From: Daniel Lezcano Date: Sun, 27 Dec 2009 21:36:09 +0000 (+0100) Subject: adapt lxc-sshd to be a template X-Git-Tag: lxc-0.6.5~47 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=418c73ad12f34e461782c0b0514e0ad9729381bc;p=thirdparty%2Flxc.git adapt lxc-sshd to be a template Cleanup the script, simplify it and pass the arguments to this script to be callable by lxc-create template logic. Signed-off-by: Daniel Lezcano --- diff --git a/scripts/lxc-sshd.in b/scripts/lxc-sshd.in index 28e414052..497bbfd88 100755 --- a/scripts/lxc-sshd.in +++ b/scripts/lxc-sshd.in @@ -1,474 +1,192 @@ #!/bin/bash -ascii_tarball() { -cat < + +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. + +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. + +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +install_sshd() +{ + rootfs=$1 + + tree="\ +$rootfs/var/run \ +$rootfs/var/empty/sshd \ +$rootfs/var/lib/empty/sshd \ +$rootfs/etc/ssh \ +$rootfs/dev/shm \ +$rootfs/proc \ +$rootfs/bin \ +$rootfs/sbin \ +$rootfs/usr \ +$rootfs/tmp \ +$rootfs/home \ +$rootfs/root \ +$rootfs/lib \ +$rootfs/lib64" + + mkdir -p $tree + if [ $? -ne 0 ]; then + return 1 fi - decode_tarball | tar xz -C $1 + return 0 } -NAME="sshd" -CONFFILE="lxc.conf" -UTSNAME= -IPV4="172.20.0.20/24" - -create() { - - echo -n "What is the container name ? [$NAME] " - read _NAME_ - - if [ ! -z "$_NAME_" ]; then - NAME=$_NAME_ - fi - - echo -n "What hostname do you wish for this container ? [$NAME] " - read _UTSNAME_ - - if [ ! -z "$_UTSNAME_" ]; then - UTSNAME=$_UTSNAME_ - else - UTSNAME=$NAME - fi - - echo -n "What IP address do you wish for this container ? [$IPV4] " - read _IPV4_ +configure_sshd() +{ + rootfs=$1 - if [ ! -z "$_IPV4_" ]; then - IPV4=$_IPV4_ - fi + cat < $rootfs/etc/passwd +root:x:0:0:root:/root:/bin/bash +sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin +EOF - ROOTFS="./rootfs.$NAME" + cat < $rootfs/etc/group +root:x:0:root +sshd:x:74: +EOF - if [ ! -e $ROOTFS ]; then - mkdir $ROOTFS && untar_tarball $ROOTFS - fi +ssh-keygen -t rsa -f $rootfs/etc/ssh/ssh_host_rsa_key +ssh-keygen -t dsa -f $rootfs/etc/ssh/ssh_host_dsa_key + + # by default setup root password with no password + cat < $rootfs/etc/ssh/sshd_config +Port 22 +Protocol 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +UsePrivilegeSeparation yes +KeyRegenerationInterval 3600 +ServerKeyBits 768 +SyslogFacility AUTH +LogLevel INFO +LoginGraceTime 120 +PermitRootLogin yes +StrictModes yes +RSAAuthentication yes +PubkeyAuthentication yes +IgnoreRhosts yes +RhostsRSAAuthentication no +HostbasedAuthentication no +PermitEmptyPasswords yes +ChallengeResponseAuthentication no +EOF + return 0 +} -cat < $CONFFILE -lxc.utsname = $UTSNAME -lxc.network.type = veth -lxc.network.flags = up -lxc.network.link = br0 -lxc.network.ipv4 = $IPV4 -lxc.network.name = eth0 -lxc.rootfs = $ROOTFS -lxc.mount.entry=/lib $(pwd)/$ROOTFS/lib none ro,bind 0 0 -lxc.mount.entry=/bin $(pwd)/$ROOTFS/bin none ro,bind 0 0 -lxc.mount.entry=/usr $(pwd)/$ROOTFS/usr none ro,bind 0 0 -lxc.mount.entry=/sbin $(pwd)/$ROOTFS/sbin none ro,bind 0 0 +copy_configuration() +{ + path=$1 + rootfs=$2 + name=$3 + +cat <> $path/config +lxc.utsname = $name +lxc.pts = 1024 +lxc.rootfs = $rootfs +lxc.mount.entry=/dev $rootfs/dev none ro,bind 0 0 +lxc.mount.entry=/lib $rootfs/lib none ro,bind 0 0 +lxc.mount.entry=/bin $rootfs/bin none ro,bind 0 0 +lxc.mount.entry=/usr /$rootfs/usr none ro,bind 0 0 +lxc.mount.entry=/sbin $rootfs/sbin none ro,bind 0 0 +lxc.mount.entry=tmpfs $rootfs/var/run tmpfs defaults 0 0 +lxc.mount.entry=@BINDIR@/lxc-sshd $rootfs/sbin/init none bind 0 0 EOF if [ "$(uname -m)" = "x86_64" ]; then -cat <> $CONFFILE -lxc.mount.entry=/lib64 $(pwd)/$ROOTFS/lib64 none ro,bind 0 0 + cat <> $path/config +lxc.mount.entry=/lib64 $rootfs/lib64 none ro,bind 0 0 EOF fi - - @BINDIR@/lxc-create -n $NAME -f $CONFFILE - - rm -f $CONFFILE - - echo "Done." - echo -e "\nYou can run your container with: \n\t\ -'lxc-execute -n $NAME /usr/sbin/sshd &'\n" } -destroy() { +usage() +{ + cat < +EOF + return 0 +} - echo -n "What is the container name ? [$NAME] " - read _NAME_ +options=$(getopt -o hp:n: -l help,path:,name: -- "$@") +if [ $? -ne 0 ]; then + usage $(basename $0) + exit 1 +fi +eval set -- "$options" + +while true +do + case "$1" in + -h|--help) usage $0 && exit 0;; + -p|--path) path=$2; shift 2;; + -n|--name) name=$2; shift 2;; + --) shift 1; break ;; + *) break ;; + esac +done - if [ ! -z "$_NAME_" ]; then - NAME=$_NAME_ - fi +if [ "$(id -u)" != "0" ]; then + echo "This script should be run as 'root'" + exit 1 +fi - ROOTFS="./rootfs.$NAME" +if [ $0 == "/sbin/init" ]; then - echo -n "Shall I remove the rootfs [y/n] ? " - read - if [ "$REPLY" = "y" ]; then - rm -rf $ROOTFS + type @LIBEXECDIR@/lxc-init + if [ $? -ne 0 ]; then + echo "'lxc-init is not accessible on the system" + exit 1 fi - @BINDIR@/lxc-destroy -n $NAME -} - -help() { -cat <