trim($shell) != '') $parts[6] = trim($shell);
1419+
$new_line = implode(':',$parts);
1420+
copy('/etc/passwd','/etc/passwd~');
1421+
chmod('/etc/passwd~',0600);
1422+
$app->uses('system');
1423+
$app->system->replaceLine('/etc/passwd',$line,$new_line,1,0);
1424+
}
1425+
}
1426+
unset($passwd_file_array);
1427+
}
1428+
1429+
//* If username != login, change username in group and gshadow file
1430+
if($username != $login) {
1431+
$group_file_array = file('/etc/group');
1432+
if(is_array($group_file_array)) {
1433+
foreach($group_file_array as $line) {
1434+
$line = trim($line);
1435+
$parts = explode(':',$line);
1436+
if(strstr($parts[3],$username)) {
1437+
$uparts = explode(',',$parts[3]);
1438+
if(is_array($uparts)) {
1439+
foreach($uparts as $key => $val) {
1440+
if($val == $username) $uparts[$key] = $login;
1441+
}
1442+
}
1443+
$parts[3] = implode(',',$uparts);
1444+
$new_line = implode(':',$parts);
1445+
copy('/etc/group','/etc/group~');
1446+
chmod('/etc/group~',0600);
1447+
$app->system->replaceLine('/etc/group',$line,$new_line,1,0);
1448+
}
1449+
}
1450+
}
1451+
unset($group_file_array);
1452+
1453+
$gshadow_file_array = file('/etc/gshadow');
1454+
if(is_array($gshadow_file_array)) {
1455+
foreach($gshadow_file_array as $line) {
1456+
$line = trim($line);
1457+
$parts = explode(':',$line);
1458+
if(strstr($parts[3],$username)) {
1459+
$uparts = explode(',',$parts[3]);
1460+
if(is_array($uparts)) {
1461+
foreach($uparts as $key => $val) {
1462+
if($val == $username) $uparts[$key] = $login;
1463+
}
1464+
}
1465+
$parts[3] = implode(',',$uparts);
1466+
$new_line = implode(':',$parts);
1467+
copy('/etc/gshadow','/etc/gshadow~');
1468+
chmod('/etc/gshadow~',0600);
1469+
$app->system->replaceLine('/etc/gshadow',$line,$new_line,1,0);
1470+
}
1471+
}
1472+
}
1473+
unset($group_file_array);
1474+
}
1475+
1476+
1477+
//* When password or login name has been changed
1478+
if($password != '' || $username != $login) {
1479+
$shadow_file_array = file('/etc/shadow');
1480+
if(is_array($shadow_file_array)) {
1481+
foreach($shadow_file_array as $line) {
1482+
$line = trim($line);
1483+
$parts = explode(':',$line);
1484+
if($parts[0] == $username) {
1485+
if(trim($login) != '' && trim($login) != trim($username)) $parts[0] = trim($login);
1486+
if(trim($password) != '') $parts[1] = trim($password);
1487+
$new_line = implode(':',$parts);
1488+
copy('/etc/shadow','/etc/shadow~');
1489+
chmod('/etc/shadow~',0600);
1490+
$app->system->replaceLine('/etc/shadow',$line,$new_line,1,0);
1491+
}
1492+
}
1493+
}
1494+
unset($shadow_file_array);
1495+
}
1496+
}
13991497

14001498
}
14011499
?>

‎server/plugins-available/shelluser_base_plugin.inc.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,7 @@ function update($event_name,$data) {
148148
if($uid > $this->min_uid) {
149149
// Check if the user that we want to update exists, if not, we insert it
150150
if($app->system->is_user($data['old']['username'])) {
151+
/*
151152
$command = 'usermod';
152153
$command .= ' --home '.escapeshellcmd($data['new']['dir']);
153154
$command .= ' --gid '.escapeshellcmd($data['new']['pgroup']);
@@ -160,6 +161,9 @@ function update($event_name,$data) {
160161
161162
exec($command);
162163
$app->log("Executed command: $command ",LOGLEVEL_DEBUG);
164+
*/
165+
$groupinfo = posix_getgrnam($data['new']['pgroup']);
166+
$app->system->usermod($data['old']['username'],0, $groupinfo[gid], $data['new']['dir'], $data['new']['shell'], $data['new']['password'], $data['new']['username']);
163167
$app->log("Updated shelluser: ".$data['old']['username'],LOGLEVEL_DEBUG);
164168

165169
// call the ssh-rsa update function

‎server/plugins-available/shelluser_jailkit_plugin.inc.php‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ function insert($event_name,$data) {
7171
global $app, $conf;
7272

7373
$app->uses('system');
74-
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['new']['parent_domain_id']);
74+
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
7575

7676
if($app->system->is_user($data['new']['username'])) {
7777

@@ -97,7 +97,12 @@ function insert($event_name,$data) {
9797
//* call the ssh-rsa update function
9898
$this->_setup_ssh_rsa();
9999

100-
$command .= 'usermod -s /usr/sbin/jk_chrootsh -U '.escapeshellcmd($data['new']['username']);
100+
//$command .= 'usermod -s /usr/sbin/jk_chrootsh -U '.escapeshellcmd($data['new']['username']);
101+
//exec($command);
102+
$app->system->usermod($data['new']['username'], 0, 0, '', '/usr/sbin/jk_chrootsh', '', '');
103+
104+
//* Unlock user
105+
$command = 'usermod -U '.escapeshellcmd($data['new']['username']);
101106
exec($command);
102107

103108
$this->_update_website_security_level();
@@ -117,7 +122,7 @@ function update($event_name,$data) {
117122
global $app, $conf;
118123

119124
$app->uses('system');
120-
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['new']['parent_domain_id']);
125+
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
121126

122127
if($app->system->is_user($data['new']['username'])) {
123128

@@ -164,7 +169,7 @@ function delete($event_name,$data) {
164169

165170
$app->uses('system');
166171

167-
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['old']['parent_domain_id']);
172+
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['old']['parent_domain_id']);
168173

169174
if ($data['old']['chroot'] == "jailkit")
170175
{
@@ -285,6 +290,7 @@ function _add_jailkit_user()
285290
//* Change the homedir of the shell user and parent user
286291
//* We have to do this manually as the usermod command fails
287292
//* when the user is logged in or a command is running under that user
293+
/*
288294
$passwd_file_array = file('/etc/passwd');
289295
$passwd_out = '';
290296
if(is_array($passwd_file_array)) {
@@ -301,8 +307,10 @@ function _add_jailkit_user()
301307
$app->system->replaceLine('/etc/passwd',$line,$new_line,1,0);
302308
}
303309
}
304-
}
310+
}*/
305311

312+
$app->system->usermod($this->data['new']['username'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, '/usr/sbin/jk_chrootsh');
313+
$app->system->usermod($this->data['new']['puser'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, '/usr/sbin/jk_chrootsh');
306314

307315
$this->app->log("Added jailkit user to chroot with command: ".$command,LOGLEVEL_DEBUG);
308316

@@ -333,9 +341,12 @@ function _update_website_security_level() {
333341
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['new']['parent_domain_id']);
334342

335343
//* If the security level is set to high
336-
if($web_config['security_level'] == 20) {
337-
$this->_exec('chmod 755 '.escapeshellcmd($web["document_root"]));
338-
$this->_exec('chown root:root '.escapeshellcmd($web["document_root"]));
344+
if($web_config['security_level'] == 20 && is_array($web)) {
345+
$app->system->web_folder_protection($web["document_root"],false);
346+
$app->system->chmod($web["document_root"],0755);
347+
$app->system->chown($web["document_root"],'root');
348+
$app->system->chgrp($web["document_root"],'root');
349+
$app->system->web_folder_protection($web["document_root"],true);
339350
}
340351

341352
}

‎server/server.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@
148148
unset($tmp_rec);
149149

150150
//** Load required base-classes
151-
$app->uses('modules,plugins,file,services');
151+
$app->uses('modules,plugins,file,services,system');
152152
//** Load the modules that are in the mods-enabled folder
153153
$app->modules->loadModules('all');
154154
//** Load the plugins that are in the plugins-enabled folder

0 commit comments

Comments
 (0)