kebler.net
/
bash-shell-network
Archived
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

added 312

master
Kebler Network System Administrator 2021-07-04 17:17:32 -07:00
parent 57705c1082
commit e396386725
8 changed files with 462 additions and 152 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
238.kebler.net/function/gateway Normal file
View File

@ -0,0 +1,14 @@
#!/bin/bash
# commands that run on 238 gateway router
function rdns() {
module_load ssh
ssh 238gater 'systemctl restart dnsmasq'
}
function ednsproxy() {
module_load ssh
ssh 238gate '/bin/bash -e "nano /opt/dnsmasq/proxy.238.kebler.net"'
#ssh 238gate 'cd /opt/dnsmasq/; ls -la'
}

123
238.kebler.net/function/ssh-mounts/238
View File

@ -1,89 +1,88 @@
#!/bin/bash #!/bin/bash
function mnt238gate(){ function mnt238gate() {
smount sysadmin@gateway.238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22 smount sysadmin@gateway.238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22
smount sysadmin@gateway.238.kebler.net:/opt /mnt/238/gate/opt -p 22 smount sysadmin@gateway.238.kebler.net:/opt /mnt/238/gate/opt -p 22
smount root@gateway.238.kebler.net:/ /mnt/238/gate/root -p 22 smount root@gateway.238.kebler.net:/ /mnt/238/gate/root -p 22
smount root@gateway.238.kebler.net:/etc /mnt/238/gate/etc -p 22 smount root@gateway.238.kebler.net:/etc /mnt/238/gate/etc -p 22
} }
function wmnt238gate() {
function wmnt238gate(){ smount sysadmin@238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22
smount sysadmin@238.kebler.net:/home/sysadmin /mnt/238/gate/sysadmin -p 22 smount sysadmin@238.kebler.net:/opt /mnt/238/gate/opt -p 22
smount sysadmin@238.kebler.net:/opt /mnt/238/gate/opt -p 22 smount root@238.kebler.net:/ /mnt/238/gate/root -p 22
smount root@238.kebler.net:/ /mnt/238/gate/root -p 22 smount root@238.kebler.net:/etc /mnt/238/gate/etc -p 22
smount root@238.kebler.net:/etc /mnt/238/gate/etc -p 22
} }
function umnt238gate(){ function umnt238gate() {
usmount /mnt/238/gate/opt usmount /mnt/238/gate/opt
usmount /mnt/238/gate/root usmount /mnt/238/gate/root
usmount /mnt/238/gate/etc usmount /mnt/238/gate/etc
usmount /mnt/238/gate/sysadmin usmount /mnt/238/gate/sysadmin
} }
function mntseldon(){ function mntseldon() {
smount sysadmin@seldon.kebler.net:/home/sysadmin /mnt/238/seldon/sysadmin -p 22 smount sysadmin@seldon.kebler.net:/home/sysadmin /mnt/238/seldon/sysadmin -p 22
smount sysadmin@seldon.kebler.net:/opt /mnt/238/seldon/opt -p 22 smount sysadmin@seldon.kebler.net:/opt /mnt/238/seldon/opt -p 22
smount root@seldon.kebler.net:/ /mnt/238/seldon/root -p 22 smount root@seldon.kebler.net:/ /mnt/238/seldon/root -p 22
smount root@seldon.kebler.net:/etc /mnt/238/seldon/etc -p 22 smount root@seldon.kebler.net:/etc /mnt/238/seldon/etc -p 22
} }
function umntseldon(){ function umntseldon() {
usmount /mnt/238/seldon/opt usmount /mnt/238/seldon/opt
usmount /mnt/238/seldon/root usmount /mnt/238/seldon/root
usmount /mnt/238/seldon/etc usmount /mnt/238/seldon/etc
usmount /mnt/238/seldon/sysadmin usmount /mnt/238/seldon/sysadmin
} }
function mnt238nas() {
function mnt238nas(){ smount sysadmin@nas.238.kebler.net:/opt /mnt/238/nas/opt -p 22
smount sysadmin@nas.238.kebler.net:/opt /mnt/238/nas/opt -p 22 smount sysadmin@nas.238.kebler.net:/mnt/data /mnt/238/nas/data -p 22
smount sysadmin@nas.238.kebler.net:/mnt/data /mnt/238/nas/data -p 22 smount sysadmin@nas.238.kebler.net:/mnt/datamirror /mnt/238/nas/datamirror -p 22
smount sysadmin@nas.238.kebler.net:/mnt/datamirror /mnt/238/nas/datamirror -p 22 smount sysadmin@nas.kebler.net:/home/sysadmin /mnt/238/nas/sysadmin -p 22
smount sysadmin@nas.kebler.net:/home/sysadmin /mnt/238/nas/sysadmin -p 22 smount root@nas.238.kebler.net:/ /mnt/238/nas/root -p 22
smount root@nas.238.kebler.net:/ /mnt/238/nas/root -p 22
} }
function umnt238nas() {
function umnt238nas(){ usmount /mnt/238/nas/opt
usmount /mnt/238/nas/opt usmount /mnt/238/nas/data
usmount /mnt/238/nas/data usmount /mnt/238/nas/datamirror
usmount /mnt/238/nas/datamirror usmount /mnt/238/nas/sysadmin
usmount /mnt/238/nas/sysadmin usmount /mnt/238/nas/root
usmount /mnt/238/nas/root
} }
function mnttrantor(){ function mnttrantor() {
smount sysadmin@trantor.kebler.net:/home/sysadmin /mnt/238/trantor/sysadmin -p 22 smount sysadmin@trantor.kebler.net:/home/sysadmin /mnt/238/trantor/sysadmin -p 22
smount sysadmin@trantor.kebler.net:/opt /mnt/238/trantor/opt -p 22 smount sysadmin@trantor.kebler.net:/opt /mnt/238/trantor/opt -p 22
smount sysadmin@trantor.kebler.net:/mnt/data /mnt/238/trantor/data -p 22 smount sysadmin@trantor.kebler.net:/mnt/data /mnt/238/trantor/data -p 22
smount root@trantor.kebler.net:/ /mnt/238/trantor/root -p 22 smount root@trantor.kebler.net:/ /mnt/238/trantor/root -p 22
smount sysadmin@trantor.kebler.net:/backup /mnt/238/trantor/backup -p 22
} }
function umnttrantor(){ function umnttrantor() {
usmount /mnt/238/trantor/opt usmount /mnt/238/trantor/opt
usmount /mnt/238/trantor/root usmount /mnt/238/trantor/root
usmount /mnt/238/trantor/data usmount /mnt/238/trantor/data
usmount /mnt/238/trantor/sysadmin usmount /mnt/238/trantor/sysadmin
usmount /mnt/238/trantor/backup
} }
function mntwater(){ function mntwater() {
smount sysadmin@water.kebler.net:/home/sysadmin /mnt/238/water/home -p 22 smount sysadmin@water.kebler.net:/home/sysadmin /mnt/238/water/home -p 22
smount sysadmin@water.kebler.net:/opt /mnt/238/water/opt -p 22 smount sysadmin@water.kebler.net:/opt /mnt/238/water/opt -p 22
smount root@water.kebler.net:/ /mnt/238/water/root -p 22 smount root@water.kebler.net:/ /mnt/238/water/root -p 22
} }
function umntwater(){ function umntwater() {
usmount /mnt/238/water/opt usmount /mnt/238/water/opt
usmount /mnt/238/water/root usmount /mnt/238/water/root
usmount /mnt/238/water/home usmount /mnt/238/water/home
} }
function mnt238hass(){ function mnt238hass() {
smount root@hassio.238.kebler.net:/ /mnt/238/hass -p 22 -o allow_other smount root@hassio.238.kebler.net:/ /mnt/238/hass -p 22 -o allow_other
} }
function umnt238hass(){ function umnt238hass() {
usmount /mnt/238/hass usmount /mnt/238/hass
} }

31
238.kebler.net/ssh/config/238.cfg
View File

@ -2,7 +2,7 @@ AddKeysToAgent yes
ForwardX11 no ForwardX11 no
ForwardX11Trusted yes ForwardX11Trusted yes
# ForwardAgent yes # ForwardAgent yes
IdentityFile ~/.ssh/privatekeys/sysadmin.kebler.net # IdentityFile /mnt/AllData~/.ssh/privatekeys/sysadmin.kebler.net
######### 238 McHaley Network ################ ######### 238 McHaley Network ################
@ -49,12 +49,18 @@ Host 238admin trantor
hostname admin.238.kebler.net hostname admin.238.kebler.net
ForwardX11 yes ForwardX11 yes
Host 238adminr trantorr Host 238adminr trantorr
user root user root
hostname admin.238.kebler.net hostname admin.238.kebler.net
ForwardX11 yes ForwardX11 yes
Host 288adminb trantorb
user root
hostname trantor.kebler.net
IdentityFile /mnt/AllData/secure/privatekeys/xfer.kebler.net
IdentitiesOnly yes
# ServerAliveInterval 60
# ServerAliveCountMax 240
Host seldon printer Host seldon printer
user sysadmin user sysadmin
@ -68,35 +74,35 @@ Host rseldon
# Lights Sytem Network # Lights Sytem Network
# relays # relays
Host r238lights Host r238lights
user sysadmin user sysadmin
hostname lights.238.kebler.net hostname lights.238.kebler.net
port 222 port 222
Host r238lightsr Host r238lightsr
user root user root
hostname lights.238.kebler.net hostname lights.238.kebler.net
port 222 port 222
# switches # switches
Host s238lights Host s238lights
user sysadmin user sysadmin
hostname lights.238.kebler.net hostname lights.238.kebler.net
port 122 port 122
Host s238lightsr Host s238lightsr
user root user root
hostname lights.238.kebler.net hostname lights.238.kebler.net
port 122 port 122
# controller # controller
Host 238lights Host 238lights
user sysadmin user sysadmin
hostname lights.238.kebler.net hostname lights.238.kebler.net
port 22 port 22
# root connections # root connections
Host 238lightsr Host 238lightsr
user root user root
hostname lights.238.kebler.net hostname lights.238.kebler.net
port 22 port 22
@ -133,6 +139,8 @@ Host w238gater
hostname 238.kebler.net hostname 238.kebler.net
IdentityFile ~/.ssh/sysadmin.kebler.net IdentityFile ~/.ssh/sysadmin.kebler.net
# admin server trantor
Host wtrantor Host wtrantor
user sysadmin user sysadmin
hostname 238.kebler.net hostname 238.kebler.net
@ -144,4 +152,3 @@ Host wtrantorr
hostname 238.kebler.net hostname 238.kebler.net
port 222 port 222
IdentityFile ~/.ssh/sysadmin.kebler.net IdentityFile ~/.ssh/sysadmin.kebler.net

18
312.kebler.net/function/ssh-mounts/312 Normal file
View File

@ -0,0 +1,18 @@
#!/bin/
function mnt312admin() {
smount sysadmin@admin.312.kebler.net:/home/sysadmin /mnt/312/admin/sysadmin -p 22
smount sysadmin@admin.312.kebler.net:/opt /mnt/312/admin/opt -p 22
smount sysadmin@admin.312.kebler.net:/mnt/data /mnt/312/admin/data -p 22
smount root@admin.312.kebler.net:/ /mnt/312/admin/root -p 22
smount root@admin.312.kebler.net:/etc /mnt/312/admin/etc -p 22
}
function umnt312admin() {
usmount /mnt/312/admin/opt
usmount /mnt/312/admin/data
usmount /mnt/312/admin/root
usmount /mnt/312/admin/etc
usmount /mnt/312/admin/sysadmin
}

21
312.kebler.net/ssh/config/312.cfg Normal file
View File

@ -0,0 +1,21 @@
AddKeysToAgent yes
ForwardX11 no
ForwardX11Trusted yes
# ForwardAgent yes
# IdentityFile /mnt/AllData~/.ssh/privatekeys/sysadmin.kebler.net
######### 238 McHaley Network ################
## misc
## router
Host 312admin
user sysadmin
hostname admin.312.kebler.net
ForwardX11 yes
Host 312adminr
user root
hostname admin.312.kebler.net
ForwardX11 yes

1
all/function/ssh
View File

@ -1 +0,0 @@
module_load ssh

246
all/modules/rrsync.sh Executable file
View File

@ -0,0 +1,246 @@
#!/usr/bin/perl
# Name: /usr/local/bin/rrsync (should also have a symlink in /usr/bin)
# Purpose: Restricts rsync to subdirectory declared in .ssh/authorized_keys
# Author: Joe Smith <js-cgi@inwap.com> 30-Sep-2004
# Modified by: Wayne Davison <wayned@samba.org>
# https://www.guyrutenberg.com/2014/01/14/restricting-ssh-access-to-rsync/
# insert this before key in authorized keys, include -ro before access root to limit to read only
# command="/path/to/rrsync /root/of/access" ,no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding
use strict;
use Socket;
use Cwd 'abs_path';
use File::Glob ':glob';
# You may configure these values to your liking. See also the section
# of options if you want to disable any options that rsync accepts.
use constant RSYNC => '/usr/bin/rsync';
use constant LOGFILE => 'rrsync.log';
my $Usage = <<EOM;
Use 'command="$0 [-ro|-wo] SUBDIR"'
in front of lines in $ENV{HOME}/.ssh/authorized_keys
EOM
# Handle the -ro and -wo options.
our $only = '';
while (@ARGV && $ARGV[0] =~ /^-([rw])o$/) {
my $r_or_w = $1;
if ($only && $only ne $r_or_w) {
die "$0: the -ro and -wo options conflict.\n";
}
$only = $r_or_w;
shift;
}
our $subdir = shift;
die "$0: No subdirectory specified\n$Usage" unless defined $subdir;
$subdir = abs_path($subdir);
die "$0: Restricted directory does not exist!\n" if $subdir ne '/' && !-d $subdir;
# The client uses "rsync -av -e ssh src/ server:dir/", and sshd on the server
# executes this program when .ssh/authorized_keys has 'command="..."'.
# For example:
# command="rrsync logs/client" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzGhEeNlPr...
# command="rrsync -ro results" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAmkHG1WCjC...
#
# Format of the environment variables set by sshd:
# SSH_ORIGINAL_COMMAND=rsync --server -vlogDtpr --partial . ARG # push
# SSH_ORIGINAL_COMMAND=rsync --server --sender -vlogDtpr --partial . ARGS # pull
# SSH_CONNECTION=client_addr client_port server_port
my $command = $ENV{SSH_ORIGINAL_COMMAND};
die "$0: Not invoked via sshd\n$Usage" unless defined $command;
die "$0: SSH_ORIGINAL_COMMAND='$command' is not rsync\n" unless $command =~ s/^rsync\s+//;
die "$0: --server option is not first\n" unless $command =~ /^--server\s/;
our $am_sender = $command =~ /^--server\s+--sender\s/; # Restrictive on purpose!
die "$0 sending to read-only server not allowed\n" if $only eq 'r' && !$am_sender;
die "$0 reading from write-only server not allowed\n" if $only eq 'w' && $am_sender;
### START of options data produced by the cull_options script. ###
# These options are the only options that rsync might send to the server,
# and only in the option format that the stock rsync produces.
# To disable a short-named option, add its letter to this string:
our $short_disabled = 's';
our $short_no_arg = 'ACDEHIJKLORSWXbcdgklmnoprstuvxyz'; # DO NOT REMOVE ANY
our $short_with_num = 'B'; # DO NOT REMOVE ANY
# To disable a long-named option, change its value to a -1. The values mean:
# 0 = the option has no arg; 1 = the arg doesn't need any checking; 2 = only
# check the arg when receiving; and 3 = always check the arg.
our %long_opt = (
'append' => 0,
'backup-dir' => 2,
'block-size' => 1,
'bwlimit' => 1,
'checksum-seed' => 1,
'compare-dest' => 2,
'compress-level' => 1,
'copy-dest' => 2,
'copy-unsafe-links' => 0,
'daemon' => -1,
'debug' => 1,
'delay-updates' => 0,
'delete' => 0,
'delete-after' => 0,
'delete-before' => 0,
'delete-delay' => 0,
'delete-during' => 0,
'delete-excluded' => 0,
'delete-missing-args' => 0,
'existing' => 0,
'fake-super' => 0,
'files-from' => 3,
'force' => 0,
'from0' => 0,
'fuzzy' => 0,
'group' => 0,
'groupmap' => 1,
'hard-links' => 0,
'iconv' => 1,
'ignore-errors' => 0,
'ignore-existing' => 0,
'ignore-missing-args' => 0,
'ignore-times' => 0,
'info' => 1,
'inplace' => 0,
'link-dest' => 2,
'links' => 0,
'list-only' => 0,
'log-file' => 3,
'log-format' => 1,
'max-delete' => 1,
'max-size' => 1,
'min-size' => 1,
'modify-window' => 1,
'new-compress' => 0,
'no-implied-dirs' => 0,
'no-r' => 0,
'no-relative' => 0,
'no-specials' => 0,
'numeric-ids' => 0,
'one-file-system' => 0,
'only-write-batch' => 1,
'owner' => 0,
'partial' => 0,
'partial-dir' => 2,
'perms' => 0,
'preallocate' => 0,
'recursive' => 0,
'remove-sent-files' => $only eq 'r' ? -1 : 0,
'remove-source-files' => $only eq 'r' ? -1 : 0,
'safe-links' => 0,
'sender' => 0,
'server' => 0,
'size-only' => 0,
'skip-compress' => 1,
'specials' => 0,
'stats' => 0,
'suffix' => 1,
'super' => 0,
'temp-dir' => 2,
'timeout' => 1,
'times' => 0,
'use-qsort' => 0,
'usermap' => 1,
);
### END of options data produced by the cull_options script. ###
if ($short_disabled ne '') {
$short_no_arg =~ s/[$short_disabled]//go;
$short_with_num =~ s/[$short_disabled]//go;
}
$short_no_arg = "[$short_no_arg]" if length($short_no_arg) > 1;
$short_with_num = "[$short_with_num]" if length($short_with_num) > 1;
my $write_log = -f LOGFILE && open(LOG, '>>', LOGFILE);
chdir($subdir) or die "$0: Unable to chdir to restricted dir: $!\n";
my(@opts, @args);
my $in_options = 1;
my $last_opt = '';
my $check_type;
while ($command =~ /((?:[^\s\\]+|\\.[^\s\\]*)+)/g) {
$_ = $1;
if ($check_type) {
push(@opts, check_arg($last_opt, $_, $check_type));
$check_type = 0;
} elsif ($in_options) {
push(@opts, $_);
if ($_ eq '.') {
$in_options = 0;
} else {
die "$0: invalid option: '-'\n" if $_ eq '-';
next if /^-$short_no_arg*(e\d*\.\w*)?$/o || /^-$short_with_num\d+$/o;
my($opt,$arg) = /^--([^=]+)(?:=(.*))?$/;
my $disabled;
if (defined $opt) {
my $ct = $long_opt{$opt};
last unless defined $ct;
next if $ct == 0;
if ($ct > 0) {
if (!defined $arg) {
$check_type = $ct;
$last_opt = $opt;
next;
}
$arg = check_arg($opt, $arg, $ct);
$opts[-1] =~ s/=.*/=$arg/;
next;
}
$disabled = 1;
$opt = "--$opt";
} elsif ($short_disabled ne '') {
$disabled = /^-$short_no_arg*([$short_disabled])/o;
$opt = "-$1";
}
last unless $disabled; # Generate generic failure
die "$0: option $opt has been disabled on this server.\n";
}
} else {
if ($subdir ne '/') {
# Validate args to ensure they don't try to leave our restricted dir.
s{//+}{/}g;
s{^/}{};
s{^$}{.};
die "$0: do not use .. in any path!\n" if m{(^|/)\\?\.\\?\.(\\?/|$)};
}
push(@args, bsd_glob($_, GLOB_LIMIT|GLOB_NOCHECK|GLOB_BRACE|GLOB_QUOTE));
}
}
die "$0: invalid rsync-command syntax or options\n" if $in_options;
@args = ( '.' ) if !@args;
if ($write_log) {
my ($mm,$hh) = (localtime)[1,2];
my $host = $ENV{SSH_CONNECTION} || 'unknown';
$host =~ s/ .*//; # Keep only the client's IP addr
$host =~ s/^::ffff://;
$host = gethostbyaddr(inet_aton($host),AF_INET) || $host;
printf LOG "%02d:%02d %-13s [%s]\n", $hh, $mm, $host, "@opts @args";
close LOG;
}
# Note: This assumes that the rsync protocol will not be maliciously hijacked.
exec(RSYNC, @opts, @args) or die "exec(rsync @opts @args) failed: $? $!";
sub check_arg
{
my($opt, $arg, $type) = @_;
$arg =~ s/\\(.)/$1/g;
if ($subdir ne '/' && ($type == 3 || ($type == 2 && !$am_sender))) {
$arg =~ s{//}{/}g;
die "Do not use .. in --$opt; anchor the path at the root of your restricted dir.\n"
if $arg =~ m{(^|/)\.\.(/|$)};
$arg =~ s{^/}{$subdir/};
}
$arg;
}

6
all/modules/ssh.sh
View File

@ -81,6 +81,12 @@ ssh() {
fi fi
} }
ssh_test() {
echo running non-interactive ssh test on $2 with user $1
ssh $1@$2 "cat .bashrc"
# env | grep -E 'SHELL|BASH|SSH';type module_load;module_load helpers;adirname .
}
function rrem() { function rrem() {
ssh -X -t "$@" ssh -X -t "$@"
} }