Skip to content
This repository was archived by the owner on Nov 8, 2021. It is now read-only.

Commit d0f82f9

Browse files
michaelwittigmichaelwittig
committed
refs #115 
1 parent 8477494 commit d0f82f9

5 files changed

+94
-132
lines changed

‎aws-ec2-ssh.spec

+5-64
Original file line numberDiff line numberDiff line change
@@ -43,70 +43,11 @@ chmod 0644 ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.d/import_users
4343

4444

4545
%post
46-
if grep -q '#AuthorizedKeysCommand none' /etc/ssh/sshd_config; then
47-
sed -i "s:#AuthorizedKeysCommand none:AuthorizedKeysCommand /usr/bin/authorized_keys_command.sh:g" /etc/ssh/sshd_config
48-
else
49-
if ! grep -q "AuthorizedKeysCommand /usr/bin/authorized_keys_command.sh" /etc/ssh/sshd_config; then
50-
echo "AuthorizedKeysCommand /usr/bin/authorized_keys_command.sh" >> /etc/ssh/sshd_config
51-
fi
52-
fi
53-
if grep -q '#AuthorizedKeysCommandUser nobody' /etc/ssh/sshd_config; then
54-
sed -i "s:#AuthorizedKeysCommandUser nobody:AuthorizedKeysCommandUser nobody:g" /etc/ssh/sshd_config
55-
else
56-
if ! grep -q 'AuthorizedKeysCommandUser nobody' /etc/ssh/sshd_config; then
57-
echo "AuthorizedKeysCommandUser nobody" >> /etc/ssh/sshd_config
58-
fi
59-
fi
60-
61-
# In order to support SELinux in Enforcing mode, we need to tell SELinux that it
62-
# should have the nis_enabled boolean turned on (so it should expect login services
63-
# like PAM and sshd to make calls to get public keys from a remote server)
64-
#
65-
# This is observed on CentOS 7 and RHEL 7
66-
67-
# Capture the return code and use that to determine if we have the command available
68-
retval=0
69-
which getenforce > /dev/null 2>&1 || retval=$?
70-
71-
if [[ "$retval" -eq "0" ]]; then
72-
retval=0
73-
selinuxenabled || retval=$?
74-
if [[ "$retval" -eq "0" ]]; then
75-
setsebool -P nis_enabled on
76-
fi
77-
fi
78-
79-
# Restart sshd using an appropriate method based on the currently running init daemon
80-
# Note that systemd can return "running" or "degraded" (If a systemd unit has failed)
81-
# This was observed on the RHEL 7.3 AMI, so it's added for completeness
82-
# systemd is also not standardized in the name of the ssh service, nor in the places
83-
# where the unit files are stored.
84-
85-
# Capture the return code and use that to determine if we have the command available
86-
retval=0
87-
which systemctl > /dev/null 2>&1 || retval=$?
88-
89-
if [[ "$retval" -eq "0" ]]; then
90-
if [[ (`systemctl is-system-running` =~ running) || (`systemctl is-system-running` =~ degraded) || (`systemctl is-system-running` =~ starting) ]]; then
91-
if [ -f "/usr/lib/systemd/system/sshd.service" ] || [ -f "/lib/systemd/system/sshd.service" ]; then
92-
systemctl restart sshd.service
93-
else
94-
systemctl restart ssh.service
95-
fi
96-
fi
97-
elif [[ `/sbin/init --version` =~ upstart ]]; then
98-
if [ -f "/etc/init.d/sshd" ]; then
99-
service sshd restart
100-
else
101-
service ssh restart
102-
fi
103-
else
104-
if [ -f "/etc/init.d/sshd" ]; then
105-
/etc/init.d/sshd restart
106-
else
107-
/etc/init.d/ssh restart
108-
fi
109-
fi
46+
%include install_configure_sshd.sh
47+
48+
%include install_configure_selinux.sh
49+
50+
$include install_restart_sshs.sh
11051

11152
echo "To configure the aws-ec2-ssh package, edit /etc/aws-ec-ssh.conf. No users will be synchronized before you did this."
11253

‎install.sh

100644100755
+20-68
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ Install import_users.sh and authorized_key_commands.
2828
EOF
2929
}
3030

31-
SSHD_CONFIG_FILE="/etc/ssh/sshd_config"
32-
AUTHORIZED_KEYS_COMMAND_FILE="/opt/authorized_keys_command.sh"
33-
IMPORT_USERS_SCRIPT_FILE="/opt/import_users.sh"
34-
MAIN_CONFIG_FILE="/etc/aws-ec2-ssh.conf"
31+
export SSHD_CONFIG_FILE="/etc/ssh/sshd_config"
32+
export AUTHORIZED_KEYS_COMMAND_FILE="/opt/authorized_keys_command.sh"
33+
export IMPORT_USERS_SCRIPT_FILE="/opt/import_users.sh"
34+
export MAIN_CONFIG_FILE="/etc/aws-ec2-ssh.conf"
3535

3636
IAM_GROUPS=""
3737
SUDO_GROUPS=""
@@ -80,6 +80,19 @@ do
8080
esac
8181
done
8282

83+
export IAM_GROUPS
84+
export SUDO_GROUPS
85+
export LOCAL_GROUPS
86+
export ASSUME_ROLE
87+
export USERADD_PROGRAM
88+
export USERADD_ARGS
89+
90+
# check if AWS CLI exists
91+
if ! which aws; then
92+
echo "aws executable not found - exiting!"
93+
exit 1
94+
fi
95+
8396
tmpdir=$(mktemp -d)
8497

8598
cd "$tmpdir"
@@ -121,21 +134,9 @@ then
121134
echo "USERADD_ARGS=\"${USERADD_ARGS}\"" >> $MAIN_CONFIG_FILE
122135
fi
123136

124-
if grep -q '#AuthorizedKeysCommand none' $SSHD_CONFIG_FILE; then
125-
sed -i "s:#AuthorizedKeysCommand none:AuthorizedKeysCommand ${AUTHORIZED_KEYS_COMMAND_FILE}:g" $SSHD_CONFIG_FILE
126-
else
127-
if ! grep -q "AuthorizedKeysCommand ${AUTHORIZED_KEYS_COMMAND_FILE}" $SSHD_CONFIG_FILE; then
128-
echo "AuthorizedKeysCommand ${AUTHORIZED_KEYS_COMMAND_FILE}" >> $SSHD_CONFIG_FILE
129-
fi
130-
fi
137+
./install_configure_selinux.sh
131138

132-
if grep -q '#AuthorizedKeysCommandUser nobody' $SSHD_CONFIG_FILE; then
133-
sed -i "s:#AuthorizedKeysCommandUser nobody:AuthorizedKeysCommandUser nobody:g" $SSHD_CONFIG_FILE
134-
else
135-
if ! grep -q 'AuthorizedKeysCommandUser nobody' $SSHD_CONFIG_FILE; then
136-
echo "AuthorizedKeysCommandUser nobody" >> $SSHD_CONFIG_FILE
137-
fi
138-
fi
139+
./install_configure_sshd.sh
139140

140141
cat > /etc/cron.d/import_users << EOF
141142
SHELL=/bin/bash
@@ -148,53 +149,4 @@ chmod 0644 /etc/cron.d/import_users
148149

149150
$IMPORT_USERS_SCRIPT_FILE
150151

151-
# In order to support SELinux in Enforcing mode, we need to tell SELinux that it
152-
# should have the nis_enabled boolean turned on (so it should expect login services
153-
# like PAM and sshd to make calls to get public keys from a remote server)
154-
#
155-
# This is observed on CentOS 7 and RHEL 7
156-
157-
# Capture the return code and use that to determine if we have the command available
158-
retval=0
159-
which getenforce > /dev/null 2>&1 || retval=$?
160-
161-
if [[ "$retval" -eq "0" ]]; then
162-
retval=0
163-
selinuxenabled || retval=$?
164-
if [[ "$retval" -eq "0" ]]; then
165-
setsebool -P nis_enabled on
166-
fi
167-
fi
168-
169-
170-
# Restart sshd using an appropriate method based on the currently running init daemon
171-
# Note that systemd can return "running" or "degraded" (If a systemd unit has failed)
172-
# This was observed on the RHEL 7.3 AMI, so it's added for completeness
173-
# systemd is also not standardized in the name of the ssh service, nor in the places
174-
# where the unit files are stored.
175-
176-
# Capture the return code and use that to determine if we have the command available
177-
retval=0
178-
which systemctl > /dev/null 2>&1 || retval=$?
179-
180-
if [[ "$retval" -eq "0" ]]; then
181-
if [[ (`systemctl is-system-running` =~ running) || (`systemctl is-system-running` =~ degraded) || (`systemctl is-system-running` =~ starting) ]]; then
182-
if [ -f "/usr/lib/systemd/system/sshd.service" ] || [ -f "/lib/systemd/system/sshd.service" ]; then
183-
systemctl restart sshd.service
184-
else
185-
systemctl restart ssh.service
186-
fi
187-
fi
188-
elif [[ `/sbin/init --version` =~ upstart ]]; then
189-
if [ -f "/etc/init.d/sshd" ]; then
190-
service sshd restart
191-
else
192-
service ssh restart
193-
fi
194-
else
195-
if [ -f "/etc/init.d/sshd" ]; then
196-
/etc/init.d/sshd restart
197-
else
198-
/etc/init.d/ssh restart
199-
fi
200-
fi
152+
./install_restart_sshs.sh

‎install_configure_selinux.sh

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash -e
2+
3+
# In order to support SELinux in Enforcing mode, we need to tell SELinux that it
4+
# should have the nis_enabled boolean turned on (so it should expect login services
5+
# like PAM and sshd to make calls to get public keys from a remote server)
6+
#
7+
# This is observed on CentOS 7 and RHEL 7
8+
9+
# Capture the return code and use that to determine if we have the command available
10+
retval=0
11+
which getenforce > /dev/null 2>&1 || retval=$?
12+
13+
if [[ "$retval" -eq "0" ]]; then
14+
retval=0
15+
selinuxenabled || retval=$?
16+
if [[ "$retval" -eq "0" ]]; then
17+
setsebool -P nis_enabled on
18+
fi
19+
fi

‎install_configure_sshd.sh

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash -e
2+
3+
if grep -q '#AuthorizedKeysCommand none' "$SSHD_CONFIG_FILE"; then
4+
sed -i "s:#AuthorizedKeysCommand none:AuthorizedKeysCommand ${AUTHORIZED_KEYS_COMMAND_FILE}:g" "$SSHD_CONFIG_FILE"
5+
else
6+
if ! grep -q "AuthorizedKeysCommand ${AUTHORIZED_KEYS_COMMAND_FILE}" "$SSHD_CONFIG_FILE"; then
7+
echo "AuthorizedKeysCommand ${AUTHORIZED_KEYS_COMMAND_FILE}" >> "$SSHD_CONFIG_FILE"
8+
fi
9+
fi
10+
11+
if grep -q '#AuthorizedKeysCommandUser nobody' "$SSHD_CONFIG_FILE"; then
12+
sed -i "s:#AuthorizedKeysCommandUser nobody:AuthorizedKeysCommandUser nobody:g" "$SSHD_CONFIG_FILE"
13+
else
14+
if ! grep -q 'AuthorizedKeysCommandUser nobody' "$SSHD_CONFIG_FILE"; then
15+
echo "AuthorizedKeysCommandUser nobody" >> "$SSHD_CONFIG_FILE"
16+
fi
17+
fi

‎install_restart_sshs.sh

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash -e
2+
3+
# Restart sshd using an appropriate method based on the currently running init daemon
4+
# Note that systemd can return "running" or "degraded" (If a systemd unit has failed)
5+
# This was observed on the RHEL 7.3 AMI, so it's added for completeness
6+
# systemd is also not standardized in the name of the ssh service, nor in the places
7+
# where the unit files are stored.
8+
9+
# Capture the return code and use that to determine if we have the command available
10+
retval=0
11+
which systemctl > /dev/null 2>&1 || retval=$?
12+
13+
if [[ "$retval" -eq "0" ]]; then
14+
if [[ ($(systemctl is-system-running) =~ running) || ($(systemctl is-system-running) =~ degraded) || ($(systemctl is-system-running) =~ starting) ]]; then
15+
if [ -f "/usr/lib/systemd/system/sshd.service" ] || [ -f "/lib/systemd/system/sshd.service" ]; then
16+
systemctl restart sshd.service
17+
else
18+
systemctl restart ssh.service
19+
fi
20+
fi
21+
elif [[ $(/sbin/init --version) =~ upstart ]]; then
22+
if [ -f "/etc/init.d/sshd" ]; then
23+
service sshd restart
24+
else
25+
service ssh restart
26+
fi
27+
else
28+
if [ -f "/etc/init.d/sshd" ]; then
29+
/etc/init.d/sshd restart
30+
else
31+
/etc/init.d/ssh restart
32+
fi
33+
fi

0 commit comments

Comments
 (0)