138 lines
6.0 KiB
Bash
138 lines
6.0 KiB
Bash
#!/bin/bash
|
|
NF="\e[0m"
|
|
FB="\e[1m"
|
|
CG="\e[38;5;40m"
|
|
CR="\e[38;5;9m"
|
|
CY="\033[38;5;226m"
|
|
|
|
echo ""
|
|
echo "AutoremakeSSH Version MR20260410-Dev1"
|
|
echo "© 2026 Franscobec - AGPLv3 License"
|
|
echo "https://git.franscorack.com/Franscobec/AutoremakeSSH/src/branch/main/"
|
|
echo ""
|
|
|
|
if [[ $1 = "--trigger" ]]; then
|
|
echo test
|
|
elif [[ $1 = "--auto" ]]; then
|
|
echo test
|
|
else
|
|
echo "Usage:"
|
|
echo "autoremakessh --MODE [OPTIONS]"
|
|
echo ""
|
|
echo "Possible Modes:"
|
|
echo "trigger - For manual triggering of autoremakessh"
|
|
echo "auto - For automated triggering of autoremakessh"
|
|
echo ""
|
|
echo "Possible Options:"
|
|
echo "-c [FILE] - Configuration file to use (Default /opt/autoremakessh/client/default)"
|
|
echo "-r - Resets .ssh folder of the selected user in the active config"
|
|
|
|
fi
|
|
|
|
guardband() {
|
|
if [ $? -ne 0 ]; then
|
|
echo -e "${CR}Script Exited with an Error.${NF}"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
verifyserver(){
|
|
if ! wget --spider "$server" 2>/dev/null; then
|
|
echo -e "${CR}Error: Cannot reach provisioning server${NF}"
|
|
echo -e "${CR}URL in config: $server ${NF}"
|
|
return 1
|
|
else
|
|
echo -e "${CG}Server OK!${NF}"
|
|
|
|
sleep 1
|
|
fi
|
|
}
|
|
|
|
checksums(){
|
|
if [[ $disablechecksums = "0" ]]; then
|
|
serversidePUB=$(wget $server/$checksumdir/$priv -q -O -)
|
|
serversidePRIV=$(wget $server/$checksumdir/$pub -q -O -)
|
|
fi
|
|
}
|
|
|
|
verifyconfigsecureIP(){
|
|
local config_file="$1"
|
|
local server_line=$(grep "^server=" "$config_file")
|
|
local url=$(echo "$server_line" | sed 's/^server=//')
|
|
local ip=""
|
|
local host_part=$(echo "$url" | sed -E 's|^[a-zA-Z0-9]+://([^/]+).*|\1|')
|
|
|
|
if [[ $host_part =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
|
ip="$host_part"
|
|
else
|
|
if command -v host >/dev/null 2>&1; then
|
|
ip=$(host "$host_part" 2>/dev/null | grep "has address" | awk '{print $4}' | head -1)
|
|
elif command -v nslookup >/dev/null 2>&1; then
|
|
ip=$(nslookup "$host_part" 2>/dev/null | grep "Name:" | awk '{print $2}' | head -1)
|
|
elif command -v dig >/dev/null 2>&1; then
|
|
ip=$(dig +short "$host_part" 2>/dev/null | head -1)
|
|
else
|
|
ip=$(getent ahosts "$host_part" 2>/dev/null | awk '{print $1}' | head -1)
|
|
fi
|
|
fi
|
|
if [[ -z "$ip" ]]; then
|
|
return 1
|
|
fi
|
|
|
|
local oct1=$(echo "$ip" | cut -d. -f1)
|
|
local oct2=$(echo "$ip" | cut -d. -f2)
|
|
|
|
if [[ $oct1 -eq 10 ]]; then
|
|
return 0
|
|
fi
|
|
|
|
if [[ $oct1 -eq 172 ]] && [[ $oct2 -ge 16 ]] && [[ $oct2 -le 31 ]]; then
|
|
return 0
|
|
fi
|
|
|
|
if [[ $oct1 -eq 192 ]] && [[ $oct2 -eq 168 ]]; then
|
|
return 0
|
|
fi
|
|
|
|
return 1
|
|
}
|
|
|
|
securitywarning(){
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ Security Check has reported a fail - Either config is using @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ a public IP as a target server for provisioning, or hostname @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ couldn't be resolved. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ Assuming by default that the target server is publicly @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ reachable, this is an incredibly bad idea as it exposes @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ your keys on the internet, which is the same as leaving @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ your machine passwordless over the internet. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ Please consider using a local server that isn't exposed to @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ the internet unless you accept the risks or know what you're @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ doing. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ If you have already generated new keys using the publicly @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ exposed server, it is strongly recommended to reset your keys @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ IMMEDIATELY! @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ You can override this warning by setting 'insecure' to 1 @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ in the active config file. Refer to docs for more details. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
sleep 30
|
|
exit 1
|
|
}
|