freedombone-adduser 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Adds an user to the system
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. PROJECT_NAME='freedombone'
  30. export TEXTDOMAIN=${PROJECT_NAME}-adduser
  31. export TEXTDOMAINDIR="/usr/share/locale"
  32. MY_USERNAME=$1
  33. SSH_PUBLIC_KEY="$2"
  34. GPG_KEYSERVER='hkp://keys.gnupg.net'
  35. SSH_PORT=2222
  36. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  37. SIP_EXTENSION=
  38. FULLBLOG_DOMAIN_NAME=
  39. if [ ! $MY_USERNAME ]; then
  40. echo $'No username was given'
  41. exit 1
  42. fi
  43. if [ -d /home/$MY_USERNAME ]; then
  44. echo $"The user $MY_USERNAME already exists"
  45. exit 2
  46. fi
  47. if [ ! -f $COMPLETION_FILE ]; then
  48. echo $"$COMPLETION_FILE not found"
  49. userdel -r $MY_USERNAME
  50. exit 3
  51. fi
  52. NEW_USER_PASSWORD="$(openssl rand -base64 10 | cut -c1-8)"
  53. useradd -m -p "$NEW_USER_PASSWORD" -s /bin/bash $MY_USERNAME
  54. adduser $MY_USERNAME sasl
  55. if [ ! -d /home/$MY_USERNAME ]; then
  56. echo $'Home directory was not created'
  57. exit 4
  58. fi
  59. if [ "$SSH_PUBLIC_KEY" ]; then
  60. if [ ${#SSH_PUBLIC_KEY} -gt 5 ]; then
  61. if [ -f "$SSH_PUBLIC_KEY" ]; then
  62. mkdir /home/$MY_USERNAME/.ssh
  63. cp $SSH_PUBLIC_KEY /home/$MY_USERNAME/.ssh/authorized_keys
  64. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  65. echo $'ssh public key installed'
  66. else
  67. if [[ "$SSH_PUBLIC_KEY" == "ssh-"* ]]; then
  68. mkdir /home/$MY_USERNAME/.ssh
  69. echo "$SSH_PUBLIC_KEY" > /home/$MY_USERNAME/.ssh/authorized_keys
  70. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  71. echo $'ssh public key installed'
  72. else
  73. echo $'The second parameter does not look like an ssh key'
  74. exit 5
  75. fi
  76. fi
  77. fi
  78. fi
  79. if [ ! -d /home/$MY_USERNAME/Maildir ]; then
  80. echo $'Email directory was not created'
  81. userdel -r $MY_USERNAME
  82. exit 6
  83. fi
  84. if grep -q "set from=" /home/$MY_USERNAME/.muttrc; then
  85. sed -i "s|set from=.*|set from='$MY_USERNAME <$MY_USERNAME@$HOSTNAME>'|g" /home/$MY_USERNAME/.muttrc
  86. else
  87. echo "set from='$MY_USERNAME <$MY_USERNAME@$HOSTNAME>'" >> /home/$MY_USERNAME/.muttrc
  88. fi
  89. USERN='$USER@'
  90. sed -i "s|$USERN|$MY_USERNAME@|g" /home/$MY_USERNAME/.procmailrc
  91. # generate a gpg key
  92. echo "Making a GPG key for $MY_USERNAME@$HOSTNAME"
  93. mkdir /home/$MY_USERNAME/.gnupg
  94. echo "keyserver $GPG_KEYSERVER" >> /home/$MY_USERNAME/.gnupg/gpg.conf
  95. echo 'keyserver-options auto-key-retrieve' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  96. echo '' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  97. echo '# default preferences' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  98. echo 'personal-digest-preferences SHA256' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  99. echo 'cert-digest-algo SHA256' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  100. echo 'default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed' >> /home/$MY_USERNAME/.gnupg/gpg.conf
  101. chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.gnupg
  102. chmod 700 /home/$MY_USERNAME/.gnupg
  103. chmod 600 /home/$MY_USERNAME/.gnupg/*
  104. # Generate a GPG key
  105. echo 'Key-Type: 1' > /home/$MY_USERNAME/gpg-genkey.conf
  106. echo 'Key-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  107. echo 'Subkey-Type: 1' >> /home/$MY_USERNAME/gpg-genkey.conf
  108. echo 'Subkey-Length: 4096' >> /home/$MY_USERNAME/gpg-genkey.conf
  109. echo "Name-Real: $MY_USERNAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  110. echo "Name-Email: $MY_USERNAME@$HOSTNAME" >> /home/$MY_USERNAME/gpg-genkey.conf
  111. echo 'Expire-Date: 0' >> /home/$MY_USERNAME/gpg-genkey.conf
  112. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/gpg-genkey.conf
  113. su -c "gpg --batch --gen-key /home/$MY_USERNAME/gpg-genkey.conf" - $MY_USERNAME
  114. shred -zu /home/$MY_USERNAME/gpg-genkey.conf
  115. MY_GPG_PUBLIC_KEY_ID=$(su -c "gpg --list-keys $MY_USERNAME@$HOSTNAME | grep 'pub '" - $MY_USERNAME | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  116. MY_GPG_PUBLIC_KEY=/home/$MY_USERNAME/public_key.gpg
  117. su -c "gpg --output $MY_GPG_PUBLIC_KEY --armor --export $MY_GPG_PUBLIC_KEY_ID" - $MY_USERNAME
  118. if [ ! -f $MY_GPG_PUBLIC_KEY ]; then
  119. echo "GPG public key was not generated for $MY_USERNAME@$HOSTNAME $MY_GPG_PUBLIC_KEY_ID"
  120. userdel -r $MY_USERNAME
  121. exit 7
  122. fi
  123. # encrypt outgoing mail to the "sent" folder
  124. if ! grep -q "pgp_encrypt_only_command" /home/$MY_USERNAME/.muttrc; then
  125. echo '' >> /home/$MY_USERNAME/.muttrc
  126. echo $'# Encrypt items in the Sent folder' >> /home/$MY_USERNAME/.muttrc
  127. echo "set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  128. else
  129. sed -i "s|set pgp_encrypt_only_command.*|set pgp_encrypt_only_command=\"/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  130. fi
  131. if ! grep -q "pgp_encrypt_sign_command" /home/$MY_USERNAME/.muttrc; then
  132. echo "set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"" >> /home/$MY_USERNAME/.muttrc
  133. else
  134. sed -i "s|set pgp_encrypt_sign_command.*|set pgp_encrypt_sign_command=\"/usr/lib/mutt/pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust --encrypt-to 0x$MY_GPG_PUBLIC_KEY_ID -- -r %r -- %f\"|g" /home/$MY_USERNAME/.muttrc
  135. fi
  136. if ! grep -q "Change your GPG password" /home/$MY_USERNAME/README; then
  137. echo '' >> /home/$MY_USERNAME/README
  138. echo '' >> /home/$MY_USERNAME/README
  139. echo $'Change your GPG password' >> /home/$MY_USERNAME/README
  140. echo '========================' >> /home/$MY_USERNAME/README
  141. echo $"It's very important to add a password to your GPG key so that" >> /home/$MY_USERNAME/README
  142. echo $"if anyone does get access to your email they still won't be able" >> /home/$MY_USERNAME/README
  143. echo $'to read them without knowning the GPG password.' >> /home/$MY_USERNAME/README
  144. echo $'You can change the it with:' >> /home/$MY_USERNAME/README
  145. echo '' >> /home/$MY_USERNAME/README
  146. echo " gpg --edit-key $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
  147. echo ' passwd' >> /home/$MY_USERNAME/README
  148. echo ' save' >> /home/$MY_USERNAME/README
  149. echo ' quit' >> /home/$MY_USERNAME/README
  150. fi
  151. if ! grep -q "Publish your GPG public key" /home/$MY_USERNAME/README; then
  152. echo '' >> /home/$MY_USERNAME/README
  153. echo '' >> /home/$MY_USERNAME/README
  154. echo $'Publish your GPG public key' >> /home/$MY_USERNAME/README
  155. echo '===========================' >> /home/$MY_USERNAME/README
  156. echo $'So that others can send emails to you securely you should' >> /home/$MY_USERNAME/README
  157. echo $'publish your GPG public key with the command:' >> /home/$MY_USERNAME/README
  158. echo '' >> /home/$MY_USERNAME/README
  159. echo " gpg --send-keys $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
  160. fi
  161. chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
  162. chown $MY_USERNAME:$MY_USERNAME $MY_GPG_PUBLIC_KEY
  163. chmod 600 /home/$MY_USERNAME/README
  164. if grep -q "install_xmpp" $COMPLETION_FILE; then
  165. echo $"Adding an XMPP account for $MY_USERNAME"
  166. ${PROJECT_NAME}-addxmpp -e "$MY_USERNAME@$HOSTNAME" -p "$NEW_USER_PASSWORD"
  167. if [ ! "$?" = "0" ]; then
  168. echo $"XMPP account not created"
  169. userdel -r $MY_USERNAME
  170. exit 8
  171. fi
  172. fi
  173. if grep -q "Blog domain" $COMPLETION_FILE; then
  174. FULLBLOG_DOMAIN_NAME=$(cat $COMPLETION_FILE | grep "Blog domain" | awk -F ':' '{print $2}')
  175. if [ ! -d /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users ]; then
  176. echo $'Blog users directory not found'
  177. if grep -q "install_xmpp" $COMPLETION_FILE; then
  178. ${PROJECT_NAME}-rmxmpp -e "$MY_USERNAME@$HOSTNAME"
  179. fi
  180. userdel -r $MY_USERNAME
  181. exit 9
  182. fi
  183. echo ';Password' > /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini
  184. echo "password = '$NEW_USER_PASSWORD'" >> /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini
  185. echo 'encryption = clear' >> /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini
  186. echo ';Role' >> /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini
  187. echo 'role = admin' >> /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini
  188. echo "$MY_USERNAME added as a blog user"
  189. fi
  190. if grep -q "install_sip" $COMPLETION_FILE; then
  191. SIP_EXTENSION=$(${PROJECT_NAME}-sipfreeext)
  192. ${PROJECT_NAME}-addsipuser -u $MY_USERNAME -e $SIP_EXTENSION -p "$NEW_USER_PASSWORD"
  193. if [ ! "$?" = "0" ]; then
  194. echo $'SIP user could not be added. Ensure that extension numbers are in order and do no exceed 299'
  195. if grep -q "install_xmpp" $COMPLETION_FILE; then
  196. ${PROJECT_NAME}-rmxmpp -e "$MY_USERNAME@$HOSTNAME"
  197. fi
  198. if grep -q "Blog domain" $COMPLETION_FILE; then
  199. if [ -f /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini ]; then
  200. rm /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini
  201. fi
  202. fi
  203. userdel -r $MY_USERNAME
  204. exit 10
  205. fi
  206. fi
  207. #if grep -q "install_owncloud" $COMPLETION_FILE; then
  208. # export OC_PASS="$NEW_USER_PASSWORD"
  209. # occ user:add --password-from-env --display-name="$MY_USERNAME" --group="users" $MY_USERNAME
  210. # if [ ! "$?" = "0" ]; then
  211. # echo 'Owncloud user could not be added'
  212. # if grep -q "install_xmpp" $COMPLETION_FILE; then
  213. # ${PROJECT_NAME}-rmxmpp -e "$MY_USERNAME@$HOSTNAME"
  214. # fi
  215. # if grep -q "Blog domain" $COMPLETION_FILE; then
  216. # if [ -f /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini ]; then
  217. # rm /var/www/$FULLBLOG_DOMAIN_NAME/htdocs/config/users/$MY_USERNAME.ini
  218. # fi
  219. # fi
  220. # if grep -q "install_sip" $COMPLETION_FILE; then
  221. # ${PROJECT_NAME}-rmsipuser $MY_USERNAME
  222. # fi
  223. # userdel -r $MY_USERNAME
  224. # export OC_PASS=""
  225. # exit 11
  226. # fi
  227. # export OC_PASS=""
  228. #fi
  229. clear
  230. echo $"New user $MY_USERNAME was created"
  231. if [ $SIP_EXTENSION ]; then
  232. echo $"Their SIP phone extension is $SIP_EXTENSION"
  233. fi
  234. echo $"Their login password is $NEW_USER_PASSWORD"
  235. echo ''
  236. echo $'IMPORTANT: Make a note of the password, because it will not be saved'
  237. echo $'anywhere else. Preferably give it to them in person on paper or via'
  238. echo $'a secure channel, not in an unencrypted email.'
  239. echo ''
  240. echo $"They can download their GPG keys with:"
  241. echo ''
  242. echo " scp -P $SSH_PORT -r $MY_USERNAME@$HOSTNAME:/home/$MY_USERNAME/.gnupg ~/"
  243. echo ''
  244. echo $"They should also run ${PROJECT_NAME}-client on their system to ensure"
  245. echo $'the best security.'
  246. exit 0