Skip to content

Commit 54c3c73

Browse files
LupulLupul
committed
SecImprov: File operations in user home folder will be executed as the real user
1 parent 0298214 commit 54c3c73

File tree

5 files changed

+71
-78
lines changed

5 files changed

+71
-78
lines changed

‎bin/v-add-web-domain‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ is_object_valid 'user' 'USER' "$user"
4646
is_object_unsuspended 'user' 'USER' "$user"
4747
is_package_full 'WEB_DOMAINS' 'WEB_ALIASES'
4848
is_domain_new 'web' "$domain,$aliases"
49-
is_dir_symlink $HOMEDIR/$user/web
49+
is_dir_symlink "$HOMEDIR/$user/web"
50+
is_dir_symlink "$HOMEDIR/$user/web/$domain"
5051
if [ ! -z "$ip" ]; then
5152
is_ip_valid "$ip" "$user"
5253
else
@@ -65,14 +66,14 @@ check_hestia_demo_mode
6566
source $USER_DATA/user.conf
6667

6768
# Creating domain directories
68-
mkdir -p $HOMEDIR/$user/web/$domain \
69-
$HOMEDIR/$user/web/$domain/public_html \
70-
$HOMEDIR/$user/web/$domain/public_shtml \
71-
$HOMEDIR/$user/web/$domain/document_errors \
72-
$HOMEDIR/$user/web/$domain/cgi-bin \
73-
$HOMEDIR/$user/web/$domain/private \
74-
$HOMEDIR/$user/web/$domain/stats \
75-
$HOMEDIR/$user/web/$domain/logs
69+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain"
70+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/public_html"
71+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/public_shtml"
72+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/document_errors"
73+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/cgi-bin"
74+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/private"
75+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/stats"
76+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/logs"
7677

7778
# Creating domain logs
7879
touch /var/log/$WEB_SYSTEM/domains/$domain.bytes \
@@ -82,7 +83,7 @@ ln -f -s /var/log/$WEB_SYSTEM/domains/$domain.*log \
8283
$HOMEDIR/$user/web/$domain/logs/
8384

8485
# Adding domain skeleton
85-
cp -r $WEBTPL/skel/* $HOMEDIR/$user/web/$domain/ >/dev/null 2>&1
86+
sudo -u $user -- cp -r $WEBTPL/skel/* "$HOMEDIR/$user/web/$domain/" >/dev/null 2>&1
8687
for file in $(find "$HOMEDIR/$user/web/$domain/" -type f); do
8788
sed -i "s/%domain%/$domain/g" $file
8889
done

‎bin/v-add-web-domain-ftp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ else
7777
fi
7878
# Creating ftp user home directory
7979
if [ ! -e "$ftp_path_a" ]; then
80-
mkdir -p $ftp_path_a
80+
$BIN/v-add-fs-directory "$user" "$ftp_path_a"
8181
chown $user:$user "$ftp_path_a"
8282
chmod 751 "$ftp_path_a"
8383
fi

‎bin/v-change-web-domain-ftp-path‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ check_hestia_demo_mode
6161

6262
# MKDIR if path doesn't exist
6363
if [ ! -e "$ftp_path_a" ]; then
64-
mkdir -p "$ftp_path_a"
64+
$BIN/v-add-fs-directory "$user" "$ftp_path_a"
6565
chown $user:$user "$ftp_path_a"
6666
chmod 751 "$ftp_path_a"
6767
fi

‎bin/v-restore-user‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -230,7 +230,7 @@ fi
230230
backup_system="hestia"
231231

232232
# Check if it is a Vesta backup
233-
if tar -tf $BACKUP/$backup ./vesta >/dev/null 2>&1; then
233+
if tar -tf "$BACKUP/$backup" ./vesta >/dev/null 2>&1; then
234234
backup_system="vesta"
235235
fi
236236

@@ -240,7 +240,7 @@ if [ "$create_user" = 'yes' ]; then
240240
echo -e "$(date "+%F %T") $user" |tee -a $tmpdir/restore.log
241241

242242
# Unpacking user container
243-
tar xf $BACKUP/$backup -C $tmpdir ./$backup_system 2>/dev/null
243+
tar xf "$BACKUP/$backup" -C "$tmpdir" --no-wildcards "./$backup_system" 2>/dev/null
244244
if [ "$?" -ne 0 ]; then
245245
rm -rf $tmpdir
246246
echo "Can't unpack user container" |$SENDMAIL -s "$subj" $email $notify
@@ -259,6 +259,7 @@ if [ "$create_user" = 'yes' ]; then
259259
fi
260260

261261
# Unpacking pam container
262+
chown "$user" "$tmpdir"
262263
tar xf $BACKUP/$backup -C $tmpdir ./pam
263264
if [ "$?" -ne 0 ]; then
264265
rm -rf $tmpdir
@@ -402,8 +403,10 @@ if [ "$web" != 'no' ] && [ ! -z "$WEB_SYSTEM" ]; then
402403
if [ -d "$HOMEDIR/$user/web/$domain/public_html" ]; then
403404
rm -rf $HOMEDIR/$user/web/$domain/public_html/*
404405
fi
405-
tar -xzpf $tmpdir/web/$domain/domain_data.tar.gz \
406-
-C $HOMEDIR/$user/web/$domain/
406+
chmod u+w "$HOMEDIR/$user/web/$domain"
407+
sudo -u $user -- tar -xzpf $tmpdir/web/$domain/domain_data.tar.gz \
408+
-C "$HOMEDIR/$user/web/$domain/" \
409+
--exclude='logs/*'
407410
if [ "$?" -ne 0 ]; then
408411
rm -rf $tmpdir
409412
error="Can't unpack $domain data tarball"
@@ -595,8 +598,8 @@ if [ "$mail" != 'no' ] && [ ! -z "$MAIL_SYSTEM" ]; then
595598

596599
# Restoring emails
597600
if [ -e "$tmpdir/mail/$domain/accounts.tar.gz" ]; then
598-
tar -xzpf $tmpdir/mail/$domain/accounts.tar.gz \
599-
-C $HOMEDIR/$user/mail/$domain_idn/
601+
chmod u+w "$HOMEDIR/$user/mail/$domain_idn"
602+
$BIN/v-extract-fs-archive "$user" "$tmpdir/mail/$domain/accounts.tar.gz" "$HOMEDIR/$user/mail/$domain_idn/"
600603
if [ "$?" -ne 0 ]; then
601604
rm -rf $tmpdir
602605
error="Can't unpack $domain mail account container"
@@ -746,15 +749,15 @@ if [ "$udir" != 'no' ]; then
746749

747750
for user_dir in $user_dirs; do
748751
echo -e "$(date "+%F %T") $user_dir" |tee -a $tmpdir/restore.log
749-
tar xf $BACKUP/$backup -C $tmpdir ./user_dir/$user_dir.tar.gz
752+
tar xf "$BACKUP/$backup" -C "$tmpdir" --no-wildcards "./user_dir/$user_dir.tar.gz"
750753
if [ "$?" -ne 0 ]; then
751754
error="Can't unpack $user_dir user dir container"
752755
echo "$error" |$SENDMAIL -s "$subj" $email $notify
753756
sed -i "/ $user /d" $HESTIA/data/queue/backup.pipe
754757
check_result "$E_PARSING" "$error"
755758
fi
756759

757-
tar xzf $tmpdir/user_dir/$user_dir.tar.gz -C $HOMEDIR/$user
760+
$BIN/v-extract-fs-archive "$user" "$tmpdir/user_dir/$user_dir.tar.gz" "$HOMEDIR/$user"
758761
if [ "$?" -ne 0 ]; then
759762
error="Can't unpack $user_dir user dir container"
760763
echo "$error" |$SENDMAIL -s "$subj" $email $notify

‎func/rebuild.sh‎

Lines changed: 47 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -24,24 +24,26 @@ rebuild_user_conf() {
2424
/usr/sbin/useradd "$user" -s "$shell" -c "$CONTACT" \
2525
-m -d "$HOMEDIR/$user" > /dev/null 2>&1
2626

27+
# Add a general group for normal users created by Hestia
28+
if [ -z "$(grep "^hestia-users:" /etc/group)" ]; then
29+
groupadd --system "hestia-users"
30+
fi
31+
32+
# Add membership to hestia-users group to non-admin users
33+
if [ "$user" = "admin" ]; then
34+
setfacl -m "g:admin:r-x" "$HOMEDIR/$user"
35+
else
36+
usermod -a -G "hestia-users" "$user"
37+
setfacl -m "u:$user:r-x" "$HOMEDIR/$user"
38+
fi
39+
setfacl -m "g:hestia-users:---" "$HOMEDIR/$user"
40+
2741
# Update user shell
2842
/usr/bin/chsh -s "$shell" "$user" &>/dev/null
2943

3044
# Update password
31-
shadow=$(grep ^$user: /etc/shadow)
32-
shdw3=$(echo "$shadow" | cut -f3 -d :)
33-
shdw4=$(echo "$shadow" | cut -f4 -d :)
34-
shdw5=$(echo "$shadow" | cut -f5 -d :)
35-
shdw6=$(echo "$shadow" | cut -f6 -d :)
36-
shdw7=$(echo "$shadow" | cut -f7 -d :)
37-
shdw8=$(echo "$shadow" | cut -f8 -d :)
38-
shdw9=$(echo "$shadow" | cut -f9 -d :)
39-
shadow_str="$user:$MD5:$shdw3:$shdw4:$shdw5:$shdw6"
40-
shadow_str="$shadow_str:$shdw7:$shdw8:$shdw9"
41-
4245
chmod u+w /etc/shadow
43-
sed -i "/^$user:*/d" /etc/shadow
44-
echo "$shadow_str" >> /etc/shadow
46+
sed -i 's/^$user:[^:]*:/$user:$MD5:/' /etc/shadow
4547
chmod u-w /etc/shadow
4648

4749
# Building directory tree
@@ -169,17 +171,17 @@ rebuild_web_domain_conf() {
169171

170172
# Rebuilding domain directories
171173
if [ -d "$HOMEDIR/$user/web/$domain/document_errors" ]; then
172-
rm -rf "$HOMEDIR/$user/web/$domain/document_errors"
174+
$BIN/v-delete-fs-directory "$user" "$HOMEDIR/$user/web/$domain/document_errors"
173175
fi
174176

175-
mkdir -p $HOMEDIR/$user/web/$domain \
176-
$HOMEDIR/$user/web/$domain/public_html \
177-
$HOMEDIR/$user/web/$domain/public_shtml \
178-
$HOMEDIR/$user/web/$domain/document_errors \
179-
$HOMEDIR/$user/web/$domain/cgi-bin \
180-
$HOMEDIR/$user/web/$domain/private \
181-
$HOMEDIR/$user/web/$domain/stats \
182-
$HOMEDIR/$user/web/$domain/logs
177+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain"
178+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/public_html"
179+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/public_shtml"
180+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/document_errors"
181+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/cgi-bin"
182+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/private"
183+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/stats"
184+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/web/$domain/logs"
183185

184186
# Creating domain logs
185187
if [ ! -e "/var/log/$WEB_SYSTEM/domains" ]; then
@@ -198,22 +200,23 @@ rebuild_web_domain_conf() {
198200

199201
# Propagating html skeleton
200202
if [ -d "$WEBTPL/skel/document_errors/" ]; then
201-
cp -r $WEBTPL/skel/document_errors/ $HOMEDIR/$user/web/$domain/
203+
sudo -u $user -- cp -r "$WEBTPL/skel/document_errors/" "$HOMEDIR/$user/web/$domain/"
202204
fi
203205

204206
# Set folder permissions
205-
chmod 551 $HOMEDIR/$user/web/$domain \
206-
$HOMEDIR/$user/web/$domain/stats \
207-
$HOMEDIR/$user/web/$domain/logs
208-
chmod 751 $HOMEDIR/$user/web/$domain/private \
209-
$HOMEDIR/$user/web/$domain/cgi-bin \
210-
$HOMEDIR/$user/web/$domain/public_html \
211-
$HOMEDIR/$user/web/$domain/public_shtml \
212-
$HOMEDIR/$user/web/$domain/document_errors
207+
chmod 551 $HOMEDIR/$user/web/$domain \
208+
$HOMEDIR/$user/web/$domain/stats \
209+
$HOMEDIR/$user/web/$domain/logs
210+
chmod 751 $HOMEDIR/$user/web/$domain/private \
211+
$HOMEDIR/$user/web/$domain/cgi-bin \
212+
$HOMEDIR/$user/web/$domain/public_html \
213+
$HOMEDIR/$user/web/$domain/public_shtml \
214+
$HOMEDIR/$user/web/$domain/document_errors
213215
chmod 640 /var/log/$WEB_SYSTEM/domains/$domain.*
214216

215217
# Set ownership
216-
chown $user:$user $HOMEDIR/$user/web/$domain \
218+
chown $user:$user \
219+
$HOMEDIR/$user/web/$domain \
217220
$HOMEDIR/$user/web/$domain/private \
218221
$HOMEDIR/$user/web/$domain/cgi-bin \
219222
$HOMEDIR/$user/web/$domain/public_html \
@@ -285,16 +288,15 @@ rebuild_web_domain_conf() {
285288
if [ ! -z "$STATS_USER" ]; then
286289
stats_dir="$HOMEDIR/$user/web/$domain/stats"
287290
if [ "$WEB_SYSTEM" = 'nginx' ]; then
288-
echo "auth_basic \"Web Statistics\";" > $stats_dir/auth.conf
289-
echo "auth_basic_user_file $stats_dir/.htpasswd;" >> \
290-
$stats_dir/auth.conf
291+
echo "auth_basic \"Web Statistics\";" |sudo -u $user -- tee $stats_dir/auth.conf
292+
echo "auth_basic_user_file $stats_dir/.htpasswd;" |sudo -u $user -- tee -a $stats_dir/auth.conf
291293
else
292-
echo "AuthUserFile $stats_dir/.htpasswd" > $stats_dir/.htaccess
293-
echo "AuthName \"Web Statistics\"" >> $stats_dir/.htaccess
294-
echo "AuthType Basic" >> $stats_dir/.htaccess
295-
echo "Require valid-user" >> $stats_dir/.htaccess
294+
echo "AuthUserFile $stats_dir/.htpasswd" |sudo -u $user -- tee $stats_dir/.htaccess
295+
echo "AuthName \"Web Statistics\"" |sudo -u $user -- tee -a $stats_dir/.htaccess
296+
echo "AuthType Basic" |sudo -u $user -- tee -a $stats_dir/.htaccess
297+
echo "Require valid-user" |sudo -u $user -- tee -a $stats_dir/.htaccess
296298
fi
297-
echo "$STATS_USER:$STATS_CRYPT" > $stats_dir/.htpasswd
299+
echo "$STATS_USER:$STATS_CRYPT" |sudo -u $user -- tee $stats_dir/.htpasswd
298300
fi
299301
fi
300302

@@ -316,26 +318,13 @@ rebuild_web_domain_conf() {
316318
ftp_md5=$(echo $FTP_MD5 | tr ':' '\n' |grep -n '' |\
317319
grep "^$position:" |cut -f 2 -d :)
318320

319-
/usr/sbin/useradd $ftp_user \
320-
-s $shell \
321-
-o -u $(id -u $user) \
322-
-g $(id -u $user) \
323-
-M -d "$HOMEDIR/$user/web/$domain${ftp_path}" >/dev/null 2>&1
321+
# rebuild S/FTP users
322+
$BIN/v-delete-web-domain-ftp "$user" "$domain" "$ftp_user"
323+
$BIN/v-add-web-domain-ftp "$user" "$domain" "${ftp_user#*_}" "!xplaceholder$FTP_MD5" "$ftp_path"
324324

325325
# Updating ftp user password
326-
shadow=$(grep "^$ftp_user:" /etc/shadow)
327-
shdw3=$(echo "$shadow" |cut -f3 -d :)
328-
shdw4=$(echo "$shadow" |cut -f4 -d :)
329-
shdw5=$(echo "$shadow" |cut -f5 -d :)
330-
shdw6=$(echo "$shadow" |cut -f6 -d :)
331-
shdw7=$(echo "$shadow" |cut -f7 -d :)
332-
shdw8=$(echo "$shadow" |cut -f8 -d :)
333-
shdw9=$(echo "$shadow" |cut -f9 -d :)
334-
shadow_str="$ftp_user:$ftp_md5:$shdw3:$shdw4:$shdw5:$shdw6"
335-
shadow_str="$shadow_str:$shdw7:$shdw8:$shdw9"
336326
chmod u+w /etc/shadow
337-
sed -i "/^$ftp_user:*/d" /etc/shadow
338-
echo "$shadow_str" >> /etc/shadow
327+
sed -i 's/^$ftp_user:[^:]*:/$ftp_user:$ftp_md5:/' /etc/shadow
339328
chmod u-w /etc/shadow
340329
fi
341330
done
@@ -500,7 +489,7 @@ rebuild_mail_domain_conf() {
500489

501490
# Adding mail directiry
502491
if [ ! -e $HOMEDIR/$user/mail/$domain_idn ]; then
503-
mkdir $HOMEDIR/$user/mail/$domain_idn
492+
$BIN/v-add-fs-directory "$user" "$HOMEDIR/$user/mail/$domain_idn"
504493
fi
505494

506495
# Adding catchall email

0 commit comments

Comments
 (0)