feat: add plugin ssh key generator

2026-06-30 12:52:45 +02:00
parent b23e959491
commit d43c87486c
4 changed files with 133 additions and 2 deletions
@@ -0,0 +1,85 @@
+#!/bin/sh
+set -eu
+
+KEY_DIR="${MAIL_LOGIN_KEY_DIR:-/usr/local/hitme_plugins/mail-login/secrets}"
+KEY_NAME="${MAIL_LOGIN_KEY_NAME:-mx1_ed25519}"
+KEY_PATH="$KEY_DIR/$KEY_NAME"
+MX_MODE="${MX_LOGIN_MODE:-1}"
+SOURCE_IP="${SOURCE_IP:-SOURCE_SERVER_PUBLIC_IP}"
+HELPER_COMMAND="${MAIL_LOGIN_HELPER_COMMAND:-/usr/local/hitme_plugins/mail-login-helper/bin/create-login-url}"
+
+derive_servername() {
+  if [ -n "${SERVERNAME:-}" ]; then
+    printf '%s' "$SERVERNAME"
+    return
+  fi
+  host="$(hostname -f 2>/dev/null || hostname 2>/dev/null || printf 'source')"
+  printf '%s' "$host" | awk -F. '{print $1}'
+}
+
+clean_label() {
+  printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g; s/^-*//; s/-*$//'
+}
+
+SERVER_LABEL="$(clean_label "$(derive_servername)")"
+if [ -z "$SERVER_LABEL" ]; then
+  echo "Cannot determine SERVERNAME" >&2
+  exit 1
+fi
+
+case "$MX_MODE" in
+  1|2) ;;
+  *)
+    echo "MX_LOGIN_MODE must be 1 or 2" >&2
+    exit 1
+    ;;
+esac
+
+case "$SOURCE_IP" in
+  *[!A-Za-z0-9:./_-]*|'')
+    echo "SOURCE_IP contains unsupported characters" >&2
+    exit 1
+    ;;
+esac
+
+mkdir -p "$KEY_DIR"
+chmod 700 "$KEY_DIR"
+
+if [ ! -f "$KEY_PATH" ]; then
+  umask 077
+  ssh-keygen -q -t ed25519 -a 100 -N "" -f "$KEY_PATH" -C "KLUCZ PLUGINU mail-autologin DLA SERWERA $SERVER_LABEL"
+fi
+
+if [ ! -f "$KEY_PATH.pub" ]; then
+  ssh-keygen -y -f "$KEY_PATH" > "$KEY_PATH.pub"
+fi
+
+chmod 600 "$KEY_PATH"
+chmod 644 "$KEY_PATH.pub"
+
+PUB_KEY="$(cat "$KEY_PATH.pub")"
+BASE_OPTIONS="from=\"$SOURCE_IP\",restrict,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty"
+
+if [ "$MX_MODE" = "2" ]; then
+  AUTH_OPTIONS="$BASE_OPTIONS,command=\"$HELPER_COMMAND\""
+else
+  AUTH_OPTIONS="$BASE_OPTIONS"
+fi
+
+COMMENT="KLUCZ PLUGINU mail-autologin DLA SERWERA $SERVER_LABEL"
+
+cat <<EOF
+Private key:
+$KEY_PATH
+
+Public key:
+$KEY_PATH.pub
+
+Set this in plugin-settings.conf:
+MAIL_LOGIN_SSH_IDENTITY=$KEY_PATH
+MAIL_LOGIN_SSH_KNOWN_HOSTS=/root/.ssh/known_hosts
+
+Add this line to /root/.ssh/authorized_keys on mx1:
+$AUTH_OPTIONS $PUB_KEY $COMMENT
+EOF
+