From e396386725fd5c0a3efbe71647efb52f22a7b636 Mon Sep 17 00:00:00 2001 From: "kebler.net" Date: Sun, 4 Jul 2021 17:17:32 -0700 Subject: [PATCH] added 312 --- 238.kebler.net/function/gateway | 14 ++ 238.kebler.net/function/ssh-mounts/238 | 123 ++++++------- 238.kebler.net/ssh/config/238.cfg | 185 ++++++++++--------- 312.kebler.net/function/ssh-mounts/312 | 18 ++ 312.kebler.net/ssh/config/312.cfg | 21 +++ all/function/ssh | 1 - all/modules/rrsync.sh | 246 +++++++++++++++++++++++++ all/modules/ssh.sh | 6 + 8 files changed, 462 insertions(+), 152 deletions(-) create mode 100644 238.kebler.net/function/gateway create mode 100644 312.kebler.net/function/ssh-mounts/312 create mode 100644 312.kebler.net/ssh/config/312.cfg delete mode 100644 all/function/ssh create mode 100755 all/modules/rrsync.sh diff --git a/238.kebler.net/function/gateway b/238.kebler.net/function/gateway new file mode 100644 index 0000000..446b08b --- /dev/null +++ b/238.kebler.net/function/gateway @@ -0,0 +1,14 @@ +#!/bin/bash + +# commands that run on 238 gateway router + +function rdns() { +module_load ssh +ssh 238gater 'systemctl restart dnsmasq' +} + +function ednsproxy() { +module_load ssh +ssh 238gate '/bin/bash -e "nano /opt/dnsmasq/proxy.238.kebler.net"' +#ssh 238gate 'cd /opt/dnsmasq/; ls -la' +} \ No newline at end of file diff --git a/238.kebler.net/function/ssh-mounts/238 b/238.kebler.net/function/ssh-mounts/238 index db3133f..e0f63a5 100644 --- a/238.kebler.net/function/ssh-mounts/238 +++ b/238.kebler.net/function/ssh-mounts/238 @@ -1,89 +1,88 @@ #!/bin/bash -function mnt238gate(){ -smount sysadmin@gateway.238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22 -smount sysadmin@gateway.238.kebler.net:/opt /mnt/238/gate/opt -p 22 -smount root@gateway.238.kebler.net:/ /mnt/238/gate/root -p 22 -smount root@gateway.238.kebler.net:/etc /mnt/238/gate/etc -p 22 +function mnt238gate() { + smount sysadmin@gateway.238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22 + smount sysadmin@gateway.238.kebler.net:/opt /mnt/238/gate/opt -p 22 + smount root@gateway.238.kebler.net:/ /mnt/238/gate/root -p 22 + smount root@gateway.238.kebler.net:/etc /mnt/238/gate/etc -p 22 } - -function wmnt238gate(){ -smount sysadmin@238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22 -smount sysadmin@238.kebler.net:/opt /mnt/238/gate/opt -p 22 -smount root@238.kebler.net:/ /mnt/238/gate/root -p 22 -smount root@238.kebler.net:/etc /mnt/238/gate/etc -p 22 +function wmnt238gate() { + smount sysadmin@238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22 + smount sysadmin@238.kebler.net:/opt /mnt/238/gate/opt -p 22 + smount root@238.kebler.net:/ /mnt/238/gate/root -p 22 + smount root@238.kebler.net:/etc /mnt/238/gate/etc -p 22 } -function umnt238gate(){ -usmount /mnt/238/gate/opt -usmount /mnt/238/gate/root -usmount /mnt/238/gate/etc -usmount /mnt/238/gate/sysadmin +function umnt238gate() { + usmount /mnt/238/gate/opt + usmount /mnt/238/gate/root + usmount /mnt/238/gate/etc + usmount /mnt/238/gate/sysadmin } -function mntseldon(){ -smount sysadmin@seldon.kebler.net:/home/sysadmin /mnt/238/seldon/sysadmin -p 22 -smount sysadmin@seldon.kebler.net:/opt /mnt/238/seldon/opt -p 22 -smount root@seldon.kebler.net:/ /mnt/238/seldon/root -p 22 -smount root@seldon.kebler.net:/etc /mnt/238/seldon/etc -p 22 +function mntseldon() { + smount sysadmin@seldon.kebler.net:/home/sysadmin /mnt/238/seldon/sysadmin -p 22 + smount sysadmin@seldon.kebler.net:/opt /mnt/238/seldon/opt -p 22 + smount root@seldon.kebler.net:/ /mnt/238/seldon/root -p 22 + smount root@seldon.kebler.net:/etc /mnt/238/seldon/etc -p 22 } -function umntseldon(){ -usmount /mnt/238/seldon/opt -usmount /mnt/238/seldon/root -usmount /mnt/238/seldon/etc -usmount /mnt/238/seldon/sysadmin +function umntseldon() { + usmount /mnt/238/seldon/opt + usmount /mnt/238/seldon/root + usmount /mnt/238/seldon/etc + usmount /mnt/238/seldon/sysadmin } - -function mnt238nas(){ -smount sysadmin@nas.238.kebler.net:/opt /mnt/238/nas/opt -p 22 -smount sysadmin@nas.238.kebler.net:/mnt/data /mnt/238/nas/data -p 22 -smount sysadmin@nas.238.kebler.net:/mnt/datamirror /mnt/238/nas/datamirror -p 22 -smount sysadmin@nas.kebler.net:/home/sysadmin /mnt/238/nas/sysadmin -p 22 -smount root@nas.238.kebler.net:/ /mnt/238/nas/root -p 22 +function mnt238nas() { + smount sysadmin@nas.238.kebler.net:/opt /mnt/238/nas/opt -p 22 + smount sysadmin@nas.238.kebler.net:/mnt/data /mnt/238/nas/data -p 22 + smount sysadmin@nas.238.kebler.net:/mnt/datamirror /mnt/238/nas/datamirror -p 22 + smount sysadmin@nas.kebler.net:/home/sysadmin /mnt/238/nas/sysadmin -p 22 + smount root@nas.238.kebler.net:/ /mnt/238/nas/root -p 22 } - -function umnt238nas(){ -usmount /mnt/238/nas/opt -usmount /mnt/238/nas/data -usmount /mnt/238/nas/datamirror -usmount /mnt/238/nas/sysadmin -usmount /mnt/238/nas/root +function umnt238nas() { + usmount /mnt/238/nas/opt + usmount /mnt/238/nas/data + usmount /mnt/238/nas/datamirror + usmount /mnt/238/nas/sysadmin + usmount /mnt/238/nas/root } -function mnttrantor(){ -smount sysadmin@trantor.kebler.net:/home/sysadmin /mnt/238/trantor/sysadmin -p 22 -smount sysadmin@trantor.kebler.net:/opt /mnt/238/trantor/opt -p 22 -smount sysadmin@trantor.kebler.net:/mnt/data /mnt/238/trantor/data -p 22 -smount root@trantor.kebler.net:/ /mnt/238/trantor/root -p 22 +function mnttrantor() { + smount sysadmin@trantor.kebler.net:/home/sysadmin /mnt/238/trantor/sysadmin -p 22 + smount sysadmin@trantor.kebler.net:/opt /mnt/238/trantor/opt -p 22 + smount sysadmin@trantor.kebler.net:/mnt/data /mnt/238/trantor/data -p 22 + smount root@trantor.kebler.net:/ /mnt/238/trantor/root -p 22 + smount sysadmin@trantor.kebler.net:/backup /mnt/238/trantor/backup -p 22 } -function umnttrantor(){ -usmount /mnt/238/trantor/opt -usmount /mnt/238/trantor/root -usmount /mnt/238/trantor/data -usmount /mnt/238/trantor/sysadmin +function umnttrantor() { + usmount /mnt/238/trantor/opt + usmount /mnt/238/trantor/root + usmount /mnt/238/trantor/data + usmount /mnt/238/trantor/sysadmin + usmount /mnt/238/trantor/backup } -function mntwater(){ -smount sysadmin@water.kebler.net:/home/sysadmin /mnt/238/water/home -p 22 -smount sysadmin@water.kebler.net:/opt /mnt/238/water/opt -p 22 -smount root@water.kebler.net:/ /mnt/238/water/root -p 22 +function mntwater() { + smount sysadmin@water.kebler.net:/home/sysadmin /mnt/238/water/home -p 22 + smount sysadmin@water.kebler.net:/opt /mnt/238/water/opt -p 22 + smount root@water.kebler.net:/ /mnt/238/water/root -p 22 } -function umntwater(){ -usmount /mnt/238/water/opt -usmount /mnt/238/water/root -usmount /mnt/238/water/home +function umntwater() { + usmount /mnt/238/water/opt + usmount /mnt/238/water/root + usmount /mnt/238/water/home } -function mnt238hass(){ -smount root@hassio.238.kebler.net:/ /mnt/238/hass -p 22 -o allow_other +function mnt238hass() { + smount root@hassio.238.kebler.net:/ /mnt/238/hass -p 22 -o allow_other } -function umnt238hass(){ -usmount /mnt/238/hass +function umnt238hass() { + usmount /mnt/238/hass } diff --git a/238.kebler.net/ssh/config/238.cfg b/238.kebler.net/ssh/config/238.cfg index 71f4e06..85c03dc 100644 --- a/238.kebler.net/ssh/config/238.cfg +++ b/238.kebler.net/ssh/config/238.cfg @@ -2,146 +2,153 @@ AddKeysToAgent yes ForwardX11 no ForwardX11Trusted yes # ForwardAgent yes -IdentityFile ~/.ssh/privatekeys/sysadmin.kebler.net +# IdentityFile /mnt/AllData~/.ssh/privatekeys/sysadmin.kebler.net ######### 238 McHaley Network ################ ## router Host 238gate - user sysadmin - hostname gateway.238.kebler.net + user sysadmin + hostname gateway.238.kebler.net Host 238gater - user root - hostname gateway.238.kebler.net + user root + hostname gateway.238.kebler.net Host 238nas - user sysadmin - hostname nas.238.kebler.net - ForwardX11 yes + user sysadmin + hostname nas.238.kebler.net + ForwardX11 yes Host 238nasr - user root - hostname nas.kebler.net - ForwardX11 yes + user root + hostname nas.kebler.net + ForwardX11 yes Host 238water water - user sysadmin - hostname water.238.kebler.net + user sysadmin + hostname water.238.kebler.net Host 238waterr waterr - user root - hostname water.238.kebler.net + user root + hostname water.238.kebler.net Host 238hass 238ha - user root - hostname hassio.238.kebler.net - port 22 + user root + hostname hassio.238.kebler.net + port 22 Host 238hasshost 238hahost - user root - hostname hassio.238.kebler.net - port 22222 + user root + hostname hassio.238.kebler.net + port 22222 Host 238admin trantor - user sysadmin - hostname admin.238.kebler.net - ForwardX11 yes - + user sysadmin + hostname admin.238.kebler.net + ForwardX11 yes Host 238adminr trantorr - user root - hostname admin.238.kebler.net - ForwardX11 yes + user root + hostname admin.238.kebler.net + ForwardX11 yes +Host 288adminb trantorb + user root + hostname trantor.kebler.net + IdentityFile /mnt/AllData/secure/privatekeys/xfer.kebler.net + IdentitiesOnly yes +# ServerAliveInterval 60 +# ServerAliveCountMax 240 Host seldon printer - user sysadmin - hostname seldon.kebler.net - ForwardX11 yes + user sysadmin + hostname seldon.kebler.net + ForwardX11 yes Host rseldon - user root - hostname seldon.kebler.net - ForwardX11 yes + user root + hostname seldon.kebler.net + ForwardX11 yes # Lights Sytem Network # relays - Host r238lights - user sysadmin - hostname lights.238.kebler.net - port 222 +Host r238lights + user sysadmin + hostname lights.238.kebler.net + port 222 - Host r238lightsr - user root - hostname lights.238.kebler.net - port 222 +Host r238lightsr + user root + hostname lights.238.kebler.net + port 222 - # switches - Host s238lights - user sysadmin - hostname lights.238.kebler.net - port 122 +# switches +Host s238lights + user sysadmin + hostname lights.238.kebler.net + port 122 - Host s238lightsr - user root - hostname lights.238.kebler.net - port 122 +Host s238lightsr + user root + hostname lights.238.kebler.net + port 122 - # controller - Host 238lights - user sysadmin - hostname lights.238.kebler.net - port 22 +# controller +Host 238lights + user sysadmin + hostname lights.238.kebler.net + port 22 - # root connections - Host 238lightsr - user root - hostname lights.238.kebler.net - port 22 +# root connections +Host 238lightsr + user root + hostname lights.238.kebler.net + port 22 ## FOR ACCESS WHEN OUTSIDE 238 VIA NAT PORT FORWARDING WHEN VPN IS OFFLINE Host w238nas - user sysadmin - hostname 238.kebler.net - port 322 - ForwardX11 yes + user sysadmin + hostname 238.kebler.net + port 322 + ForwardX11 yes Host w238nasf - user sysadmin - hostname 238.kebler.net - port 322 - IdentityFile ~/.ssh/sysadmin.kebler.net - ForwardX11 yes + user sysadmin + hostname 238.kebler.net + port 322 + IdentityFile ~/.ssh/sysadmin.kebler.net + ForwardX11 yes Host w238nasr - user root - hostname 238.kebler.net - port 322 - ForwardX11 yes + user root + hostname 238.kebler.net + port 322 + ForwardX11 yes ## router Host w238gate - user sysadmin - hostname 238.kebler.net - IdentityFile ~/.ssh/sysadmin.kebler.net + user sysadmin + hostname 238.kebler.net + IdentityFile ~/.ssh/sysadmin.kebler.net Host w238gater - user root - hostname 238.kebler.net - IdentityFile ~/.ssh/sysadmin.kebler.net + user root + hostname 238.kebler.net + IdentityFile ~/.ssh/sysadmin.kebler.net + +# admin server trantor Host wtrantor - user sysadmin - hostname 238.kebler.net - port 222 - IdentityFile ~/.ssh/sysadmin.kebler.net + user sysadmin + hostname 238.kebler.net + port 222 + IdentityFile ~/.ssh/sysadmin.kebler.net Host wtrantorr - user root - hostname 238.kebler.net - port 222 - IdentityFile ~/.ssh/sysadmin.kebler.net - + user root + hostname 238.kebler.net + port 222 + IdentityFile ~/.ssh/sysadmin.kebler.net diff --git a/312.kebler.net/function/ssh-mounts/312 b/312.kebler.net/function/ssh-mounts/312 new file mode 100644 index 0000000..5519164 --- /dev/null +++ b/312.kebler.net/function/ssh-mounts/312 @@ -0,0 +1,18 @@ +#!/bin/ + +function mnt312admin() { + smount sysadmin@admin.312.kebler.net:/home/sysadmin /mnt/312/admin/sysadmin -p 22 + smount sysadmin@admin.312.kebler.net:/opt /mnt/312/admin/opt -p 22 + smount sysadmin@admin.312.kebler.net:/mnt/data /mnt/312/admin/data -p 22 + smount root@admin.312.kebler.net:/ /mnt/312/admin/root -p 22 + smount root@admin.312.kebler.net:/etc /mnt/312/admin/etc -p 22 +} + +function umnt312admin() { + usmount /mnt/312/admin/opt + usmount /mnt/312/admin/data + usmount /mnt/312/admin/root + usmount /mnt/312/admin/etc + usmount /mnt/312/admin/sysadmin +} + diff --git a/312.kebler.net/ssh/config/312.cfg b/312.kebler.net/ssh/config/312.cfg new file mode 100644 index 0000000..8aa8d87 --- /dev/null +++ b/312.kebler.net/ssh/config/312.cfg @@ -0,0 +1,21 @@ +AddKeysToAgent yes +ForwardX11 no +ForwardX11Trusted yes +# ForwardAgent yes +# IdentityFile /mnt/AllData~/.ssh/privatekeys/sysadmin.kebler.net + +######### 238 McHaley Network ################ + +## misc + +## router + +Host 312admin + user sysadmin + hostname admin.312.kebler.net + ForwardX11 yes + +Host 312adminr + user root + hostname admin.312.kebler.net + ForwardX11 yes diff --git a/all/function/ssh b/all/function/ssh deleted file mode 100644 index f01e7c8..0000000 --- a/all/function/ssh +++ /dev/null @@ -1 +0,0 @@ -module_load ssh diff --git a/all/modules/rrsync.sh b/all/modules/rrsync.sh new file mode 100755 index 0000000..9d352e0 --- /dev/null +++ b/all/modules/rrsync.sh @@ -0,0 +1,246 @@ +#!/usr/bin/perl +# Name: /usr/local/bin/rrsync (should also have a symlink in /usr/bin) +# Purpose: Restricts rsync to subdirectory declared in .ssh/authorized_keys +# Author: Joe Smith 30-Sep-2004 +# Modified by: Wayne Davison +# https://www.guyrutenberg.com/2014/01/14/restricting-ssh-access-to-rsync/ +# insert this before key in authorized keys, include -ro before access root to limit to read only +# command="/path/to/rrsync /root/of/access" ,no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding +use strict; + +use Socket; +use Cwd 'abs_path'; +use File::Glob ':glob'; + +# You may configure these values to your liking. See also the section +# of options if you want to disable any options that rsync accepts. +use constant RSYNC => '/usr/bin/rsync'; +use constant LOGFILE => 'rrsync.log'; + +my $Usage = < 0, + 'backup-dir' => 2, + 'block-size' => 1, + 'bwlimit' => 1, + 'checksum-seed' => 1, + 'compare-dest' => 2, + 'compress-level' => 1, + 'copy-dest' => 2, + 'copy-unsafe-links' => 0, + 'daemon' => -1, + 'debug' => 1, + 'delay-updates' => 0, + 'delete' => 0, + 'delete-after' => 0, + 'delete-before' => 0, + 'delete-delay' => 0, + 'delete-during' => 0, + 'delete-excluded' => 0, + 'delete-missing-args' => 0, + 'existing' => 0, + 'fake-super' => 0, + 'files-from' => 3, + 'force' => 0, + 'from0' => 0, + 'fuzzy' => 0, + 'group' => 0, + 'groupmap' => 1, + 'hard-links' => 0, + 'iconv' => 1, + 'ignore-errors' => 0, + 'ignore-existing' => 0, + 'ignore-missing-args' => 0, + 'ignore-times' => 0, + 'info' => 1, + 'inplace' => 0, + 'link-dest' => 2, + 'links' => 0, + 'list-only' => 0, + 'log-file' => 3, + 'log-format' => 1, + 'max-delete' => 1, + 'max-size' => 1, + 'min-size' => 1, + 'modify-window' => 1, + 'new-compress' => 0, + 'no-implied-dirs' => 0, + 'no-r' => 0, + 'no-relative' => 0, + 'no-specials' => 0, + 'numeric-ids' => 0, + 'one-file-system' => 0, + 'only-write-batch' => 1, + 'owner' => 0, + 'partial' => 0, + 'partial-dir' => 2, + 'perms' => 0, + 'preallocate' => 0, + 'recursive' => 0, + 'remove-sent-files' => $only eq 'r' ? -1 : 0, + 'remove-source-files' => $only eq 'r' ? -1 : 0, + 'safe-links' => 0, + 'sender' => 0, + 'server' => 0, + 'size-only' => 0, + 'skip-compress' => 1, + 'specials' => 0, + 'stats' => 0, + 'suffix' => 1, + 'super' => 0, + 'temp-dir' => 2, + 'timeout' => 1, + 'times' => 0, + 'use-qsort' => 0, + 'usermap' => 1, +); + +### END of options data produced by the cull_options script. ### + +if ($short_disabled ne '') { + $short_no_arg =~ s/[$short_disabled]//go; + $short_with_num =~ s/[$short_disabled]//go; +} +$short_no_arg = "[$short_no_arg]" if length($short_no_arg) > 1; +$short_with_num = "[$short_with_num]" if length($short_with_num) > 1; + +my $write_log = -f LOGFILE && open(LOG, '>>', LOGFILE); + +chdir($subdir) or die "$0: Unable to chdir to restricted dir: $!\n"; + +my(@opts, @args); +my $in_options = 1; +my $last_opt = ''; +my $check_type; +while ($command =~ /((?:[^\s\\]+|\\.[^\s\\]*)+)/g) { + $_ = $1; + if ($check_type) { + push(@opts, check_arg($last_opt, $_, $check_type)); + $check_type = 0; + } elsif ($in_options) { + push(@opts, $_); + if ($_ eq '.') { + $in_options = 0; + } else { + die "$0: invalid option: '-'\n" if $_ eq '-'; + next if /^-$short_no_arg*(e\d*\.\w*)?$/o || /^-$short_with_num\d+$/o; + + my($opt,$arg) = /^--([^=]+)(?:=(.*))?$/; + my $disabled; + if (defined $opt) { + my $ct = $long_opt{$opt}; + last unless defined $ct; + next if $ct == 0; + if ($ct > 0) { + if (!defined $arg) { + $check_type = $ct; + $last_opt = $opt; + next; + } + $arg = check_arg($opt, $arg, $ct); + $opts[-1] =~ s/=.*/=$arg/; + next; + } + $disabled = 1; + $opt = "--$opt"; + } elsif ($short_disabled ne '') { + $disabled = /^-$short_no_arg*([$short_disabled])/o; + $opt = "-$1"; + } + + last unless $disabled; # Generate generic failure + die "$0: option $opt has been disabled on this server.\n"; + } + } else { + if ($subdir ne '/') { + # Validate args to ensure they don't try to leave our restricted dir. + s{//+}{/}g; + s{^/}{}; + s{^$}{.}; + die "$0: do not use .. in any path!\n" if m{(^|/)\\?\.\\?\.(\\?/|$)}; + } + push(@args, bsd_glob($_, GLOB_LIMIT|GLOB_NOCHECK|GLOB_BRACE|GLOB_QUOTE)); + } +} +die "$0: invalid rsync-command syntax or options\n" if $in_options; + +@args = ( '.' ) if !@args; + +if ($write_log) { + my ($mm,$hh) = (localtime)[1,2]; + my $host = $ENV{SSH_CONNECTION} || 'unknown'; + $host =~ s/ .*//; # Keep only the client's IP addr + $host =~ s/^::ffff://; + $host = gethostbyaddr(inet_aton($host),AF_INET) || $host; + printf LOG "%02d:%02d %-13s [%s]\n", $hh, $mm, $host, "@opts @args"; + close LOG; +} + +# Note: This assumes that the rsync protocol will not be maliciously hijacked. +exec(RSYNC, @opts, @args) or die "exec(rsync @opts @args) failed: $? $!"; + +sub check_arg +{ + my($opt, $arg, $type) = @_; + $arg =~ s/\\(.)/$1/g; + if ($subdir ne '/' && ($type == 3 || ($type == 2 && !$am_sender))) { + $arg =~ s{//}{/}g; + die "Do not use .. in --$opt; anchor the path at the root of your restricted dir.\n" + if $arg =~ m{(^|/)\.\.(/|$)}; + $arg =~ s{^/}{$subdir/}; + } + $arg; +} diff --git a/all/modules/ssh.sh b/all/modules/ssh.sh index 3643b03..36f73fb 100644 --- a/all/modules/ssh.sh +++ b/all/modules/ssh.sh @@ -81,6 +81,12 @@ ssh() { fi } + ssh_test() { + echo running non-interactive ssh test on $2 with user $1 + ssh $1@$2 "cat .bashrc" + # env | grep -E 'SHELL|BASH|SSH';type module_load;module_load helpers;adirname . + } + function rrem() { ssh -X -t "$@" }