wcp/bin/v-add-sys-sftp-jail at ccd181ab4116c213a40d72aef75c10ab9c150c99 · ghzhost/wcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
#!/bin/bash
# info: add system sftp jail
# options: [RESTART]
# labels:
#
# example: v-add-sys-sftp-jail yes
#
# The script enables sftp jailed environment


#----------------------------------------------------------#
#                    Variable&Function                     #
#----------------------------------------------------------#

# Includes
source /etc/profile
source $HESTIA/func/main.sh
source $HESTIA/conf/hestia.conf

restart=$1

#----------------------------------------------------------#
#                    Verifications                         #
#----------------------------------------------------------#

# Perform verification if read-only mode is enabled
check_hestia_demo_mode

#----------------------------------------------------------#
#                       Action                             #
#----------------------------------------------------------#

# Checking sshd directives
config='/etc/ssh/sshd_config'
sftp_n=$(grep -n "Subsystem.*sftp" $config |grep -v internal |grep -v ":#")
sftp_i=$(grep -n "^# Hestia SFTP Chroot" $config)

# Disabling normal sftp
if [ ! -z "$sftp_n" ]; then
    fline=$(echo $sftp_n |cut -f 1 -d :)
    sed -i "${fline}s/Subsystem.*sftp/#Subsystem sftp/" $config
    restart='yes'
fi

# Enabling jailed sftp
if [ -z "$sftp_i" ]; then
    echo " " >> $config
    echo "# Hestia SFTP Chroot" >> $config
    echo "Match User sftp_dummy99" >> $config
    echo "ChrootDirectory %h" >> $config
    echo "    X11Forwarding no" >> $config
    echo "    AllowTCPForwarding no" >> $config
    echo "    ForceCommand internal-sftp" >> $config
    restart='yes'
fi

# Validating opensshd config
if [ "$restart" = 'yes' ]; then
    subj="OpenSSH restart failed"
    email=$(grep CONTACT $HESTIA/data/users/admin/user.conf |cut -f 2 -d \')
    /usr/sbin/sshd -t >/dev/null 2>&1
    if [ "$?" -ne 0 ]; then
        mail_text="OpenSSH can not be restarted. Please check config:
            \n\n$(/usr/sbin/sshd -t)"
        echo -e "$mail_text" |$SENDMAIL -s "$subj" $email
    else
        service ssh restart >/dev/null 2>&1
    fi
fi

# Checking users
shells="rssh|nologin"
for user in $(grep "$HOMEDIR" /etc/passwd |egrep "$shells" |cut -f 1 -d:); do
    $BIN/v-add-user-sftp-jail $user $restart
done

# Add v-add-sys-sftp-jail to startup
if [ ! -e "/etc/cron.d/hestia-sftp" ]; then
    echo "@reboot root sleep 60 && /usr/local/hestia/bin/v-add-sys-sftp-jail" > /etc/cron.d/hestia-sftp
fi

#----------------------------------------------------------#
#                       Hestia                             #
#----------------------------------------------------------#

# Logging
log_event "$OK" "$ARGUMENTS"

exit