ScriptsCollections/ServerUserCreate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update ssh key move script

Browse Source 
admin/ubuntu/ec2-user keys must move too, but the folders don't get
auto removed
This commit is contained in:
Clemens Schwaighofer
2023-06-01 14:38:00 +09:00
parent 43ef147de6
commit 46dc2be34d
1 changed files with 51 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
bin/authorized_key_location_change.sh.sh
View File

@@ -2,19 +2,20 @@
# check if we need to move the users authorized keys to the central location
TEST=0;
TEST=1;
SKIP_USERS=();
while getopts ":tis:" opt; do
while getopts ":gs:" opt; do
case "${opt}" in
t|test)
TEST=1;
g|go)
# default we
TEST=0;
;;
s|skip)
SKIP_USERS+=("${OPTARG}");
;;
\?)
echo -e "\n Option does not exist: ${OPTARG}\n";
echo "Use -t for test and -s <user> for users to skip";
echo "Use -g for go (run) and -s <user> for users to skip";
exit 1;
;;
esac;
@@ -23,6 +24,7 @@ done;
# check if authorized keys is actually enabled
# detect ssh authorized_keys setting
SSH_CENTRAL_AUTHORIZED_FILE_FOLDER='';
SSH_MASTER_AUTHORIZED_FILE='';
SSH_AUTHORIZED_FILE='';
for cf in $(grep "^AuthorizedKeysFile" /etc/ssh/sshd_config | grep "%u"); do
if [ ! -z $(echo "${cf}" | grep "%u") ]; then
@@ -37,17 +39,35 @@ if [ -z "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}" ]; then
echo "No central authorized_keys file detected, no change check needed";
exit;
fi;
echo "SSH Authorized Files folder: ${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}";
for cf in $(grep "^AuthorizedKeysFile" /etc/ssh/sshd_config | grep -- "--master"); do
if [ ! -z $(echo "${cf}" | grep -- "--master") ]; then
SSH_MASTER_AUTHORIZED_FILE="${cf}";
if [ ! -f "${SSH_MASTER_AUTHORIZED_FILE}" ]; then
echo "ssh master authorized_file could not be found: ${SSH_MASTER_AUTHORIZED_FILE}"l
exit;
fi;
fi;
done;
if [ -z "${SSH_MASTER_AUTHORIZED_FILE}" ]; then
echo "No master authorized_key file detected, no change check needed";
exit;
fi;
echo "SSH Msater Authorized Key file: ${SSH_MASTER_AUTHORIZED_FILE}";
echo "SSH Authorized Keys file folder: ${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}";
PRINTF_INFO="%-8s [%3s]: %-25s: %s\n";
# list of user accounts we will never touch
NO_ACTION=(root admin ec2-user ubuntu);
NO_ACTION=(root);
# move, but must check that master is set
# master key is the first in the authorized keys list for the below users
MASTER_KEY=(admin ec2-user ubuntu);
# loop over passwd file
# if not in no action then check if .ssh/authorized_keys file exists
cat /etc/passwd | cut -d ":" -f 1,6 |
while read user_home; do
username=$(echo "${user_home}" | cut -d ":" -f 1);
master_user=0;
# skip admin usernames
if [[ " ${NO_ACTION[*]} " =~ " ${username} " ]]; then
printf "${PRINTF_INFO}" "NO ACT" "!" "${username}" "user in NO ACTION list";
@@ -68,13 +88,26 @@ while read user_home; do
fi;
continue;
fi;
# check those keys are in the master key list
if [[ " ${MASTER_KEY[*]} " =~ " ${username} " ]]; then
master_user=1;
ssh_key_diff=$(diff -u "${home_folder}/.ssh/authorized_keys" "${SSH_MASTER_AUTHORIZED_FILE}");
if [ ! -z "${ssh_key_diff}" ]; then
printf "${PRINTF_INFO}" "ABORT" "!!!" "${username}" "authorized key is not matching the master key file";
exit;
fi;
fi;
# check if this user public key(s) exist in AuthorizedKeysFile target
if [ -f "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}" ]; then
ssh_key_diff=$(diff -u "${home_folder}/.ssh/authorized_keys" "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}");
if [ -z "${ssh_key_diff}" ]; then
printf "${PRINTF_INFO}" "REMOVE" "-" "${username}" ".ssh/authorized_keys";
if [ ${TEST} -eq 0 ]; then
rm "${home_folder}/.ssh/authorized_keys";
if [ ${master_user} -eq 0 ]; then
rm "${home_folder}/.ssh/authorized_keys";
else
echo "[!] No delete for master user, must be done manually";
fi;
else
echo "$> rm \"${home_folder}/.ssh/authorized_keys\"";
fi;
@@ -99,14 +132,22 @@ while read user_home; do
break;
fi;
# remove home .ssh/authorized_keys (do not remove folder)
rm "${home_folder}/.ssh/authorized_keys";
if [ ${master_user} -eq 0 ]; then
rm "${home_folder}/.ssh/authorized_keys";
else
print "=> No delete for master user, must be done manually";
fi;
else
echo "[START] ====>";
echo "$> cat \"${home_folder}/.ssh/authorized_keys\" > \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
echo "$> chown ${username} \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
echo "$> chmod 400 \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
echo "$> chattr +i \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
echo "$> rm \"${home_folder}/.ssh/authorized_keys\"";
if [ ${master_user} -eq 0 ]; then
echo "$> rm \"${home_folder}/.ssh/authorized_keys\"";
else
echo "[!] No delete for master user, must be done manually";
fi;
echo "[END ] ====>";
fi;
done;