102 lines
2.8 KiB
Bash
Executable file
102 lines
2.8 KiB
Bash
Executable file
#!/bin/bash
|
|
#
|
|
# 30-ask-hostname - request the user to type in the hostname of the local host
|
|
#
|
|
# Copyright © 2006-2009 martin f. krafft <madduck@madduck.net>
|
|
# Copyright © 2012 Ludovico Gardenghi <lu@dovi.co>
|
|
# Copyright © 2014 Josh Triplett <josh@joshtriplett.org>
|
|
# Copyright © 2015 Francois Marier <francois@debian.org>
|
|
# Copyright © 2017 Simó Albert i Beltran <sim6@probeta.net>
|
|
# Copyright © 2023 Andrew Ruthven <andrew@etc.gen.nz>
|
|
# Released under the terms of the Artistic Licence 2.0
|
|
#
|
|
set -eu
|
|
|
|
ME=molly-guard
|
|
|
|
# Skip if we're being run by configuration management.
|
|
[ $CONFIGURATION_MANAGEMENT -eq 1 ] && exit 0
|
|
|
|
# Walk up the process tree until PID 1 is reached or a process with 'sshd' in
|
|
# its /proc/<pid>/cmdline is met. Return success if such a process is found.
|
|
is_child_of_sshd_or_mosh_server() {
|
|
pid=$$
|
|
ppid=$PPID
|
|
# Be a bit paranoid with the guard, should some horribly broken system
|
|
# provide a strange process hierarchy. '[ $pid -ne 1 ]' should be enough for
|
|
# sane systems.
|
|
[ -z "$pid" ] || [ -z "$ppid" ] && return 2
|
|
while [ $pid -gt 1 ] && [ $pid -ne $ppid ]; do
|
|
if egrep -q 'sshd|mosh-server|etterminal' /proc/$ppid/cmdline; then
|
|
return 0
|
|
fi
|
|
pid=$ppid
|
|
ppid=$(grep ^PPid: /proc/$pid/status | tr -dc 0-9)
|
|
done
|
|
return 1
|
|
}
|
|
|
|
[ -f "$MOLLYGUARD_SETTINGS" ] && . "$MOLLYGUARD_SETTINGS"
|
|
|
|
PRETEND_SSH=0
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
(*-pretend-ssh) PRETEND_SSH=1;;
|
|
esac
|
|
done
|
|
|
|
# require an interactive terminal connected to stdin
|
|
test -t 0 || exit 0
|
|
|
|
# we've been asked to always protect this host
|
|
case "${ALWAYS_QUERY_HOSTNAME:-0}" in
|
|
0|false|False|no|No|off|Off)
|
|
# only run if we are being called over SSH, that is if the current terminal
|
|
# was created by sshd.
|
|
command -v tty >/dev/null 2>&1 || exit 0
|
|
PTS=$(tty)
|
|
if ! pgrep -f "^sshd.+${PTS#/dev/}\>" >/dev/null \
|
|
&& [ -z "${SSH_CONNECTION:-}" ] \
|
|
&& ! is_child_of_sshd_or_mosh_server; then
|
|
if [ $PRETEND_SSH -eq 1 ]; then
|
|
echo "I: $ME: this is not an SSH session, but --pretend-ssh was given..." >&2
|
|
else
|
|
exit 0
|
|
fi
|
|
else
|
|
echo "W: $ME: SSH session detected!" >&2
|
|
fi
|
|
;;
|
|
*)
|
|
echo "I: $ME: $MOLLYGUARD_CMD is always molly-guarded on this system." >&2
|
|
;;
|
|
esac
|
|
|
|
case "${USE_FQDN:-0}" in
|
|
0|false|False|no|No|off|Off)
|
|
HOSTNAME="$(hostname --short)"
|
|
;;
|
|
*)
|
|
HOSTNAME="$(hostname --fqdn)"
|
|
;;
|
|
esac
|
|
|
|
sigh()
|
|
{
|
|
echo "Good thing I asked; I won't $MOLLYGUARD_CMD $HOSTNAME ..." >&2
|
|
exit 1
|
|
}
|
|
|
|
trap 'echo;sigh' 1 2 3 9 10 12 15
|
|
|
|
echo -n "Please type in hostname of the machine to $MOLLYGUARD_CMD: "
|
|
read HOSTNAME_USER || :
|
|
|
|
HOSTNAME="$(echo "$HOSTNAME" | tr '[:upper:]' '[:lower:]')"
|
|
HOSTNAME_USER="$(echo "$HOSTNAME_USER" | tr '[:upper:]' '[:lower:]')"
|
|
|
|
[ "$HOSTNAME_USER" = "$HOSTNAME" ] || sigh
|
|
|
|
trap - 1 2 3 9 10 12 15
|
|
|
|
exit 0
|