templates/lxc-sshd.in

   1 #!/bin/bash
   2
   3 #
   4 # lxc: linux Container library
   5
   6 # Authors:
   7 # Daniel Lezcano <daniel.lezcano@free.fr>
   8
   9 # This library is free software; you can redistribute it and/or
  10 # modify it under the terms of the GNU Lesser General Public
  11 # License as published by the Free Software Foundation; either
  12 # version 2.1 of the License, or (at your option) any later version.
  13
  14 # This library is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 # Lesser General Public License for more details.
  18
  19 # You should have received a copy of the GNU Lesser General Public
  20 # License along with this library; if not, write to the Free Software
  21 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22
  23 install_sshd()
  24 {
  25     rootfs=$1
  26
  27     tree="\
  28 $rootfs/var/run/sshd \
  29 $rootfs/var/empty/sshd \
  30 $rootfs/var/lib/empty/sshd \
  31 $rootfs/etc/ssh \
  32 $rootfs/dev/shm \
  33 $rootfs/run/shm \
  34 $rootfs/proc \
  35 $rootfs/bin \
  36 $rootfs/sbin \
  37 $rootfs/usr \
  38 $rootfs/tmp \
  39 $rootfs/home \
  40 $rootfs/root \
  41 $rootfs/lib \
  42 $rootfs/lib64"
  43
  44     mkdir -p $tree
  45     if [ $? -ne 0 ]; then
  46         return 1
  47     fi
  48
  49     return 0
  50 }
  51
  52 configure_sshd()
  53 {
  54     rootfs=$1
  55
  56     cat <<EOF > $rootfs/etc/passwd
  57 root:x:0:0:root:/root:/bin/bash
  58 sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
  59 EOF
  60
  61     cat <<EOF > $rootfs/etc/group
  62 root:x:0:root
  63 sshd:x:74:
  64 EOF
  65
  66 ssh-keygen -t rsa -f $rootfs/etc/ssh/ssh_host_rsa_key
  67 ssh-keygen -t dsa -f $rootfs/etc/ssh/ssh_host_dsa_key
  68
  69     # by default setup root password with no password
  70     cat <<EOF > $rootfs/etc/ssh/sshd_config
  71 Port 22
  72 Protocol 2
  73 HostKey /etc/ssh/ssh_host_rsa_key
  74 HostKey /etc/ssh/ssh_host_dsa_key
  75 UsePrivilegeSeparation yes
  76 KeyRegenerationInterval 3600
  77 ServerKeyBits 768
  78 SyslogFacility AUTH
  79 LogLevel INFO
  80 LoginGraceTime 120
  81 PermitRootLogin yes
  82 StrictModes yes
  83 RSAAuthentication yes
  84 PubkeyAuthentication yes
  85 IgnoreRhosts yes
  86 RhostsRSAAuthentication no
  87 HostbasedAuthentication no
  88 PermitEmptyPasswords yes
  89 ChallengeResponseAuthentication no
  90 EOF
  91
  92     if [ -n "$auth_key" -a -f "$auth_key" ]; then
  93         u_path="/root/.ssh"
  94         root_u_path="$rootfs/$u_path"
  95         mkdir -p $root_u_path
  96         cp $auth_key "$root_u_path/authorized_keys"
  97         chown -R 0:0 "$rootfs/$u_path"
  98         chmod 700 "$rootfs/$u_path"
  99         echo "Inserted SSH public key from $auth_key into $rootfs/$u_path"
 100     fi
 101
 102     return 0
 103 }
 104
 105 copy_configuration()
 106 {
 107     path=$1
 108     rootfs=$2
 109     name=$3
 110
 111     grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
 112 cat <<EOF >> $path/config
 113 lxc.utsname = $name
 114 lxc.pts = 1024
 115 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 116
 117 # When using LXC with apparmor, uncomment the next line to run unconfined:
 118 #lxc.aa_profile = unconfined
 119
 120 lxc.mount.entry = /dev dev none ro,bind 0 0
 121 lxc.mount.entry = /lib lib none ro,bind 0 0
 122 lxc.mount.entry = /bin bin none ro,bind 0 0
 123 lxc.mount.entry = /usr usr none ro,bind 0 0
 124 lxc.mount.entry = /sbin sbin none ro,bind 0 0
 125 lxc.mount.entry = tmpfs var/run/sshd tmpfs mode=0644 0 0
 126 lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none bind 0 0
 127 lxc.mount.entry = proc $rootfs/proc proc nodev,noexec,nosuid 0 0
 128 EOF
 129
 130     # if no .ipv4 section in config, then have the container run dhcp
 131     grep -q "^lxc.network.ipv4" $path/config || touch $rootfs/run-dhcp
 132
 133     if [ "$(uname -m)" = "x86_64" ]; then
 134         cat <<EOF >> $path/config
 135 lxc.mount.entry = /lib64 lib64 none ro,bind 0 0
 136 EOF
 137     fi
 138 }
 139
 140 usage()
 141 {
 142     cat <<EOF
 143 $1 -h|--help -p|--path=<path> [--rootfs=<path>]
 144 EOF
 145     return 0
 146 }
 147
 148 options=$(getopt -o hp:n:S: -l help,rootfs:,path:,name:,auth-key: -- "$@")
 149 if [ $? -ne 0 ]; then
 150         usage $(basename $0)
 151     exit 1
 152 fi
 153 eval set -- "$options"
 154
 155 while true
 156 do
 157     case "$1" in
 158         -h|--help)      usage $0 && exit 0;;
 159         -p|--path)      path=$2; shift 2;;
 160         --rootfs)       rootfs=$2; shift 2;;
 161         -n|--name)      name=$2; shift 2;;
 162         -S|--auth-key)  auth_key=$2; shift 2;;
 163         --)             shift 1; break ;;
 164         *)              break ;;
 165     esac
 166 done
 167
 168 if [ "$(id -u)" != "0" ]; then
 169     echo "This script should be run as 'root'"
 170     exit 1
 171 fi
 172
 173 if [ $0 == "/sbin/init" ]; then
 174
 175     type @LXCINITDIR@/lxc-init
 176     if [ $? -ne 0 ]; then
 177         echo "'lxc-init is not accessible on the system"
 178         exit 1
 179     fi
 180
 181     type sshd
 182     if [ $? -ne 0 ]; then
 183         echo "'sshd' is not accessible on the system "
 184         exit 1
 185     fi
 186
 187     # run dhcp?
 188     if [ -f /run-dhcp ]; then
 189         type dhclient
 190         if [ $? -ne 0 ]; then
 191             echo "can't find dhclient"
 192             exit 1
 193         fi
 194         touch /etc/fstab
 195         rm -f /dhclient.conf
 196         cat > /dhclient.conf << EOF
 197 send host-name "<hostname>";
 198 EOF
 199         ifconfig eth0 up
 200         dhclient eth0 -cf /dhclient.conf
 201     fi
 202
 203     exec @LXCINITDIR@/lxc-init -- /usr/sbin/sshd
 204     exit 1
 205 fi
 206
 207 if [ -z "$path" ]; then
 208     echo "'path' parameter is required"
 209     exit 1
 210 fi
 211
 212 # detect rootfs
 213 config="$path/config"
 214 if [ -z "$rootfs" ]; then
 215     if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
 216         rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
 217     else
 218         rootfs=$path/rootfs
 219     fi
 220 fi
 221
 222 install_sshd $rootfs
 223 if [ $? -ne 0 ]; then
 224     echo "failed to install sshd's rootfs"
 225     exit 1
 226 fi
 227
 228 configure_sshd $rootfs
 229 if [ $? -ne 0 ]; then
 230     echo "failed to configure sshd template"
 231     exit 1
 232 fi
 233
 234 copy_configuration $path $rootfs $name
 235 if [ $? -ne 0 ]; then
 236     echo "failed to write configuration file"
 237     exit 1
 238 fi