247 lines
8.3 KiB
Bash
247 lines
8.3 KiB
Bash
#!/bin/bash
|
|
NF="\e[0m"
|
|
FB="\e[1m"
|
|
CG="\e[38;5;40m"
|
|
CR="\e[38;5;9m"
|
|
CY="\033[38;5;226m"
|
|
|
|
### BEGIN FUNCTION BLOCK
|
|
|
|
verifydefaultconfigpresence(){
|
|
if [ "$config" = "/opt/franscorackify/util/autoremakessh/client/defaultconfig" ]; then
|
|
if [ ! -f /opt/franscorackify/util/autoremakessh/client/defaultconfig ]; then
|
|
echo -e ${CR}No default config found! Use -h argument for help.${NF}
|
|
return 1
|
|
fi
|
|
fi
|
|
}
|
|
|
|
verifyconfigvalidity(){
|
|
if [ ! -f $config ]; then
|
|
echo -e ${CR}Invalid config file location or permissions${NF}
|
|
return 1
|
|
fi
|
|
source $config
|
|
if [ "$server" = "" ]; then
|
|
echo -e "${CR}[!] 'server' value cannot be empty! Exiting!"
|
|
return 1
|
|
fi
|
|
if [ "$privkey" = "" ]; then
|
|
echo -e "${CR}[!] 'privkey' value cannot be empty! Exiting!"
|
|
return 1
|
|
fi
|
|
if [ "$pubkey" = "" ]; then
|
|
echo -e "${CR}[!] 'pubkey' value cannot be empty! Exiting!"
|
|
return 1
|
|
fi
|
|
if [ "$checksumdir" = "" ]; then
|
|
echo -e "${CR}[!] 'checksumdir' value cannot be empty! Exiting!"
|
|
return 1
|
|
fi
|
|
if [[ "$disablechecksums" != "0" && "$disablechecksums" != "1" ]]; then
|
|
echo -e "${CR}[!] Invalid value for option 'disablechecksums'. Exiting!"
|
|
return 1
|
|
fi
|
|
if [[ "$insecure" != "0" && "$insecure" != "1" ]]; then
|
|
echo -e "${CR}[!] Invalid value for option 'insecure'. Exiting!"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
guardband() {
|
|
if [ $? -ne 0 ]; then
|
|
echo ''
|
|
echo -e "${CR}Script Exited with an error.${NF}"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
ipguardband() {
|
|
if [ $? -ne 0 ]; then
|
|
securitywarning
|
|
fi
|
|
}
|
|
|
|
verifyserver(){
|
|
if ! wget --spider "$server" 2>/dev/null; then
|
|
echo -e "${CR}Error: Cannot reach provisioning server${NF}"
|
|
echo -e "${CR}URL in config: $server ${NF}"
|
|
return 1
|
|
else
|
|
echo -e "${CG}Server OK!${NF}"
|
|
echo -e "${CG}URL in config: $server ${NF}"
|
|
|
|
sleep 1
|
|
fi
|
|
}
|
|
|
|
checksums(){
|
|
if [ "$disablechecksums" = "0" ]; then
|
|
serversidePUB=$(wget $server/$checksumdir/$priv -q -O -)
|
|
serversidePRIV=$(wget $server/$checksumdir/$pub -q -O -)
|
|
else
|
|
echo -e ${CY}Skipping checksum verification${NF}
|
|
fi
|
|
}
|
|
|
|
verifyconfigsecureIP(){
|
|
if [ "$insecure" = "1" ]; then
|
|
return 0
|
|
fi
|
|
local host_part=$(echo "$server" | sed -E 's|^[a-zA-Z0-9]+://([^/]+).*|\1|')
|
|
|
|
if [[ $host_part =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
|
ip="$host_part"
|
|
else
|
|
ip=""
|
|
if command -v host >/dev/null 2>&1; then
|
|
output=$(host "$host_part")
|
|
if [[ $output =~ has\ address ]]; then
|
|
ip=$(echo "$output" | awk '{print $4}')
|
|
fi
|
|
elif command -v nslookup >/dev/null 2>&1; then
|
|
output=$(nslookup "$host_part")
|
|
if [[ $output =~ Name: ]]; then
|
|
ip=$(echo "$output" | awk '{print $2}')
|
|
fi
|
|
elif command -v dig >/dev/null 2>&1; then
|
|
output=$(dig +short "$host_part")
|
|
ip="$output"
|
|
else
|
|
output=$(getent ahosts "$host_part")
|
|
if [[ $output =~ [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ ]]; then
|
|
ip=$(echo "$output" | awk '{print $1}')
|
|
fi
|
|
fi
|
|
|
|
if [[ -z "$ip" ]]; then
|
|
echo -e ${CR}"[!] Unable to resolve IP address for host '$host_part'."${NF}
|
|
return 1
|
|
fi
|
|
fi
|
|
|
|
local oct1=$(echo "$ip" | cut -d. -f1)
|
|
local oct2=$(echo "$ip" | cut -d. -f2)
|
|
|
|
if [[ -n $oct1 && $oct1 =~ ^[0-9]+$ ]] && [[ -n $oct2 && $oct2 =~ ^[0-9]+$ ]]; then
|
|
if [[ $oct1 -eq 10 ]]; then
|
|
return 0
|
|
fi
|
|
if [[ $oct1 -eq 172 ]] && [[ $oct2 -ge 16 ]] && [[ $oct2 -le 31 ]]; then
|
|
return 0
|
|
fi
|
|
if [[ $oct1 -eq 192 ]] && [[ $oct2 -eq 168 ]]; then
|
|
return 0
|
|
fi
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
securitywarning(){
|
|
echo ''
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ Security Check has reported a fail - Either config is using @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ a public IP as a target server for provisioning, or hostname @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ couldn't be resolved. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ Assuming by default that the target server is publicly @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ reachable, this is an incredibly bad idea as it exposes @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ your keys on the internet, which is the same as leaving @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ your machine passwordless over the internet. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ Please consider using a local server that isn't exposed to @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ the internet unless you accept the risks or know what you're @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ doing. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ If you have already generated new keys using the publicly @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ exposed server, it is strongly recommended to reset your keys @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ IMMEDIATELY! @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ You can override this warning by setting 'insecure' to 1 @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ in the active config file. Refer to docs for more details. @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! WARNING! @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@ @@@${NF}"
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
echo -e "${CR}${FB}@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@${NF}"
|
|
sleep 30
|
|
exit 1
|
|
}
|
|
|
|
usage() {
|
|
echo ""
|
|
echo "Usage:"
|
|
echo "autoremakessh [MODE] [OPTIONS]"
|
|
echo ""
|
|
echo "Possible modes:"
|
|
echo "Default - Client mode"
|
|
echo "-s - Server mode"
|
|
echo ""
|
|
echo "Possible Options:"
|
|
echo "-c [FILE] - Configuration file to use (Default /opt/franscorackify/util/autoremakessh/client/defaultconfig)"
|
|
echo "-h - Display this message"
|
|
exit 0
|
|
}
|
|
|
|
### END FUNCTION BLOCK
|
|
|
|
config="/opt/franscorackify/util/autoremakessh/client/defaultconfig"
|
|
srvmode=0
|
|
|
|
echo ""
|
|
echo "AutoremakeSSH Version 20260410-0"
|
|
echo "© 2026 Franscobec - AGPLv3 License"
|
|
echo "https://git.franscorack.com/Franscobec/AutoremakeSSH/src/branch/main/"
|
|
echo ""
|
|
|
|
while getopts ":c:sh" opt; do
|
|
case ${opt} in
|
|
c )
|
|
config=$OPTARG
|
|
;;
|
|
s )
|
|
srvmode=1
|
|
;;
|
|
h )
|
|
usage
|
|
;;
|
|
\? )
|
|
echo "Invalid option: -$OPTARG" 1>&2
|
|
exit 1
|
|
;;
|
|
: )
|
|
echo "Invalid option: -$OPTARG requires an argument" 1>&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
shift $((OPTIND -1))
|
|
if [ -z "$config" ]; then
|
|
echo "No custom config file specified. Using default: $config"
|
|
fi
|
|
|
|
if [ "$srvmode" -eq 1 ]; then
|
|
echo "Server mode is not yet implemented"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$srvmode" -eq 0 ]; then
|
|
verifydefaultconfigpresence
|
|
guardband
|
|
verifyconfigvalidity
|
|
guardband
|
|
verifyserver
|
|
guardband
|
|
verifyconfigsecureIP
|
|
ipguardband
|
|
fi |