diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2023-10-04 01:35:06 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2023-10-04 02:11:48 +0200 |
commit | 1a64deeb894dc95e2645a75771732c6cc53a79ad (patch) | |
tree | 1b9df4838f894577a09b9b260151756272efeb53 /modules/private/pub | |
parent | fa25ffd4583cc362075cd5e1b4130f33306103f0 (diff) | |
download | Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.tar.gz Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.tar.zst Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.zip |
Squash changes containing private information
There were a lot of changes since the previous commit, but a lot of them
contained personnal information about users. All thos changes got
stashed into a single commit (history is kept in a different place) and
private information was moved in a separate private repository
Diffstat (limited to 'modules/private/pub')
-rw-r--r-- | modules/private/pub/default.nix | 56 | ||||
-rw-r--r-- | modules/private/pub/ldap_pub.sh | 56 | ||||
-rw-r--r-- | modules/private/pub/restrict | 64 | ||||
-rw-r--r-- | modules/private/pub/tmux.restrict.conf | 43 |
4 files changed, 0 insertions, 219 deletions
diff --git a/modules/private/pub/default.nix b/modules/private/pub/default.nix deleted file mode 100644 index c419530..0000000 --- a/modules/private/pub/default.nix +++ /dev/null | |||
@@ -1,56 +0,0 @@ | |||
1 | { lib, pkgs, config, ... }: | ||
2 | { | ||
3 | options = { | ||
4 | myServices.pub.enable = lib.mkOption { | ||
5 | type = lib.types.bool; | ||
6 | default = false; | ||
7 | description = '' | ||
8 | Whether to enable pub user. | ||
9 | ''; | ||
10 | }; | ||
11 | }; | ||
12 | |||
13 | config = lib.mkIf config.myServices.pub.enable { | ||
14 | myServices.ssh.modules = [{ | ||
15 | snippet = builtins.readFile ./ldap_pub.sh; | ||
16 | dependencies = [ pkgs.coreutils ]; | ||
17 | }]; | ||
18 | users.users.pub = let | ||
19 | restrict = pkgs.runCommand "restrict" { | ||
20 | file = ./restrict; | ||
21 | buildInputs = [ pkgs.makeWrapper ]; | ||
22 | } '' | ||
23 | mkdir -p $out/bin | ||
24 | cp $file $out/bin/restrict | ||
25 | chmod a+x $out/bin/restrict | ||
26 | patchShebangs $out/bin/restrict | ||
27 | wrapProgram $out/bin/restrict \ | ||
28 | --prefix PATH : ${lib.makeBinPath [ pkgs.bubblewrap pkgs.rrsync ]} \ | ||
29 | --set TMUX_RESTRICT ${./tmux.restrict.conf} | ||
30 | ''; | ||
31 | purple-hangouts = pkgs.purple-hangouts.overrideAttrs(old: { | ||
32 | installPhase = '' | ||
33 | install -Dm755 -t $out/lib/purple-2/ libhangouts.so | ||
34 | for size in 16 22 24 48; do | ||
35 | install -TDm644 hangouts$size.png $out/share/pixmaps/pidgin/protocols/$size/hangouts.png | ||
36 | done | ||
37 | ''; | ||
38 | }); | ||
39 | in { | ||
40 | createHome = true; | ||
41 | description = "Restricted shell user"; | ||
42 | home = "/var/lib/pub"; | ||
43 | uid = config.myEnv.users.pub.uid; | ||
44 | useDefaultShell = true; | ||
45 | packages = [ | ||
46 | restrict | ||
47 | pkgs.tmux | ||
48 | (pkgs.pidgin.override { plugins = [ | ||
49 | pkgs.purple-plugin-pack purple-hangouts | ||
50 | pkgs.purple-discord pkgs.purple-facebook | ||
51 | pkgs.telegram-purple | ||
52 | ]; }) | ||
53 | ]; | ||
54 | }; | ||
55 | }; | ||
56 | } | ||
diff --git a/modules/private/pub/ldap_pub.sh b/modules/private/pub/ldap_pub.sh deleted file mode 100644 index bbbefdc..0000000 --- a/modules/private/pub/ldap_pub.sh +++ /dev/null | |||
@@ -1,56 +0,0 @@ | |||
1 | ### This snippet is not standalone and must be integrated in the global ldap_authorized_keys.sh | ||
2 | LDAP_PUB_RESTRICT_MEMBER="cn=restrict,cn=pub,ou=services,dc=immae,dc=eu" | ||
3 | LDAP_PUB_FORWARD_MEMBER="cn=forward,cn=pub,ou=services,dc=immae,dc=eu" | ||
4 | ECHO=$(which echo) | ||
5 | |||
6 | if [[ $user == pub ]]; then | ||
7 | ldap_search '(&(memberOf='$LDAP_PUB_RESTRICT_MEMBER')('$KEY'=*))' $KEY | \ | ||
8 | while read line ; | ||
9 | do | ||
10 | if [ ! -z "$line" ]; then | ||
11 | if [[ $line == dn* ]]; then | ||
12 | echo "" | ||
13 | user=$(sed -n 's/.*uid=\([^,]*\).*/\1/p' <<< "$line") | ||
14 | echo "# $user" | ||
15 | elif [[ $line == $KEY* ]]; then | ||
16 | key=$(clean_key_line pub "$line") | ||
17 | key_forward=$(clean_key_line forward "$line") | ||
18 | if [ ! -z "$key" ]; then | ||
19 | if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then | ||
20 | echo -n 'command="/etc/profiles/per-user/pub/bin/restrict '$user'" ' | ||
21 | echo $key | ||
22 | fi | ||
23 | elif [ ! -z "$key_forward" ]; then | ||
24 | if [[ $key_forward != *$'\n'* ]] && [[ $key_forward == ssh-* ]]; then | ||
25 | echo "# forward only" | ||
26 | echo -n 'no-pty,no-X11-forwarding,command="'$ECHO' forward only" ' | ||
27 | echo $key_forward | ||
28 | fi | ||
29 | fi | ||
30 | fi | ||
31 | fi | ||
32 | done | ||
33 | |||
34 | echo "" | ||
35 | ldap_search '(&(memberOf='$LDAP_PUB_FORWARD_MEMBER')('$KEY'=*))' $KEY | \ | ||
36 | while read line ; | ||
37 | do | ||
38 | if [ ! -z "$line" ]; then | ||
39 | if [[ $line == dn* ]]; then | ||
40 | echo "" | ||
41 | user=$(sed -n 's/.*uid=\([^,]*\).*/\1/p' <<< "$line") | ||
42 | echo "# $user" | ||
43 | elif [[ $line == $KEY* ]]; then | ||
44 | key=$(clean_key_line forward "$line") | ||
45 | if [ ! -z "$key" ]; then | ||
46 | if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then | ||
47 | echo -n 'no-pty,no-X11-forwarding,command="'$ECHO' forward only" ' | ||
48 | echo $key | ||
49 | fi | ||
50 | fi | ||
51 | fi | ||
52 | fi | ||
53 | done | ||
54 | exit 0 | ||
55 | fi | ||
56 | |||
diff --git a/modules/private/pub/restrict b/modules/private/pub/restrict deleted file mode 100644 index b2f3be3..0000000 --- a/modules/private/pub/restrict +++ /dev/null | |||
@@ -1,64 +0,0 @@ | |||
1 | #!/usr/bin/env bash | ||
2 | user="$1" | ||
3 | rootuser="$HOME/$user/" | ||
4 | mkdir -p $rootuser | ||
5 | |||
6 | orig="$SSH_ORIGINAL_COMMAND" | ||
7 | if [ -z "$orig" ]; then | ||
8 | orig="/bin/bash -l" | ||
9 | fi | ||
10 | if [ "${orig:0:7}" = "command" ]; then | ||
11 | orig="${orig:8}" | ||
12 | fi | ||
13 | |||
14 | case "$orig" in | ||
15 | rsync*) | ||
16 | rrsync $HOME/$user/ | ||
17 | ;; | ||
18 | *) | ||
19 | nix_store_paths() { | ||
20 | nix-store -q -R \ | ||
21 | /run/current-system/sw \ | ||
22 | /etc/profiles/per-user/pub \ | ||
23 | /etc/ssl/certs/ca-bundle.crt \ | ||
24 | | while read i; do | ||
25 | printf '%s--ro-bind\0'$i'\0'$i'\0' '' | ||
26 | done | ||
27 | } | ||
28 | |||
29 | set -euo pipefail | ||
30 | (exec -c bwrap --ro-bind /usr /usr \ | ||
31 | --args 10 \ | ||
32 | --dir /tmp \ | ||
33 | --dir /var \ | ||
34 | --symlink ../tmp var/tmp \ | ||
35 | --proc /proc \ | ||
36 | --dev /dev \ | ||
37 | --ro-bind /etc/resolv.conf /etc/resolv.conf \ | ||
38 | --ro-bind /etc/zoneinfo /etc/zoneinfo \ | ||
39 | --ro-bind /etc/ssl /etc/ssl \ | ||
40 | --ro-bind /etc/static/ssl/certs /etc/static/ssl/certs \ | ||
41 | --ro-bind /run/current-system/sw/lib/locale/locale-archive /etc/locale-archive \ | ||
42 | --ro-bind /run/current-system/sw/bin /bin \ | ||
43 | --ro-bind /etc/profiles/per-user/pub/bin /bin-pub \ | ||
44 | --bind /var/lib/pub/$user /var/lib/pub \ | ||
45 | --dir /var/lib/commons \ | ||
46 | --ro-bind $TMUX_RESTRICT /var/lib/commons/tmux.restrict.conf \ | ||
47 | --chdir /var/lib/pub \ | ||
48 | --unshare-all \ | ||
49 | --share-net \ | ||
50 | --dir /run/user/$(id -u) \ | ||
51 | --setenv TERM "$TERM" \ | ||
52 | --setenv LOCALE_ARCHIVE "/etc/locale-archive" \ | ||
53 | --setenv XDG_RUNTIME_DIR "/run/user/`id -u`" \ | ||
54 | --setenv PS1 "$user@pub $ " \ | ||
55 | --setenv PATH "/bin:/bin-pub" \ | ||
56 | --setenv HOME "/var/lib/pub" \ | ||
57 | --file 11 /etc/passwd \ | ||
58 | --file 12 /etc/group \ | ||
59 | -- $orig) \ | ||
60 | 10< <(nix_store_paths) \ | ||
61 | 11< <(getent passwd $UID 65534) \ | ||
62 | 12< <(getent group $(id -g) 65534) | ||
63 | ;; | ||
64 | esac | ||
diff --git a/modules/private/pub/tmux.restrict.conf b/modules/private/pub/tmux.restrict.conf deleted file mode 100644 index 5aefd1c..0000000 --- a/modules/private/pub/tmux.restrict.conf +++ /dev/null | |||
@@ -1,43 +0,0 @@ | |||
1 | # Pour les nostalgiques de screen | ||
2 | # comme les raccourcis ne sont pas les mêmes, j'évite | ||
3 | set -g prefix C-a | ||
4 | unbind-key C-b | ||
5 | |||
6 | unbind-key -a | ||
7 | bind-key -n C-h list-keys | ||
8 | bind-key C-d detach | ||
9 | bind-key & confirm-before -p "kill-window #W? (y/n)" kill-window | ||
10 | |||
11 | # même hack que sur screen lorsqu'on veut profiter du scroll du terminal | ||
12 | # (xterm ...) | ||
13 | set -g terminal-overrides 'xterm*:smcup@:rmcup@' | ||
14 | |||
15 | #Pour les ctrl+arrow | ||
16 | set-option -g xterm-keys on | ||
17 | |||
18 | # c'est un minimum (defaut 2000) | ||
19 | set-option -g history-limit 10000 | ||
20 | |||
21 | # lorsque j'ai encore un tmux ailleurs seule | ||
22 | # sa fenetre active réduit la taille de ma fenetre locale | ||
23 | setw -g aggressive-resize on | ||
24 | |||
25 | # Pour etre alerté sur un changement dans une autre fenêtre | ||
26 | setw -g monitor-activity on | ||
27 | #set -g visual-activity on | ||
28 | #set -g visual-bell on | ||
29 | |||
30 | set -g base-index 1 | ||
31 | |||
32 | # repercuter le contenu de la fenetre dans la barre de titre | ||
33 | # reference des string : man tmux (status-left) | ||
34 | set -g set-titles on | ||
35 | set -g set-titles-string '#H #W #T' # host window command | ||
36 | |||
37 | #Dans les valeurs par defaut deja, avec le ssh-agent | ||
38 | set -g update-environment "DISPLAY SSH_ASKPASS SSH_AUTH_SOCK SSH_AGENT_PID SSH_CONNECTION WINDOWID XAUTHORITY PATH" | ||
39 | |||
40 | set -g status off | ||
41 | set -g status-left '' | ||
42 | set -g status-right '' | ||
43 | |||