mirror of
https://github.com/LamGC/quickly-conf-sshd.git
synced 2026-01-13 12:50:46 +00:00
367 lines
12 KiB
Bash
Executable File
367 lines
12 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
|
|
########## 一些配置 ##########
|
|
|
|
# 默认获取 SSH key 的地方，一般是 Github.
|
|
sshkey_url="{{ SSH_KEY_URL }}"
|
|
# 默认的 Cron 执行计划, 每天凌晨 0 点执行
|
|
default_cron="{{ DEFAULT_CRON }}"
|
|
# 脚本 Url
|
|
script_url="{{ SCRIPT_URL }}"
|
|
|
|
############ 脚本区 ##########
|
|
|
|
# 初始化参数变量
|
|
arg_help="false"
|
|
arg_cron="false"
|
|
arg_cron_val=""
|
|
arg_only_update_keys="false"
|
|
arg_update_self="false"
|
|
arg_uninstall="false"
|
|
arg_no_install_sshd="false"
|
|
arg_allow_root_passwd="false"
|
|
arg_allow_root_passwd_val=""
|
|
|
|
# 解析参数
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
-h|--help)
|
|
arg_help="true"
|
|
shift
|
|
;;
|
|
-c|--cron)
|
|
arg_cron="true"
|
|
arg_cron_val="$2"
|
|
shift 2
|
|
;;
|
|
-o|--only-update-keys)
|
|
arg_only_update_keys="true"
|
|
shift
|
|
;;
|
|
-u|--update-self)
|
|
arg_update_self="true"
|
|
shift
|
|
;;
|
|
--uninstall)
|
|
arg_uninstall="true"
|
|
shift
|
|
;;
|
|
-n|--no-install-sshd)
|
|
arg_no_install_sshd="true"
|
|
shift
|
|
;;
|
|
-p|--allow-root-passwd)
|
|
arg_allow_root_passwd="true"
|
|
arg_allow_root_passwd_val="$2"
|
|
shift 2
|
|
;;
|
|
*)
|
|
shift
|
|
;;
|
|
esac
|
|
done
|
|
|
|
# 帮助信息.
|
|
if [ "$arg_help" = "true" ]; then
|
|
echo "Usage: $0 [options]"
|
|
echo "Options:"
|
|
echo " -h, --help Print this help message."
|
|
echo ""
|
|
echo "Available to any user: "
|
|
echo " -c, --cron \"<cron> | false\" Configure Crontab to automatically update ssh keys."
|
|
echo " Cron expression MUST be quoted (e.g., \"* 0 * * *\")."
|
|
echo " If 'false' is specified, Crontab settings will be deleted."
|
|
echo ""
|
|
echo " -o, --only-update-keys Only update SSH keys, do not configure ssh server."
|
|
echo " -u, --update-self Update this script to the latest version."
|
|
echo " --uninstall Uninstall this script (remove cron and local files)."
|
|
echo ""
|
|
echo "only available when the script is executed as root:"
|
|
echo " -n, --no-install-sshd Do not install SSH Server."
|
|
echo " -p, --allow-root-passwd <yes | no> Allow Root to log in with a password."
|
|
echo ""
|
|
exit 0
|
|
fi
|
|
|
|
reload_sshd_service() {
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl reload sshd
|
|
elif command -v service >/dev/null 2>&1; then
|
|
service sshd reload || service ssh reload
|
|
elif [ -f /etc/init.d/sshd ]; then
|
|
/etc/init.d/sshd reload
|
|
elif [ -f /etc/init.d/ssh ]; then
|
|
/etc/init.d/ssh reload
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
update_sshkeys() {
|
|
case "$sshkey_url" in
|
|
""|"{{"*)
|
|
echo "ERROR: sshkey_url is not configured."
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "Downloading SSH public key from '$sshkey_url'"
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
dl_tmp_file="$HOME/.ssh/authorized_keys.dl.tmp"
|
|
if ! curl -sL "$sshkey_url" -o "$dl_tmp_file"; then
|
|
echo "Failed to download SSH public key at $(date '+%Y-%m-%d %H:%M:%S')"
|
|
rm -f "$dl_tmp_file"
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -s "$dl_tmp_file" ] || ! grep -qE "(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp)" "$dl_tmp_file"; then
|
|
echo "Downloaded file is empty or does not contain valid SSH key types at $(date '+%Y-m-d %H:%M:%S')"
|
|
echo "Aborting update to prevent lockout."
|
|
rm -f "$dl_tmp_file"
|
|
exit 1
|
|
fi
|
|
|
|
echo "-------------------- SSH Keys --------------------"
|
|
cat "$dl_tmp_file"
|
|
echo "--------------------------------------------------"
|
|
|
|
auth_file="$HOME/.ssh/authorized_keys"
|
|
new_auth_file="$HOME/.ssh/authorized_keys.new.tmp"
|
|
|
|
# 受管理文本块标记
|
|
begin_marker="# --- BEGIN MANAGED BY CONF-SSHD SCRIPT ---"
|
|
end_marker="# --- END MANAGED BY CONF-SSHD SCRIPT ---"
|
|
|
|
managed_block_found="false"
|
|
inside_managed_block="false"
|
|
|
|
touch "$auth_file"
|
|
: > "$new_auth_file"
|
|
|
|
while IFS= read -r line || [ -n "$line" ]; do
|
|
if [ "$line" = "$begin_marker" ]; then
|
|
managed_block_found="true"
|
|
inside_managed_block="true"
|
|
|
|
{
|
|
echo "$begin_marker"
|
|
cat "$dl_tmp_file"
|
|
echo "$end_marker"
|
|
} >> "$new_auth_file"
|
|
|
|
elif [ "$line" = "$end_marker" ]; then
|
|
inside_managed_block="false"
|
|
elif [ "$inside_managed_block" = "false" ]; then
|
|
echo "$line" >> "$new_auth_file"
|
|
fi
|
|
done < "$auth_file"
|
|
|
|
if [ "$managed_block_found" = "false" ]; then
|
|
if [ -s "$new_auth_file" ]; then
|
|
if [ "$(tail -c 1 "$new_auth_file")" != "" ]; then
|
|
# 最后一个字符不是换行符，添加一个
|
|
echo "" >> "$new_auth_file"
|
|
fi
|
|
fi
|
|
|
|
{
|
|
echo "$begin_marker"
|
|
cat "$dl_tmp_file"
|
|
echo "$end_marker"
|
|
} >> "$new_auth_file"
|
|
fi
|
|
|
|
mv "$new_auth_file" "$auth_file"
|
|
rm -f "$dl_tmp_file"
|
|
|
|
chmod 600 "$auth_file"
|
|
echo "SSH public key updated successfully (managed block only) at $(date '+%Y-%m-%d %H:%M:%S')"
|
|
}
|
|
|
|
# 检查是否指定了 --uninstall
|
|
if [ "$arg_uninstall" = "true" ]; then
|
|
echo "Uninstalling conf-sshd (disabling auto-updates)..."
|
|
|
|
if [ "$(command -v crontab)" != "" ]; then
|
|
echo "Removing Crontab entry..."
|
|
( (crontab -l 2>/dev/null || true) | grep -F -v "conf-sshd.sh") | crontab -
|
|
else
|
|
echo "Crontab utility not found, skipping Crontab removal."
|
|
fi
|
|
|
|
script_dir="$HOME/.conf-sshd"
|
|
if [ -d "$script_dir" ]; then
|
|
echo "Removing script files from $script_dir..."
|
|
rm -rf "$script_dir"
|
|
else
|
|
echo "Script directory $script_dir not found, skipping removal."
|
|
fi
|
|
|
|
echo "Uninstall complete."
|
|
echo "Note: authorized_keys managed block and sshd_config were NOT affected."
|
|
exit 0
|
|
fi
|
|
|
|
# 检查是否只更新密钥.
|
|
if [ "$arg_only_update_keys" = "true" ]; then
|
|
update_sshkeys
|
|
exit 0
|
|
fi
|
|
|
|
# 检查是否指定了 --update-self
|
|
if [ "$arg_update_self" = "true" ]; then
|
|
echo "Updating conf-sshd script..."
|
|
mkdir -p ~/.conf-sshd
|
|
target_script="$HOME/.conf-sshd/conf-sshd.sh"
|
|
|
|
if [ -f "$target_script" ]; then
|
|
cp "$target_script" "$target_script.bak"
|
|
fi
|
|
|
|
# 下载到临时文件
|
|
if ! curl -sL "$script_url" -o "$target_script.tmp"; then
|
|
echo "Script download failed at $(date '+%Y-%m-%d %H:%M:%S')"
|
|
rm -f "$target_script.tmp"
|
|
exit 1
|
|
fi
|
|
|
|
mv "$target_script.tmp" "$target_script"
|
|
|
|
chmod +x "$target_script"
|
|
echo "Script updated successfully at $(date '+%Y-%m-%d %H:%M:%S')"
|
|
exit 0
|
|
fi
|
|
|
|
# 检查 SSHD 是否安装.
|
|
if ! command -v sshd >/dev/null 2>&1 && [ ! -x /usr/sbin/sshd ] && [ "$arg_no_install_sshd" = "false" ]; then
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
echo "The ssh server is not installed, and the script is executed as root, so it will be installed."
|
|
if [ -f /etc/redhat-release ]; then
|
|
yum install -y openssh-server
|
|
elif [ -f /etc/debian_version ]; then
|
|
apt-get update
|
|
apt-get install -y openssh-server
|
|
elif [ -f /etc/alpine-release ]; then
|
|
apk add openssh
|
|
fi
|
|
echo "The ssh server has been installed."
|
|
else
|
|
echo "The ssh server is not installed, but the script is executed as a non-root user and cannot be installed."
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "The ssh server is already installed."
|
|
fi
|
|
|
|
# 检查是否指定了 --allow-root-passwd
|
|
if [ "$arg_allow_root_passwd" = "true" ]; then
|
|
# 检查当前用户是否为 root
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
allow_root_passwd=$(echo "$arg_allow_root_passwd_val" | tr '[:upper:]' '[:lower:]')
|
|
|
|
sshd_config_file="/etc/ssh/sshd_config"
|
|
new_sshd_permit_root_login_setting=""
|
|
|
|
if [ "$allow_root_passwd" = "yes" ]; then
|
|
new_sshd_permit_root_login_setting="PermitRootLogin yes"
|
|
echo "Setting: Root user is allowed to log in with password."
|
|
elif [ "$allow_root_passwd" = "no" ]; then
|
|
new_sshd_permit_root_login_setting="PermitRootLogin prohibit-password"
|
|
echo "Setting: Root user is prohibited from logging in with password."
|
|
else
|
|
echo "Please specify 'yes' or 'no' for --allow-root-passwd."
|
|
exit 1
|
|
fi
|
|
|
|
if grep -qE '^#?PermitRootLogin' "$sshd_config_file"; then
|
|
sed "s@^#\?PermitRootLogin.*@$new_sshd_permit_root_login_setting@g" "$sshd_config_file" > "$sshd_config_file.tmp" && mv "$sshd_config_file.tmp" "$sshd_config_file"
|
|
else
|
|
echo "$new_sshd_permit_root_login_setting" >> "$sshd_config_file"
|
|
fi
|
|
|
|
if ! reload_sshd_service; then
|
|
echo "----------------------------------------------------"
|
|
echo "WARNING: Failed to reload sshd service!"
|
|
echo "Please check service status manually."
|
|
echo "----------------------------------------------------"
|
|
else
|
|
echo "SSHD config updated. Now you can use password to login root user."
|
|
fi
|
|
|
|
else
|
|
echo "The script is executed as a non-root user and cannot set whether to allow root to log in with a password."
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# 更新密钥.
|
|
update_sshkeys
|
|
|
|
# 检查是否指定了 --cron
|
|
if [ "$arg_cron" = "true" ]; then
|
|
# 检查 Crontab 是否已安装
|
|
if [ "$(command -v crontab)" = "" ]; then
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
echo "The crontab is not installed, and the script is executed as a root user, so it will be installed."
|
|
if [ -f /etc/redhat-release ]; then
|
|
yum install -y crontabs
|
|
elif [ -f /etc/debian_version ]; then
|
|
apt-get update
|
|
apt-get install -y cron
|
|
elif [ -f /etc/alpine-release ]; then
|
|
apk add cron
|
|
fi
|
|
echo "The crontab has been installed."
|
|
else
|
|
echo "The crontab is not installed, but the script is executed as a non-root user and cannot be installed."
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "The crontab is already installed."
|
|
fi
|
|
cron=$(echo "$arg_cron_val" | tr '[:upper:]' '[:lower:]')
|
|
if [ "$cron" = "false" ]; then
|
|
# 检查 Crontab 是否已经设置
|
|
if [ "$( (crontab -l 2>/dev/null || true) | grep -F -c "conf-sshd.sh" )" -eq 0 ]; then
|
|
echo "Crontab already clean. Will not be configured."
|
|
exit 0
|
|
else
|
|
(crontab -l 2>/dev/null || true) | grep -F -v "conf-sshd.sh" | crontab -
|
|
echo "Crontab has been removed."
|
|
exit 0
|
|
fi
|
|
else
|
|
if [ "$cron" = "" ]; then
|
|
cron=$default_cron
|
|
fi
|
|
# 将当前脚本移动到 ~/.conf-sshd/conf-sshd.sh 中.
|
|
mkdir -p ~/.conf-sshd
|
|
target_script="$HOME/.conf-sshd/conf-sshd.sh"
|
|
if [ ! -f "$0" ]; then
|
|
echo "Downloading conf-sshd script..."
|
|
if ! curl -sL "$script_url" -o "$target_script.tmp"; then
|
|
echo "Script download failed at $(date '+%Y-m-d %H:%M:%S')"
|
|
rm -f "$target_script.tmp"
|
|
exit 1
|
|
fi
|
|
mv "$target_script.tmp" "$target_script"
|
|
else
|
|
echo "Copying conf-sshd script..."
|
|
cp "$0" "$target_script"
|
|
fi
|
|
|
|
chmod +x "$target_script"
|
|
echo "Install conf-sshd script successfully."
|
|
# 将当前脚本追加到当前用户的 Crontab 中
|
|
echo "Configuring Crontab..."
|
|
cron_command="/bin/sh $target_script -o >> $HOME/.conf-sshd/run.log 2>&1"
|
|
cron_job="$cron $cron_command"
|
|
|
|
( (crontab -l 2>/dev/null || true) | grep -F -v "conf-sshd.sh") | { cat; echo "$cron_job"; } | crontab -
|
|
|
|
echo "Crontab has been configured.(Cron: '$cron')"
|
|
fi
|
|
fi |