Skip to content

O
OpnSense
Commit ba2eedc1 authored by Franco Fichtner's avatar Franco Fichtner
Browse files
Options

rc: add reachable installer user for ssh 

Prefer LiveCD boot during install media boot, then
set up an extra user for installation.  This user
shall be reached via console or SSH soon enough for
a sort of remote install experience.

PR: https://forum.opnsense.org/index.php?topic=3403

Inspired by: DragonFlyBSD (and we're using its installer anyway!)

(cherry picked from commit 710f00e8)
(cherry picked from commit 8ea003a0)
(cherry picked from commit bde361f7)
(cherry picked from commit d4ecff6f)
(cherry picked from commit 557e7271)
(cherry picked from commit 738f733d)
parent 2bcdb425
Hide whitespace changes
Inline Side-by-side
Showing with 93 additions and 112 deletions
+POST_INSTALL
View file @ ba2eedc1
...@@ -3,6 +3,10 @@ cp /etc/shells /etc/shells.bak ...@@ -3,6 +3,10 @@ cp /etc/shells /etc/shells.bak
(grep -v /usr/local/etc/rc.initial /etc/shells.bak; \ (grep -v /usr/local/etc/rc.initial /etc/shells.bak; \
echo /usr/local/etc/rc.initial) > /etc/shells echo /usr/local/etc/rc.initial) > /etc/shells
rm -f /etc/shells.bak rm -f /etc/shells.bak
cp /etc/shells /etc/shells.bak
(grep -v /usr/local/etc/rc.installer /etc/shells.bak; \
echo /usr/local/etc/rc.installer) > /etc/shells
rm -f /etc/shells.bak
echo "Registering root shell" echo "Registering root shell"
pw usermod -n root -s /usr/local/etc/rc.initial pw usermod -n root -s /usr/local/etc/rc.initial
......
+PRE_DEINSTALL
View file @ ba2eedc1
...@@ -5,6 +5,9 @@ echo "Updating /etc/shells" ...@@ -5,6 +5,9 @@ echo "Updating /etc/shells"
cp /etc/shells /etc/shells.bak cp /etc/shells /etc/shells.bak
(grep -v /usr/local/etc/rc.initial /etc/shells.bak) > /etc/shells (grep -v /usr/local/etc/rc.initial /etc/shells.bak) > /etc/shells
rm -f /etc/shells.bak rm -f /etc/shells.bak
cp /etc/shells /etc/shells.bak
(grep -v /usr/local/etc/rc.installer /etc/shells.bak) > /etc/shells
rm -f /etc/shells.bak
echo "Updating /boot/loader.conf" echo "Updating /boot/loader.conf"
touch /boot/loader.conf touch /boot/loader.conf
......
src/etc/inc/auth.inc
View file @ ba2eedc1
...@@ -337,7 +337,6 @@ function userHasPrivilege($userent, $privid = false) ...@@ -337,7 +337,6 @@ function userHasPrivilege($userent, $privid = false)
return true; return true;
} }
function local_sync_accounts() function local_sync_accounts()
{ {
global $config; global $config;
...@@ -429,10 +428,10 @@ function local_user_set(&$user) ...@@ -429,10 +428,10 @@ function local_user_set(&$user)
/* root user special handling */ /* root user special handling */
if ($user_uid == 0) { if ($user_uid == 0) {
$user_shell = isset($user['shell']) ? $user['shell'] : '/usr/local/etc/rc.initial';
$lock_account = 'unlock';
$user_group = 'wheel'; $user_group = 'wheel';
$user_home = '/root'; $user_home = '/root';
$user_shell = '/usr/local/etc/rc.initial';
$lock_account = 'unlock';
} }
/* read from pw db */ /* read from pw db */
......
src/etc/rc
View file @ ba2eedc1
...@@ -174,6 +174,7 @@ if [ ${USE_MFS_VAR} -ne 0 ]; then ...@@ -174,6 +174,7 @@ if [ ${USE_MFS_VAR} -ne 0 ]; then
echo -n "Setting up memory disks..." echo -n "Setting up memory disks..."
setup_mfs_link /root /var/cache opnsense-update setup_mfs_link /root /var/cache opnsense-update
setup_mfs_link /root /var/log bsdinstaller
setup_mfs_link /root /var/cache pkg setup_mfs_link /root /var/cache pkg
setup_mfs_link /root /var/db pkg setup_mfs_link /root /var/db pkg
setup_mfs_link /root /var crash setup_mfs_link /root /var crash
...@@ -181,6 +182,7 @@ if [ ${USE_MFS_VAR} -ne 0 ]; then ...@@ -181,6 +182,7 @@ if [ ${USE_MFS_VAR} -ne 0 ]; then
mount -t tmpfs tmpfs /var mount -t tmpfs tmpfs /var
install_mfs_link /root /var/cache opnsense-update install_mfs_link /root /var/cache opnsense-update
install_mfs_link /root /var/log bsdinstaller
install_mfs_link /root /var/cache pkg install_mfs_link /root /var/cache pkg
install_mfs_link /root /var/db pkg install_mfs_link /root /var/db pkg
install_mfs_link /root /var crash install_mfs_link /root /var crash
...@@ -188,6 +190,7 @@ if [ ${USE_MFS_VAR} -ne 0 ]; then ...@@ -188,6 +190,7 @@ if [ ${USE_MFS_VAR} -ne 0 ]; then
echo "done." echo "done."
else else
remove_mfs_link /root /var/cache opnsense-update remove_mfs_link /root /var/cache opnsense-update
remove_mfs_link /root /var/log bsdinstaller
remove_mfs_link /root /var/cache pkg remove_mfs_link /root /var/cache pkg
remove_mfs_link /root /var/db pkg remove_mfs_link /root /var/db pkg
remove_mfs_link /root /var crash remove_mfs_link /root /var crash
...@@ -247,16 +250,9 @@ echo "done." ...@@ -247,16 +250,9 @@ echo "done."
# let the PHP-based configuration subsystem set up the system now # let the PHP-based configuration subsystem set up the system now
echo -n "Launching the init system..." echo -n "Launching the init system..."
touch /var/run/booting touch /var/run/booting
/usr/local/etc/rc.bootup /usr/local/etc/rc.bootup || exit 1
rm /var/run/booting rm /var/run/booting
# If a shell was selected from recovery
# console then just drop to the shell now.
if [ -f "/tmp/donotbootup" ]; then
echo "Dropping to recovery shell."
exit 0
fi
# Execute the normal syshook / plugin commands # Execute the normal syshook / plugin commands
/usr/local/etc/rc.syshook start /usr/local/etc/rc.syshook start
......
src/etc/rc.bootup
View file @ ba2eedc1
...@@ -62,54 +62,6 @@ function is_interface_mismatch() ...@@ -62,54 +62,6 @@ function is_interface_mismatch()
return false; return false;
} }
function rescue_detect_keypress()
{
$timer = 7;
echo "\n";
echo "(I)nstaller will be invoked by default.\n\n";
echo "(C)ontinue with LiveCD bootup instead.\n\n";
echo "(R)ecovery mode escapes to a root shell.\n\n";
echo "Timeout before auto boot continues (seconds): ";
$key = null;
while (!isset($key) || !in_array($key, array('c', 'C', 'r', 'R', 'i', 'I'))) {
if ($timer >= 9) {
echo chr(8) . chr(8) . ($timer==9 ? chr(32) : null) . "{$timer}";
} else {
echo chr(8). "{$timer}";
}
shell_exec('/bin/stty -icanon min 0 time 25');
$key = shell_exec('/bin/dd count=1 status=none');
shell_exec('/bin/stty icanon');
if ($key == '') {
unset($key);
}
$timer--;
if ($timer == 0) {
break;
}
}
echo "\n\n";
if (in_array($key, array('r', 'R'))) {
echo "Recovery shell selected...\n\n";
touch('/tmp/donotbootup');
exit;
} elseif (in_array($key, array('c', 'C'))) {
/* nothing */
} else {
echo "Installer mode selected...\n";
passthru('/usr/local/etc/rc.installer');
if (file_exists('/tmp/install_complete')) {
passthru('/usr/local/etc/rc.reboot');
exit;
}
}
}
echo " done.\n"; echo " done.\n";
echo "Initializing..."; echo "Initializing...";
...@@ -140,7 +92,6 @@ echo "."; ...@@ -140,7 +92,6 @@ echo ".";
require_once("openvpn.inc"); require_once("openvpn.inc");
echo "."; echo ".";
require_once("rrd.inc"); require_once("rrd.inc");
echo ".";
echo " done.\n"; echo " done.\n";
/* start devd (dhclient now uses it) */ /* start devd (dhclient now uses it) */
...@@ -155,10 +106,24 @@ echo "done.\n"; ...@@ -155,10 +106,24 @@ echo "done.\n";
/* configure console menu */ /* configure console menu */
system_console_configure(); system_console_configure();
/* Display live system's early boot options */ $setup_installer = is_install_media();
if (is_install_media()) { if ($setup_installer) {
rescue_detect_keypress(); echo 'Press any key to start the early installer: ';
// config may have changed (copied by installer)
$key = timeout();
if ($key != "\n") {
echo "\n";
}
if (isset($key)) {
passthru('/usr/local/etc/rc.installer');
if (file_exists('/tmp/install_complete')) {
passthru('/usr/local/etc/rc.reboot');
exit;
}
}
/* config may have changed via installer import */
OPNsense\Core\Config::getInstance()->forceReload(); OPNsense\Core\Config::getInstance()->forceReload();
} }
...@@ -174,7 +139,7 @@ echo "done.\n"; ...@@ -174,7 +139,7 @@ echo "done.\n";
* avoid a reboot and thats a good thing. * avoid a reboot and thats a good thing.
*/ */
if (is_interface_mismatch()) { if (is_interface_mismatch()) {
echo PHP_EOL . gettext('Default interfaces not found -- Running interface assignment option.') . PHP_EOL; echo "\nDefault interfaces not found -- Running interface assignment option.\n";
while (!set_networking_interfaces_ports(true)); while (!set_networking_interfaces_ports(true));
} }
...@@ -210,10 +175,6 @@ interfaces_loopback_configure(); ...@@ -210,10 +175,6 @@ interfaces_loopback_configure();
/* start syslogd */ /* start syslogd */
system_syslogd_start(); system_syslogd_start();
echo "Starting Secure Shell Services...";
mwexec("/usr/local/etc/rc.sshd");
echo "done.\n";
/* set up interfaces */ /* set up interfaces */
mute_kernel_msgs(); mute_kernel_msgs();
openvpn_prepare_all(); openvpn_prepare_all();
...@@ -249,8 +210,11 @@ echo "Synchronizing user settings..."; ...@@ -249,8 +210,11 @@ echo "Synchronizing user settings...";
local_sync_accounts(); local_sync_accounts();
echo "done.\n"; echo "done.\n";
/* start ssh daemon */
mwexec("/usr/local/etc/rc.sshd");
/* start web server */ /* start web server */
echo 'Starting webConfigurator...'. (system_webgui_configure() ? 'done.' : 'failed.') . PHP_EOL; echo 'Starting webConfigurator...'. (system_webgui_configure() ? "done.\n" : "failed.\n");
/* configure cron service */ /* configure cron service */
echo "Configuring CRON..."; echo "Configuring CRON...";
...@@ -343,3 +307,40 @@ if ($ipsec_dynamic_hosts) { ...@@ -343,3 +307,40 @@ if ($ipsec_dynamic_hosts) {
// generate configuration data for all installed templates // generate configuration data for all installed templates
configd_run('template reload *'); configd_run('template reload *');
if ($setup_installer) {
/*
* Installer mode requires setting up an extra user and
* we will protect it with root's password. We can only
* do this if user does not exist, though.
*/
$root = null;
if (isset($config['system']['user'])) {
foreach ($config['system']['user'] as $user) {
if ($user['name'] == 'installer') {
$root = null;
break;
}
if ($user['uid'] == 0) {
$root = $user;
}
}
}
if ($root) {
$root['shell'] = '/usr/local/etc/rc.installer';
$root['name'] = 'installer';
local_user_set($root);
mwexec("/usr/local/etc/rc.sshd installer");
echo "\n";
echo "Welcome! Both `root' and `installer' users are availabe for system\n";
echo "setup or invoking the installer, respectively. The predefined root\n";
echo "password works for both accounts. Remote login via SSH is possible.\n\n";
}
}
exit(0);
src/etc/rc.initial
View file @ ba2eedc1
#!/bin/sh #!/bin/sh
# Copyright (c) 2014-2015 Franco Fichtner <franco@opnsense.org> # Copyright (c) 2014-2016 Franco Fichtner <franco@opnsense.org>
# Copyright (c) 2004-2011 Scott Ullrich <sullrich@gmail.com> # Copyright (c) 2004-2011 Scott Ullrich <sullrich@gmail.com>
# Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net> # Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net>
# All rights reserved. # All rights reserved.
...@@ -9,14 +9,6 @@ ...@@ -9,14 +9,6 @@
trap : 2 trap : 2
trap : 3 trap : 3
# If recovery console shell option has been specified
if [ -f "/tmp/donotbootup" ]; then
rm /tmp/donotbootup
/bin/csh
/usr/local/etc/rc.reboot
# no coming back from here
fi
# shell started with parameters, passthrough to real shell # shell started with parameters, passthrough to real shell
if [ -n "${*}" ]; then if [ -n "${*}" ]; then
/bin/csh "${@}" /bin/csh "${@}"
...@@ -28,13 +20,6 @@ while : ; do ...@@ -28,13 +20,6 @@ while : ; do
echo echo
# If we are on the install media advertise that fact
if _tmpdir=$(mktemp -d -q /.diskless.XXXXXX); then
rmdir ${_tmpdir}
else
option99="99) Launch the installer"
fi
echo " 0) Logout 7) Ping host" echo " 0) Logout 7) Ping host"
echo " 1) Assign Interfaces 8) Shell" echo " 1) Assign Interfaces 8) Shell"
echo " 2) Set interface(s) IP address 9) pfTop" echo " 2) Set interface(s) IP address 9) pfTop"
...@@ -42,10 +27,6 @@ echo " 3) Reset the root password 10) Filter Logs" ...@@ -42,10 +27,6 @@ echo " 3) Reset the root password 10) Filter Logs"
echo " 4) Reset to factory defaults 11) Restart web interface" echo " 4) Reset to factory defaults 11) Restart web interface"
echo " 5) Power off system 12) Upgrade from console" echo " 5) Power off system 12) Upgrade from console"
echo " 6) Reboot system 13) Restore a configuration" echo " 6) Reboot system 13) Restore a configuration"
if [ -n "${option99}" ]; then
# flat for alignment...
echo " ${option99}"
fi
echo echo
read -p "Enter an option: " OPCODE read -p "Enter an option: " OPCODE
...@@ -95,9 +76,6 @@ case ${OPCODE} in ...@@ -95,9 +76,6 @@ case ${OPCODE} in
13) 13)
/usr/local/etc/rc.restore_config_backup /usr/local/etc/rc.restore_config_backup
;; ;;
99)
/usr/local/etc/rc.installer
;;
*) *)
/bin/sh -c "${OPCODE}" /bin/sh -c "${OPCODE}"
;; ;;
......
src/etc/rc.installer
View file @ ba2eedc1
...@@ -40,7 +40,7 @@ daemon -f lua50c51 /usr/local/share/dfuibe_lua/main.lua \ ...@@ -40,7 +40,7 @@ daemon -f lua50c51 /usr/local/share/dfuibe_lua/main.lua \
conscontrol mute on > /dev/null conscontrol mute on > /dev/null
# Launch the frontend goo (must include cons25 for first boot) # Launch the frontend goo (must include cons25 for first boot)
TERM=cons25 dfuife_curses TERM=cons25 dfuife_curses -b /usr/local/share/dfuife_curses/hourglass.txt
conscontrol mute off > /dev/null conscontrol mute off > /dev/null
......
src/etc/rc.recover
View file @ ba2eedc1
...@@ -70,6 +70,7 @@ $etc_master_passwd = <<<EOF ...@@ -70,6 +70,7 @@ $etc_master_passwd = <<<EOF
# #
root::0:0::0:0:Charlie &:/root:/bin/csh root::0:0::0:0:Charlie &:/root:/bin/csh
toor:*:0:0::0:0:Bourne-again Superuser:/root: toor:*:0:0::0:0:Bourne-again Superuser:/root:
installer:*:0:0::0:0:Installer Superuser:/root:/usr/sbin/nologin
daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin
operator:*:2:5::0:0:System &:/:/usr/sbin/nologin operator:*:2:5::0:0:System &:/:/usr/sbin/nologin
bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin
...@@ -106,6 +107,7 @@ $etc_shells = <<<EOF ...@@ -106,6 +107,7 @@ $etc_shells = <<<EOF
/bin/csh /bin/csh
/bin/tcsh /bin/tcsh
/usr/local/etc/rc.initial /usr/local/etc/rc.initial
/usr/local/etc/rc.installer
EOF; EOF;
......
src/etc/rc.sshd
View file @ ba2eedc1
...@@ -4,7 +4,7 @@ ...@@ -4,7 +4,7 @@
/* /*
Copyright (C) 2004 Scott K Ullrich Copyright (C) 2004 Scott K Ullrich
Copyright (C) 2004 Fred Mol <fredmol@xs4all.nl>. Copyright (C) 2004 Fred Mol <fredmol@xs4all.nl>.
Copyright (C) 2015 Franco Fichtner <franco@opnsense.org> Copyright (C) 2015-2016 Franco Fichtner <franco@opnsense.org>
All rights reserved. All rights reserved.
Redistribution and use in source and binary forms, with or without Redistribution and use in source and binary forms, with or without
...@@ -39,7 +39,18 @@ $etc_ssh = '/usr/local/etc/ssh'; ...@@ -39,7 +39,18 @@ $etc_ssh = '/usr/local/etc/ssh';
/* if run from a shell session, `-af' and the full path is needed */ /* if run from a shell session, `-af' and the full path is needed */
mwexecf('/bin/pkill -af %s', $sbin_sshd); mwexecf('/bin/pkill -af %s', $sbin_sshd);
if (!isset($config['system']['ssh']['enabled'])) { $sshcfg = null;
if (isset($config['system']['ssh'])) {
if (isset($config['system']['ssh']['enabled'])) {
$sshcfg = $config['system']['ssh'];
}
} elseif (count($argv) > 1 && $argv[1] == 'installer') {
/* only revert to installer config when ssh is not set at all */
$sshcfg = array( 'permitrootlogin' => 1, 'passwordauth' => 1);
}
if ($sshcfg === null) {
return; return;
} }
...@@ -73,21 +84,8 @@ foreach($keys as $name) { ...@@ -73,21 +84,8 @@ foreach($keys as $name) {
/* Login related files. */ /* Login related files. */
touch("/var/log/lastlog"); touch("/var/log/lastlog");
if (isset($config['system']['ssh']['port'])) { $sshport = isset($sshcfg['port']) ? $sshcfg['port'] : 22;
$sshport = $config['system']['ssh']['port'];
} else {
$sshport = 22;
}
/*
* XXX ZOMG sshd_config BOOTSTRAPPING ACTION
*
* We can't just ditch the system file by default and roll
* our own. Instead, use the current file to find the actual
* settings that need toggling, then toggle them!
*/
/* Include default configuration for OPNsense */
$sshconf = "# This file was automatically generated by /usr/local/etc/rc.sshd\n"; $sshconf = "# This file was automatically generated by /usr/local/etc/rc.sshd\n";
$sshconf .= "Port {$sshport}\n"; $sshconf .= "Port {$sshport}\n";
$sshconf .= "Protocol 2\n"; $sshconf .= "Protocol 2\n";
...@@ -98,10 +96,10 @@ $sshconf .= "UseDNS no\n"; ...@@ -98,10 +96,10 @@ $sshconf .= "UseDNS no\n";
$sshconf .= "X11Forwarding no\n"; $sshconf .= "X11Forwarding no\n";
$sshconf .= "PubkeyAuthentication yes\n"; $sshconf .= "PubkeyAuthentication yes\n";
$sshconf .= "Subsystem\tsftp\tinternal-sftp\n"; $sshconf .= "Subsystem\tsftp\tinternal-sftp\n";
if (isset($config['system']['ssh']['permitrootlogin'])) { if (isset($sshcfg['permitrootlogin'])) {
$sshconf .= "PermitRootLogin yes\n"; $sshconf .= "PermitRootLogin yes\n";
} }
if (isset($config['system']['ssh']['passwordauth'])) { if (isset($sshcfg['passwordauth'])) {
$sshconf .= "ChallengeResponseAuthentication yes\n"; $sshconf .= "ChallengeResponseAuthentication yes\n";
$sshconf .= "PasswordAuthentication yes\n"; $sshconf .= "PasswordAuthentication yes\n";
} else { } else {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Technounit-GROUP 2023