2 # This script turns a fresh server with password-based root access into
3 # one of only key-based access and only to new non-root account plom.
5 # CAUTION: This is optimized for a *fresh* setup. It will overwrite any
6 # pre-existing ~/.ssh/authorized_keys of user plom with one that solely
7 # contains the local ~/.ssh/id_rsa.pub, and also any old
8 # /etc/ssh/sshd_config.
10 # Dependencies: ssh, scp, ~/.ssh/id_rsa.pub, properly configured sshd_config
11 # file in misc.sh:$linkable_files_dir
16 expect_n_args 1 "(server)" "$@"
19 # If we already knew that host …
20 ssh-keygen -f "/home/plom/.ssh/known_hosts" -R "${server}"
22 # So we're only asked once …
26 # This will be used to log-in as root from plom account.
27 echo 'Asking for new root password.'
28 ssh root@"${server}" "passwd"
30 # Set up plom's ~/.ssh/authorized_keys from root's.
31 ssh root@"${server}" 'useradd -m plom'
32 ssh root@"${server}" 'mkdir /home/plom/.ssh'
33 ssh root@"${server}" 'chown plom:plom /home/plom/.ssh'
34 ssh root@"${server}" 'cp /root/.ssh/authorized_keys /home/plom/.ssh/'
35 ssh root@"${server}" 'chown plom:plom /home/plom/.ssh/authorized_keys'
37 # Set up SSH config and remove direct SSH login to root.
38 scp "${local_path_sshd_config}" root@"${server}":"${system_path_sshd_config}"
39 ssh root@"${server}" 'rm -rf /root/.ssh && service ssh restart'