Marek Miklewicz
110 lines
2.5 KiB
Bash
Executable File
110 lines
2.5 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
KEY_DIR="${MAIL_LOGIN_KEY_DIR:-/usr/local/hitme_plugins/mail-login/secrets}"
|
|
KEY_NAME="${MAIL_LOGIN_KEY_NAME:-mx1_ed25519}"
|
|
KEY_PATH="$KEY_DIR/$KEY_NAME"
|
|
MX_MODE="${MX_LOGIN_MODE:-1}"
|
|
HELPER_COMMAND="${MAIL_LOGIN_HELPER_COMMAND:-/usr/local/hitme_plugins/mail-login-helper/bin/create-login-url}"
|
|
|
|
derive_servername() {
|
|
if [ -n "${SERVERNAME:-}" ]; then
|
|
printf '%s' "$SERVERNAME"
|
|
return
|
|
fi
|
|
host="$(hostname -f 2>/dev/null || hostname 2>/dev/null || printf 'source')"
|
|
printf '%s' "$host" | awk -F. '{print $1}'
|
|
}
|
|
|
|
clean_label() {
|
|
printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g; s/^-*//; s/-*$//'
|
|
}
|
|
|
|
detect_source_ip() {
|
|
if [ -n "${SOURCE_IP:-}" ]; then
|
|
printf '%s' "$SOURCE_IP"
|
|
return
|
|
fi
|
|
|
|
if command -v ip >/dev/null 2>&1; then
|
|
detected="$(ip route get 1.1.1.1 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}')"
|
|
if [ -n "$detected" ]; then
|
|
printf '%s' "$detected"
|
|
return
|
|
fi
|
|
fi
|
|
|
|
if command -v hostname >/dev/null 2>&1; then
|
|
detected="$(hostname -I 2>/dev/null | awk '{print $1}')"
|
|
if [ -n "$detected" ]; then
|
|
printf '%s' "$detected"
|
|
return
|
|
fi
|
|
fi
|
|
|
|
return 1
|
|
}
|
|
|
|
SERVER_LABEL="$(clean_label "$(derive_servername)")"
|
|
if [ -z "$SERVER_LABEL" ]; then
|
|
echo "Cannot determine SERVERNAME" >&2
|
|
exit 1
|
|
fi
|
|
|
|
case "$MX_MODE" in
|
|
1|2) ;;
|
|
*)
|
|
echo "MX_LOGIN_MODE must be 1 or 2" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
SOURCE_IP="$(detect_source_ip || true)"
|
|
case "$SOURCE_IP" in
|
|
*[!A-Za-z0-9:./_-]*|'')
|
|
echo "Cannot determine SOURCE_IP automatically. Set SOURCE_IP explicitly." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
mkdir -p "$KEY_DIR"
|
|
chmod 700 "$KEY_DIR"
|
|
|
|
if [ ! -f "$KEY_PATH" ]; then
|
|
umask 077
|
|
ssh-keygen -q -t ed25519 -a 100 -N "" -f "$KEY_PATH" -C "KLUCZ PLUGINU mail-autologin DLA SERWERA $SERVER_LABEL"
|
|
fi
|
|
|
|
if [ ! -f "$KEY_PATH.pub" ]; then
|
|
ssh-keygen -y -f "$KEY_PATH" > "$KEY_PATH.pub"
|
|
fi
|
|
|
|
chmod 600 "$KEY_PATH"
|
|
chmod 644 "$KEY_PATH.pub"
|
|
|
|
PUB_KEY="$(cat "$KEY_PATH.pub")"
|
|
BASE_OPTIONS="from=\"$SOURCE_IP\",restrict,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty"
|
|
|
|
if [ "$MX_MODE" = "2" ]; then
|
|
AUTH_OPTIONS="$BASE_OPTIONS,command=\"$HELPER_COMMAND\""
|
|
else
|
|
AUTH_OPTIONS="$BASE_OPTIONS"
|
|
fi
|
|
|
|
COMMENT="KLUCZ PLUGINU mail-autologin DLA SERWERA $SERVER_LABEL"
|
|
|
|
cat <<EOF
|
|
Private key:
|
|
$KEY_PATH
|
|
|
|
Public key:
|
|
$KEY_PATH.pub
|
|
|
|
Set this in plugin-settings.conf:
|
|
MAIL_LOGIN_SSH_IDENTITY=$KEY_PATH
|
|
MAIL_LOGIN_SSH_KNOWN_HOSTS=/root/.ssh/known_hosts
|
|
|
|
Add this line to /root/.ssh/authorized_keys on mx1:
|
|
$AUTH_OPTIONS $PUB_KEY $COMMENT
|
|
EOF
|