[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6a7e6b4499115e52cc6ec1abb799f6a7d14d2168

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6a7e6b4499115e52cc6ec1abb799f6a7d14d2168

[git]

[-- Attachment #1: Type: text/plain, Size: 3801 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  6a7e6b4499115e52cc6ec1abb799f6a7d14d2168 (commit)
       via  87d7fc6609277c4e6521265b6f008311291c1890 (commit)
       via  53eb49180e16e1cc740695bb9cdb381becfd59a1 (commit)
       via  e2d9fe7e166dc3dbf50d5d2cfe27b0d9abcb9f45 (commit)
      from  0927eadc529ac50730b0a28e567c09a51e0d4083 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6a7e6b4499115e52cc6ec1abb799f6a7d14d2168
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Sat Jul 14 15:06:39 2018 +0100

    AWS: Give setup user permissions to read its own SSH keys
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit 87d7fc6609277c4e6521265b6f008311291c1890
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Jul 12 15:37:59 2018 +0100

    aws: Unlock setup account
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit 53eb49180e16e1cc740695bb9cdb381becfd59a1
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Jul 12 13:57:19 2018 +0100

    aws: Install SSH keys only for setup user
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit e2d9fe7e166dc3dbf50d5d2cfe27b0d9abcb9f45
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Jul 12 13:55:38 2018 +0100

    aws: setup user should not be a system user
    
    Login is not permitted for system users
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 src/initscripts/helper/aws-setup | 36 +++++++++++++++++++-----------------
 1 file changed, 19 insertions(+), 17 deletions(-)

Difference in files:
diff --git a/src/initscripts/helper/aws-setup b/src/initscripts/helper/aws-setup
index a273aff7d..d8c7a358c 100644
--- a/src/initscripts/helper/aws-setup
+++ b/src/initscripts/helper/aws-setup
@@ -86,25 +86,27 @@ import_aws_configuration() {
 
 	# Create setup user
 	if ! getent passwd setup &>/dev/null; then
-		useradd -r setup -s /usr/bin/run-setup -g nobody -m
+		useradd setup -s /usr/bin/run-setup -g nobody -m
+
+		# Unlock the account
+		usermod -p "x" setup
 	fi
 
-	# Import SSH keys
-	local user
-	for user in /root /home/setup; do
-		local line
-		for line in $(get "public-keys/"); do
-			local key_no="${line%=*}"
-
-			local key="$(get public-keys/${key_no}/openssh-key)"
-			if [ -n "${key}" ] && ! grep -q "^${key}$" "${user}/.ssh/authorized_keys" 2>/dev/null; then
-				mkdir -p "${user}/.ssh"
-				chmod 700 "${user}/.ssh"
-
-				echo "${key}" >> "${user}/.ssh/authorized_keys"
-				chmod 600 "${user}/.ssh/authorized_keys"
-			fi
-		done
+	# Import SSH keys for setup user
+	local line
+	for line in $(get "public-keys/"); do
+		local key_no="${line%=*}"
+
+		local key="$(get public-keys/${key_no}/openssh-key)"
+		if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev/null; then
+			mkdir -p "/home/setup/.ssh"
+			chmod 700 "/home/setup/.ssh"
+			chown setup.nobody "/home/setup/.ssh"
+
+			echo "${key}" >> "/home/setup/.ssh/authorized_keys"
+			chmod 600 "/home/setup/.ssh/authorized_keys"
+			chown setup.nobody "/home/setup/.ssh/authorized_keys"
+		fi
 	done
 
 	# Import any DNS server settings


hooks/post-receive
--
IPFire 2.x development tree