From d103ebe98568db9109156544da6fbc508627426f Mon Sep 17 00:00:00 2001 From: Christian Heller Date: Fri, 25 Oct 2024 04:19:48 +0200 Subject: [PATCH] Various fixes. --- constants.sh | 2 + many_releases/etc/raspi/etc/ssh/sshd_config | 123 ++++++++++++++++++++ many_releases/scripts/_misc.sh | 5 +- testing/scripts/setup_raspi.sh | 9 +- 4 files changed, 133 insertions(+), 6 deletions(-) create mode 100644 many_releases/etc/raspi/etc/ssh/sshd_config diff --git a/constants.sh b/constants.sh index 015b654..da69cca 100755 --- a/constants.sh +++ b/constants.sh @@ -1,8 +1,10 @@ #!/bin/sh set -e +set -x PATH_REL_ETC="/etc" PATH_REL_APTMARK="/aptmark" PATH_REL_REPO="/config" +PATH_REL_HOME="/home" PATH_REPO="${HOME}${PATH_REL_REPO}" PATH_MANY="${PATH_REPO}/many_releases" PATH_MANY_MISC="${PATH_MANY}/scripts/_misc.sh" diff --git a/many_releases/etc/raspi/etc/ssh/sshd_config b/many_releases/etc/raspi/etc/ssh/sshd_config new file mode 100644 index 0000000..e952cb3 --- /dev/null +++ b/many_releases/etc/raspi/etc/ssh/sshd_config @@ -0,0 +1,123 @@ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +Include /etc/ssh/sshd_config.d/*.conf + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +PermitRootLogin no # plomlompom's security rule +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +KbdInteractiveAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +PrintMotd no +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +ClientAliveInterval 15 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/many_releases/scripts/_misc.sh b/many_releases/scripts/_misc.sh index a1bf381..b3b2172 100755 --- a/many_releases/scripts/_misc.sh +++ b/many_releases/scripts/_misc.sh @@ -1,5 +1,6 @@ #!/bin/sh set -e +set -x export DEBIAN_FRONTEND=noninteractive @@ -28,7 +29,7 @@ copy_dirtree() { shift 2 modules="$@" initial_directory="$(pwd)" - for module in "${modules}"; do + for module in ${modules}; do mkdir -p "${source_root}/${module}" cd "${source_root}/${module}" for path in $(find . -type f); do @@ -52,7 +53,7 @@ install_for_modules() { apt_mark_dir="$1" shift 1 modules="$@" - for module in "${modules}"; do + for module in ${modules}; do path="${apt_mark_dir}/${module}" if [ ! -f "${path}" ]; then continue diff --git a/testing/scripts/setup_raspi.sh b/testing/scripts/setup_raspi.sh index 75c625f..d9469ae 100755 --- a/testing/scripts/setup_raspi.sh +++ b/testing/scripts/setup_raspi.sh @@ -1,8 +1,11 @@ #!/bin/sh set -e -. ./../constants.sh +set -x +. ../../constants.sh . "${PATH_MANY_MISC}" +# get a proper IP address +dhclient # ensure we can log in # (alternatively, or preceding this to reduce non-remote typing, TEMPORARILY # (!) set password login:) @@ -27,8 +30,6 @@ for root in "${PATH_MANY}" '..'; do done apt -y --purge autoremove -# TODO test if isc-dhcp-client necessary (ifupdown certainly is) - # Ensure our desired locale is available. locale-gen @@ -37,7 +38,7 @@ ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime # Set up users and their environments. for root in "${PATH_MANY}" '..'; do - copy_dirtree "${root}/${NAME_HOME_DIR}" '/root' all root + copy_dirtree "${root}${PATH_REL_HOME}" '/root' all root done adduser --disabled-password --gecos "" "${USERNAME}" usermod -a -G sudo "${USERNAME}" -- 2.30.2