X-Git-Url: http://git.grml.org/?p=grml-scripts-core.git;a=blobdiff_plain;f=usr_sbin%2Fmake_chroot_jail;h=036d7a75e91c162aaf367a643f7f08e77cdcb923;hp=30a8b887bc06f6c7018d91a3450fd74a07e3bb86;hb=9fef74081f53d30174118872324fa62d4a8145b5;hpb=03fcacf4cdf6ed30709d2639436870f906b8f1c9 diff --git a/usr_sbin/make_chroot_jail b/usr_sbin/make_chroot_jail index 30a8b88..036d7a7 100755 --- a/usr_sbin/make_chroot_jail +++ b/usr_sbin/make_chroot_jail @@ -21,7 +21,7 @@ # # Feedback is welcome! # -# Thanks for Bugfixes / Enhancements to +# Thanks for Bugfixes / Enhancements to # Michael Prokop , # Randy K., Randy D. and Jonathan Hunter. @@ -57,7 +57,7 @@ if [ -z "$1" ] ; then fi echo "Am I root? " -if [ "$(whoami &2>/dev/null)" != "root" ] && [ "$(id -un &2>/dev/null)" != "root" ] ; then +if [ "$(whoami 2>/dev/null)" != "root" ] && [ "$(id -un 2>/dev/null)" != "root" ] ; then echo " NO! Error: You must be root to run this script." @@ -101,7 +101,7 @@ else fi # Check existence of necessary files -echo "Checking for which... " +echo "Checking for which... " if ( test -f /usr/bin/which ) || ( test -f /bin/which ) || ( test -f /sbin/which ) || ( test -f /usr/sbin/which ); then echo " OK"; else echo " failed @@ -111,7 +111,7 @@ Please install which-binary! exit 1 fi -echo "Checking for chroot..." +echo "Checking for chroot..." if [ `which chroot` ]; then echo " OK"; else echo " failed @@ -122,10 +122,10 @@ Please install chroot-package/binary! exit 1 fi -echo "Checking for sudo..." +echo "Checking for sudo..." if [ `which sudo` ]; then echo " OK"; -else +else echo " failed sudo not found! @@ -134,10 +134,10 @@ Please install sudo-package/binary! exit 1 fi -echo "Checking for dirname..." +echo "Checking for dirname..." if [ `which dirname` ]; then echo " OK"; -else +else echo " failed dirname not found! @@ -146,11 +146,11 @@ Please install dirname-binary (to be found eg in the package coreutils)! exit 1 fi -echo "Checking for awk..." +echo "Checking for awk..." if [ `which awk` ]; then echo " OK "; -else +else echo " failed awk not found! @@ -164,20 +164,20 @@ fi # (uncommented) line with sftp-server filename. If neither exists, just skip # this step and continue without sftp-server # -if (test ! -f /etc/ssh/sshd_config &> /dev/null); then +if (test ! -f /etc/ssh/sshd_config >/dev/null 2>&1); then echo " File /etc/ssh/sshd_config not found. Not checking for path to sftp-server. "; else - if !(grep -v "^#" /etc/ssh/sshd_config | grep -i sftp-server &> /dev/null); then + if !(grep -v "^#" /etc/ssh/sshd_config | grep -i sftp-server >/dev/null 2&1); then echo "Obviously no sftp-server is running on this system. "; else SFTP_SERVER=$(grep -v "^#" /etc/ssh/sshd_config | grep -i sftp-server | awk '{ print $3}') fi fi -#if !(grep -v "^#" /etc/ssh/sshd_config | grep -i sftp-server /etc/ssh/sshd_config | awk '{ print $3}' &> /dev/null); then +#if !(grep -v "^#" /etc/ssh/sshd_config | grep -i sftp-server /etc/ssh/sshd_config | awk '{ print $3}' >/dev/null 2&1); then APPS="$APPS $SFTP_SERVER" # Get accountname to create @@ -200,13 +200,14 @@ fi if ( id $CHROOT_USERNAME > /dev/null 2>&1 ) ; then { echo " ----------------------------- -User $CHROOT_USERNAME exists. +User $CHROOT_USERNAME exists. Are you sure you want to modify the users home directory and lock him into the chroot directory? Are you REALLY sure? -Say only yes if you absolutely know what you are doing!" - read -p "(yes/no) -> " MODIFYUSER +Say only yes if you absolutely know what you are doing! +(yes/no) -> " + read MODIFYUSER if [ "$MODIFYUSER" != "yes" ]; then echo " Not entered yes. Exiting...." @@ -221,13 +222,14 @@ fi if [ -f ${SHELL} ] ; then echo " ----------------------------- -The file $SHELL exists. +The file $SHELL exists. Probably it was created by this script. Are you sure you want to overwrite it? (you want to say yes for example if you are running the script for the second -time when adding more than one account to the jail)" -read -p "(yes/no) -> " OVERWRITE +time when adding more than one account to the jail) +(yes/no) -> " +read OVERWRITE if [ "$OVERWRITE" != "yes" ]; then echo " Not entered yes. Exiting...." @@ -270,7 +272,7 @@ echo [ -r $JAILPATH/dev/urandom ] || mknod $JAILPATH/dev/urandom c 1 9 [ -r $JAILPATH/dev/null ] || mknod -m 666 $JAILPATH/dev/null c 1 3 [ -r $JAILPATH/dev/zero ] || mknod -m 666 $JAILPATH/dev/zero c 1 5 -[ -r $JAILPATH/dev/tty ] || mknod -m 666 $JAILPATH/dev/tty c 5 0 +[ -r $JAILPATH/dev/tty ] || mknod -m 666 $JAILPATH/dev/tty c 5 0 # if we only want to update the files in the jail # skip the creation of the new account @@ -288,7 +290,7 @@ HOMEDIR="$JAILPATH/home/$CHROOT_USERNAME" # $HOME to $JAILPATH/home/* if [ "$CREATEUSER" != "yes" ] ; then echo " Not creating new User account -Modifying User \"$CHROOT_USERNAME\" +Modifying User \"$CHROOT_USERNAME\" Copying files in $CHROOT_USERNAME's \$HOME to \"$HOMEDIR\" " usermod -d "$HOMEDIR" -m -s "$SHELL" $CHROOT_USERNAME && chmod 700 "$HOMEDIR" @@ -328,7 +330,7 @@ if [ ! -f etc/group ] ; then fi # grep the username which was given to us from /etc/passwd and add it -# to ./etc/passwd replacing the $HOME with the directory as it will then +# to ./etc/passwd replacing the $HOME with the directory as it will then # appear in the jail echo "Adding User $CHROOT_USERNAME to jail" grep -e "^$CHROOT_USERNAME:" /etc/passwd | \ @@ -350,25 +352,25 @@ fi echo "Copying necessary library-files to jail (may take some time)" # The original code worked fine on RedHat 7.3, but did not on FC3. -# On FC3, when the 'ldd' is done, there is a 'linux-gate.so.1' that +# On FC3, when the 'ldd' is done, there is a 'linux-gate.so.1' that # points to nothing (or a 90xb.....), and it also does not pick up # some files that start with a '/'. To fix this, I am doing the ldd # to a file called ldlist, then going back into the file and pulling # out the libs that start with '/' -# +# # Randy K. # # The original code worked fine on 2.4 kernel systems. Kernel 2.6 -# introduced an internal library called 'linux-gate.so.1'. This -# 'phantom' library caused non-critical errors to display during the -# copy since the file does not actually exist on the file system. -# To fix re-direct output of ldd to a file, parse the file and get +# introduced an internal library called 'linux-gate.so.1'. This +# 'phantom' library caused non-critical errors to display during the +# copy since the file does not actually exist on the file system. +# To fix re-direct output of ldd to a file, parse the file and get # library files that start with / # -if [ -x ${HOME}/ldlist ]; then +if [ -x ${HOME}/ldlist ]; then mv ${HOME}/ldlist ${HOME}/ldlist.bak fi -if [ -x ${HOME}/lddlist2 ]; then +if [ -x ${HOME}/lddlist2 ]; then mv ${HOME}/lddlist2 ${HOME}/lddlist2.bak fi @@ -446,7 +448,7 @@ fi # needed library just copy all of them) # #cp /lib/*.* ${JAILPATH}/lib/ -#cp /lib/lib64/*.* ${JAILPATH}/lib/lib64/ +#cp /lib/lib64/*.* ${JAILPATH}/lib/lib64/ # if you are using PAM you need stuff from /etc/pam.d/ in the jail, echo "Copying files from /etc/pam.d/ to jail" @@ -462,7 +464,7 @@ cp /etc/login.defs ${JAILPATH}/etc/ if [ -f /etc/DIR_COLORS ] ; then cp /etc/DIR_COLORS ${JAILPATH}/etc/ -fi +fi # Don't give more permissions than necessary chown root.root ${JAILPATH}/bin/su