#!/bin/bash shopt -s nocasematch; #shell option -s allows for case insensitivty throughout the script ####################################################### #sFTP Chroots with bind mount script v1.3 #Author: Luke Shirnia #Website: lukeslinuxlessons.co.uk #Copyright ####################################################### #run script with: #bash <(curl replace_with_notes.rackerjackrawfile --silent) #################################################################################### #Release v1.3 Update notes: #Script tested abd works with: #Ubuntu 14.04LTS, 12.04LTS #CentOS 6, 6.5/6.6 #redhat 6, 6.5 #################################################################################### #################################################################################### #Release v1.2 Update notes: #New features: #-Script now has the ability to show all non-system users #-Comments have started to be added to the code #Other changes: #-Code has been cleaned up #-Script now only mounts the specified location rather than the whole of /etc/fstab #################################################################################### globalg1="/home/chroot/" clear printf "\n----------------------------------------------" printf "\nsFTP chroot (with mounts)\nBy LukesLinuxLessons" printf "\n----------------------------------------------\n\n" ################################################################################### ############################sftp group section #################################### ################################################################################### checkifnewgroupexists() { #Check New Group exists or if it doesnt if [ ! "$newsftp" = "" ] && ( ! getent group "$newsftp" ); then #checks to make sure newsftp is not equal to nothing and the group does not exist already read -p "Are you sure you want to create the group $newsftp? (y/N) " newsftpyn case $newsftpyn in y|ye|yes) if ( ! getent group "$newsftp" ) && [ ! "$newsftp" = "" ]; then groupadd "$newsftp" printf " ----------------------------------------------\n" grep "^$newsftp:" /etc/group globalgroup=$newsftp printf "Group has been added!" printf "\n----------------------------------------------\n" fi ;; n|no ) printf "Please try again\n" read -p "What would you like the group to be called? " newsftp ;; *) printf "Please enter a valid Option" printf "\n----------------------------------------------\n" ;; esac else printf "Please enter a group name that doesn't exist" printf "\n----------------------------------------------\n" read -p "What would you like the group to be called? " newsftp fi } checkexistinggroup() { #Check Existing Group Exists--------------------------- cegeno1=$( grep -c "$esftpgroup:" /etc/group ) #greps for the exact username from /etc/passwd. Returns values cegeno2=$( grep -ci "$esftpgroup" /etc/group ) #greps for case insensive username from /etc/password and similar group names. Returns values if [ "$esftpgroup" = "" ]; then printf "Please do not leave the group field empty\n" printf "\n----------------------------------------------\n" cegeno1="0" #reset the value to 0 so that the loop continues elif [ "$cegeno1" -ge 1 ]; then globalgroup=$esftpgroup getent group "$esftpgroup" printf "Exists!" printf "\n----------------------------------------------\n" elif [ "$cegeno2" -ge 1 ]; then printf "That doesn't exist however the following similar group does: \n\n" grep -i "$esftpgroup" /etc/group printf " ----------------------------------------------\n" else printf "That does not exist, please try again\n" printf " ----------------------------------------------\n" fi } #--------------------sFTP Groups--------------------------------------------- while [[ ! ("$newsftpyn" =~ (y|ye|yes)$ ) ]]; do read -p "Would you like to create a NEW sFTP group? " ngyn case $ngyn in y|ye|yes ) read -p "What would you like the group to be called? " newsftp while [[ ! ("$newsftpyn" =~ (y|ye|yes)$ ) ]]; do #while the new sftp group has not been confirmed (yes) keep looping checkifnewgroupexists done ;; n|N|no ) cegeno1="0" #assins a value to the vaiable until the loop starts while [ "$cegeno1" -lt 1 ]; do read -p "Please enter a groupname that already exists: " esftpgroup checkexistinggroup done break #use this to get out of the main loop ;; *) printf "Please enter a valid option" printf "\n----------------------------------------------\n" ;; esac done ################################################################################### #############Would you like a create a new user for sftp?########################## ################################################################################### newuseryestest() { if [ ! "$username" = "" ] && ( ! getent passwd "^$username:" ); then read -p "Are you sure you wish to add the user $username ? (y/N)" nuyn #nuyn = new user yes no case $nuyn in y|ye|yes ) useradd "$username" globaluser=$username egrep "^$username:" /etc/passwd printf "\n----------------------------------------------\n" ;; n|no ) printf "Please try again" printf "\n----------------------------------------------\n" read -p "What username would you like for the new user? " username ;; *) printf "Please enter a valid option\n" ;; esac else printf "\nPlease enter a valid option" printf "\n----------------------------------------------\n" read -p "What username would you like for the new user? " username fi } useexistinguser() { value=$( grep -ic "^$currentuser" /etc/passwd ) valuecatch=$( grep -c "^$currentuser:" /etc/passwd ) if [ "$currentuser" = "" ]; then printf "Please enter a username\n" elif [ ! "$currentuser" = "" ] && [ "$value" -ge 1 ] && [ "$valuecatch" -ge 1 ]; then printf "Thank you, you will be chrooting: $currentuser" globaluser=$currentuser printf "\n----------------------------------------------\n" elif [ "$value" -ge 1 ]; then printf "\n----------------------------------------------\n" printf "You did not enter an existing user, please try again\n" printf "Available users with similar name are: \n\n" egrep -i "^$currentuser" /etc/passwd printf "\n----------------------------------------------\n" fi } listusers() { #this function is used to list all of the current non-system users l=$(grep "^UID_MIN" /etc/login.defs) # get mini UID limit from /etc/login.defs l1=$(grep "^UID_MAX" /etc/login.defs) # get max UID limit from /etc/login.defs awk -F':' -v "min=${l##UID_MIN}" -v "max=${l1##UID_MAX}" '{ if ( $3 >= min && $3 <= max ) print $0}' /etc/passwd # use awk to print if UID >= $MIN and UID <= $MAX } #--------------------------------sF./TP user------------------------------------- valuecatch="0" #valuecatch receives a proper value in the function "useexistinguser", assigning 0 here allows the loop to start before it received a valid value in the function while [[ ! ( "$nuyn" =~ (y|ye|yes)$ ) ]]; do read -p "Would you like to create a NEW sftp user? (l to list current users) (y/N/l): " newsftpuser #newsftpuser = new sftp user case $newsftpuser in y|ye|yes ) read -p "What username would you like for the new user? " username while [[ !( "$nuyn" =~ (y|ye|yes)$ ) ]]; do #while nuyn (new user yes no) is not equal to yes, then keep looping ??&& usernameval?? newuseryestest done ;; n|no ) while [ "$valuecatch" -lt 1 ]; do #while valuecatch (valuecatch=$( grep -c "^$currentuser:" /etc/passwd )) is not equal to a valid user, keep looping read -p "What is the current user you wish to chroot? " currentuser useexistinguser done break #this breaks out of the main while loop as the condition !( "$nuyn" =~ (y|ye|yes)$ will not be met however the loop is complete ;; l|list) #calls a function to list all of the current non-system users printf "\nCurrent users are:\n" listusers printf " ----------------------------------------------\n" ;; *) printf " -------Please enter a valid option!-------\n" printf " ----Try again---- \n" ;; esac done ################################################################################### ###########################"Edit" User [Functions]################################### ################################################################################### editchrootyes() { mkdir -p $globalg1$globaluser usermod -d $globalg1$globaluser -s /sbin/nologin -G $globalgroup $globaluser printf "\n" egrep "^$globaluser:" /etc/passwd eus=$(egrep -i "^$globaluser" /etc/passwd) } editchrootno() { printf "\nPlease remember to set up the correct user configuration after the script has run \n" usermod -G $globalgroup $globaluser eus="Please remember to edit the home directory and group of $globaluser" } editcustomchroot() { if [ ! "$ccd" = "" ] && [ -d "$ccd" ]; then read -p "Are you sure you want to chroot the user $globaluser to $ccd (y/N) " ccyn case $ccyn in y|ye|yes ) mkdir -p $ccd$globaluser usermod -d "$ccd" -G $globalgroup $globaluser printf "\n" grep "$globaluser:" /etc/passwd printf " ----------------------------------------------\n" eus=$(egrep -i "^$globaluser" /etc/passwd) globalg1=$ccd while [[ ! ( $sbinyn =~ (y|ye|yes|n|no)$ ) ]]; do editcustomchrootshell done ;; n|no ) printf "Please try again\n" printf "\n----------------------------------------------\n" printf "What location would you like to chroot the user $globaluser to? \n" read -p "Please finish the directory location with a / eg. /home/: " ccd ;; *) printf "Please enter a valid option\n" printf "\n----------------------------------------------\n" ;; esac else printf "\nPlease enter a valid directory \n" printf "\n----------------------------------------------\n" printf "What location would you like to chroot the user $globaluser to? \n" read -p "Please finish the directory location with a / eg. /home/: " ccd fi } editcustomchrootshell() { read -p "Would you like to change the user to /sbin/nologin? Yes/No/Custom (y/N) " sbinyn case $sbinyn in y|ye|yes) usermod -s /sbin/nologin $globaluser ;; n|no) printf "\nThe sFTP user created will still be able to ssh into the system\n" ;; *) printf "\nPlease can you enter a valid input\n" printf "\n----------------------------------------------\n" ;; esac } #------------------------------Edit User --------------------------------- while [[ ! ( "$chrootyn" =~ (y|ye|yes)$ ) ]]; do printf "Chroot the user $globaluser to a home directory of $globalg1$globaluser\n" printf "and a shell of /sbin/nologin? " read -p "Yes, No, Custom Directory (y/N/c): " chrootyn case $chrootyn in y|ye|yes) editchrootyes printf " ----------------------------------------------\n" break #comment out once main loop is changed? ;; n|no ) editchrootno break ;; c|custom) printf "" printf "What location would you like to chroot the user $globaluser to? \n" read -p "Please finish the directory location with a / eg. /home/: " ccd while [[ ! ("$ccyn" =~ (y|ye|yes)$ ) ]]; do editcustomchroot done break ;; *) printf "Please enter a valid option\n" printf " ----------------------------------------------\n" ;; esac done ################################################################################## #########################directory permissions [Functions]######################### ################################################################################### setdirectorypermissions() { printf "Users home directory: $globalg1$globaluser \n" globalg2="$globalg1$globaluser/" read -p "Would you like to automatically set permissions or manually set permissions? (a/M): " permissionsam case $permissionsam in a|auto|automatic ) chmod 711 $globalg1 chmod 755 $globalg2 chown root:root $globalg2 printf "\nThe following permissions have been set:" printf "\nchmod 711 $globalg1" printf "\nchmod 755 $globalg2\nchroot root:root $globalg2" printf "\n----------------------------------------------\n" ;; m|man|manually ) printf "Please remember to change the permissions after the script has run" printf "\n----------------------------------------------\n" break ;; * ) printf "Please enter a valid input (a/m)" printf "\n----------------------------------------------\n" ;; esac } #-----------------------directory permissions--------------------------------- # The following section is for setting the permissions on the directories shopt -s nocasematch; #this command configures the shell option -s (set enable) no-case-match which allows for case insensitivity. while [[ ! ( $permissionsam =~ (a|auto|automatic)$ ) ]]; do setdirectorypermissions done ################################################################################### ########################Setting Mount Binds [functions]############################ ################################################################################### confirmmountsyesno() { printf "What directory would you like to mount e.g. /var/www/vhost/website1 ? \n" read -p "Please enter the directory starting and ending with / e.g. /var/www/ " mountdirectory mdirectory=$mountdirectory if [ -d "$mdirectory" ] && [ ! "$mdirectory" = "" ]; then printf "$mdirectory"" Exists!! :)" printf "\n---------------------------------------------\n" while [[ ! ( "$myn" =~ (y|ye|yes)$ ) ]]; do read -p "Are you sure you would like to mount the directory $mdirectory? (y/N): " myn #mount yes no case $myn in y|ye|yes ) printf "Thank You" printf "\n---------------------------------------------" while [[ ! ( "$wmdyn" =~ (y|ye|yes)$ ) ]]; do #while mountdirectoryyesno #function done ;; n|no ) printf "Please try again!\n\n" break ;; *) printf "\nPlease enter yes or no (y/n) \n" ;; esac done else printf "$mdirectory Does not exist, please try again!" printf "\n---------------------------------------------\n" fi } mountdirectoryyesno() { printf "\nWhat directory would you like to CREATE for this mount?\n" printf "Please enter this location WITHOUT / before or after \n" read -p "Examples: $globalg2 website1 or domain1.co.uk: " wmd #wd = what mount directory while [[ ! ( "$wmdyn" =~ (y|ye|yes)$ ) ]]; do if [ ! "$wmd" = "" ]; then read -p "Are you sure you would like to mount to the following location $globalg2$wmd (y/N)? " wmdyn #wdyn = what mount directory yes no case $wmdyn in y|ye|yes ) printf "\nThank You!" printf "\n---------------------------------------------" printf "\n\nMaking directory "$globalg2$wmd"....\n" mkdir -p $globalg2$wmd echo "$mdirectory " "$globalg2$wmd " "none bind 0 0" >> /etc/fstab printf "Configuring fstab....\n" mount $globalg2$wmd #this command mounts the location that has been confirmed and then written to /etc/fstab chown $globaluser:$globalgroup $globalg2$wmd #changing ownsership of the mounted directory to allow the chrooted user to edit the files printf "Setting permissions on the directory....\n" printf "Mounting the directory....\n" printf "Setting correct permissions on the mount....\n" ;; n|no ) printf "\nPlease try again!\n" break ;; *) printf "\nPlease enter yes or no (y/n) \n" printf "\n---------------------------------------------\n" ;; esac else printf "Please enter a directory you wish to create for this mount" printf "\n---------------------------------------------\n" fi done } #--------------------------Setting Mount Binds--------------------------------- printf "\nSetting bind mounts\n" printf "\n---------------------------------------------\n" while [[ !( "$wmdyn" =~ (y|ye|yes)$ ) ]]; do #while the mount directory is not confirmed (yes) keep looping read -p "Would you like to set bind mount? (y/N) " mountyn case $mountyn in y|ye|yes ) while [[ !( "$myn" =~ (y|ye|yes)$ ) ]]; do #while mount directory (eg /var/) is not equal to yes then keep looping the function confirmmountsyesno #function done ;; n|no ) break #breaks the while loop as the following will not be met: !( "$wdyn" =~ (y|ye|yes)$ ) ;; *) printf "\nPlease enter yes or no \n" printf "\n---------------------------------------------\n" ;; esac done printf "\n---------------------------------------------\n" ################################################################################### ################################ Summary Sections################################## ################################################################################### printf "\n\n\n-----------------------------------------------------------------" printf "\n-------------------------Summary Section-------------------------" printf "\n-----------------------------------------------------------------" printf "\nThe following group was used: $globalgroup" printf "\nThe following user was added to that group: $globaluser " printf "\nIf you have created a new user please REMEMBER to change the password for the user" printf "\nChroot Directory: $globalg2" case $permissionsam in a|auto|automatic ) printf "\n-----------------------------------------------------------------" printf "\n\nThe following permissions have been set:" printf "\nchmod 711 $globalg1" printf "\nchmod 755 / chroot root:root $globalg2" ;; *) printf "\n------------Permissions------------" printf "\nYou chose to manually set permissions, please remember to do this now." ;; esac case $mountyn in a|auto|automatic ) printf "\n\n------------bind mounts------------" printf "\nYou configured:\n $mdirectory to mount to the location: $globalg2$wmd\n" ;; *) printf "\n----You chose NOT to set up bind mounts----\n" ;; esac printf "\n-----------------------------------------------------------------" printf "\n--Please remember to manually configure /etc/ssh/sshd_config file--\n" printf "Visit the following domain for an example configuration guide for sFTP" printf "\nhttp://lukeslinuxlessons.co.uk/sftp-chroot/#sshconfig\n" printf "\n-----------------------------------------------------------------\n" ###################################################################################