This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 6a7e6b4499115e52cc6ec1abb799f6a7d14d2168 (commit) via 87d7fc6609277c4e6521265b6f008311291c1890 (commit) via 53eb49180e16e1cc740695bb9cdb381becfd59a1 (commit) via e2d9fe7e166dc3dbf50d5d2cfe27b0d9abcb9f45 (commit) from 0927eadc529ac50730b0a28e567c09a51e0d4083 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 6a7e6b4499115e52cc6ec1abb799f6a7d14d2168 Author: Michael Tremer michael.tremer@ipfire.org Date: Sat Jul 14 15:06:39 2018 +0100

AWS: Give setup user permissions to read its own SSH keys

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 87d7fc6609277c4e6521265b6f008311291c1890 Author: Michael Tremer michael.tremer@ipfire.org Date: Thu Jul 12 15:37:59 2018 +0100

aws: Unlock setup account

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 53eb49180e16e1cc740695bb9cdb381becfd59a1 Author: Michael Tremer michael.tremer@ipfire.org Date: Thu Jul 12 13:57:19 2018 +0100

aws: Install SSH keys only for setup user

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit e2d9fe7e166dc3dbf50d5d2cfe27b0d9abcb9f45 Author: Michael Tremer michael.tremer@ipfire.org Date: Thu Jul 12 13:55:38 2018 +0100

aws: setup user should not be a system user

Login is not permitted for system users

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: src/initscripts/helper/aws-setup | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-)

Difference in files: diff --git a/src/initscripts/helper/aws-setup b/src/initscripts/helper/aws-setup index a273aff7d..d8c7a358c 100644 --- a/src/initscripts/helper/aws-setup +++ b/src/initscripts/helper/aws-setup @@ -86,25 +86,27 @@ import_aws_configuration() {

# Create setup user if ! getent passwd setup &>/dev/null; then - useradd -r setup -s /usr/bin/run-setup -g nobody -m + useradd setup -s /usr/bin/run-setup -g nobody -m + + # Unlock the account + usermod -p "x" setup fi

- # Import SSH keys - local user - for user in /root /home/setup; do - local line - for line in $(get "public-keys/"); do - local key_no="${line%=*}" - - local key="$(get public-keys/${key_no}/openssh-key)" - if [ -n "${key}" ] && ! grep -q "^${key}$" "${user}/.ssh/authorized_keys" 2>/dev/null; then - mkdir -p "${user}/.ssh" - chmod 700 "${user}/.ssh" - - echo "${key}" >> "${user}/.ssh/authorized_keys" - chmod 600 "${user}/.ssh/authorized_keys" - fi - done + # Import SSH keys for setup user + local line + for line in $(get "public-keys/"); do + local key_no="${line%=*}" + + local key="$(get public-keys/${key_no}/openssh-key)" + if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev/null; then + mkdir -p "/home/setup/.ssh" + chmod 700 "/home/setup/.ssh" + chown setup.nobody "/home/setup/.ssh" + + echo "${key}" >> "/home/setup/.ssh/authorized_keys" + chmod 600 "/home/setup/.ssh/authorized_keys" + chown setup.nobody "/home/setup/.ssh/authorized_keys" + fi done

# Import any DNS server settings

hooks/post-receive -- IPFire 2.x development tree