#!/bin/bash
shopt -s nocasematch; #shell option -s allows for case insensitivty throughout the script
#######################################################
#sFTP Chroots with bind mount script v1.3
#Author: Luke Shirnia
#Website: lukeslinuxlessons.co.uk
#Copyright
#######################################################
#run script with:
#bash <(curl replace_with_notes.rackerjackrawfile --silent)
####################################################################################
#Release v1.3 Update notes:
#Script tested abd works with:
#Ubuntu 14.04LTS, 12.04LTS
#CentOS 6, 6.5/6.6
#redhat 6, 6.5
####################################################################################
####################################################################################
#Release v1.2 Update notes:
#New features:
#-Script now has the ability to show all non-system users
#-Comments have started to be added to the code
#Other changes:
#-Code has been cleaned up
#-Script now only mounts the specified location rather than the whole of /etc/fstab
####################################################################################
globalg1="/home/chroot/"
clear
printf "\n----------------------------------------------"
printf "\nsFTP chroot (with mounts)\nBy LukesLinuxLessons"
printf "\n----------------------------------------------\n\n"
###################################################################################
############################sftp group section ####################################
###################################################################################
checkifnewgroupexists() { #Check New Group exists or if it doesnt
if [ ! "$newsftp" = "" ] && ( ! getent group "$newsftp" ); then #checks to make sure newsftp is not equal to nothing and the group does not exist already
read -p "Are you sure you want to create the group $newsftp? (y/N) " newsftpyn
case $newsftpyn in
y|ye|yes)
if ( ! getent group "$newsftp" ) && [ ! "$newsftp" = "" ]; then
groupadd "$newsftp"
printf " ----------------------------------------------\n"
grep "^$newsftp:" /etc/group
globalgroup=$newsftp
printf "Group has been added!"
printf "\n----------------------------------------------\n"
fi
;;
n|no )
printf "Please try again\n"
read -p "What would you like the group to be called? " newsftp
;;
*)
printf "Please enter a valid Option"
printf "\n----------------------------------------------\n"
;;
esac
else
printf "Please enter a group name that doesn't exist"
printf "\n----------------------------------------------\n"
read -p "What would you like the group to be called? " newsftp
fi
}
checkexistinggroup() { #Check Existing Group Exists---------------------------
cegeno1=$( grep -c "$esftpgroup:" /etc/group ) #greps for the exact username from /etc/passwd. Returns values
cegeno2=$( grep -ci "$esftpgroup" /etc/group ) #greps for case insensive username from /etc/password and similar group names. Returns values
if [ "$esftpgroup" = "" ]; then
printf "Please do not leave the group field empty\n"
printf "\n----------------------------------------------\n"
cegeno1="0" #reset the value to 0 so that the loop continues
elif [ "$cegeno1" -ge 1 ]; then
globalgroup=$esftpgroup
getent group "$esftpgroup"
printf "Exists!"
printf "\n----------------------------------------------\n"
elif [ "$cegeno2" -ge 1 ]; then
printf "That doesn't exist however the following similar group does: \n\n"
grep -i "$esftpgroup" /etc/group
printf " ----------------------------------------------\n"
else
printf "That does not exist, please try again\n"
printf " ----------------------------------------------\n"
fi
}
#--------------------sFTP Groups---------------------------------------------
while [[ ! ("$newsftpyn" =~ (y|ye|yes)$ ) ]]; do
read -p "Would you like to create a NEW sFTP group? <y/N> " ngyn
case $ngyn in
y|ye|yes )
read -p "What would you like the group to be called? " newsftp
while [[ ! ("$newsftpyn" =~ (y|ye|yes)$ ) ]]; do #while the new sftp group has not been confirmed (yes) keep looping
checkifnewgroupexists
done
;;
n|N|no )
cegeno1="0" #assins a value to the vaiable until the loop starts
while [ "$cegeno1" -lt 1 ]; do
read -p "Please enter a groupname that already exists: " esftpgroup
checkexistinggroup
done
break #use this to get out of the main loop
;;
*)
printf "Please enter a valid option"
printf "\n----------------------------------------------\n"
;;
esac
done
###################################################################################
#############Would you like a create a new user for sftp?##########################
###################################################################################
newuseryestest() {
if [ ! "$username" = "" ] && ( ! getent passwd "^$username:" ); then
read -p "Are you sure you wish to add the user $username ? (y/N)" nuyn #nuyn = new user yes no
case $nuyn in
y|ye|yes )
useradd "$username"
globaluser=$username
egrep "^$username:" /etc/passwd
printf "\n----------------------------------------------\n"
;;
n|no )
printf "Please try again"
printf "\n----------------------------------------------\n"
read -p "What username would you like for the new user? " username
;;
*)
printf "Please enter a valid option\n"
;;
esac
else
printf "\nPlease enter a valid option"
printf "\n----------------------------------------------\n"
read -p "What username would you like for the new user? " username
fi
}
useexistinguser() {
value=$( grep -ic "^$currentuser" /etc/passwd )
valuecatch=$( grep -c "^$currentuser:" /etc/passwd )
if [ "$currentuser" = "" ]; then
printf "Please enter a username\n"
elif [ ! "$currentuser" = "" ] && [ "$value" -ge 1 ] && [ "$valuecatch" -ge 1 ]; then
printf "Thank you, you will be chrooting: $currentuser"
globaluser=$currentuser
printf "\n----------------------------------------------\n"
elif [ "$value" -ge 1 ]; then
printf "\n----------------------------------------------\n"
printf "You did not enter an existing user, please try again\n"
printf "Available users with similar name are: \n\n"
egrep -i "^$currentuser" /etc/passwd
printf "\n----------------------------------------------\n"
fi
}
listusers() { #this function is used to list all of the current non-system users
l=$(grep "^UID_MIN" /etc/login.defs) # get mini UID limit from /etc/login.defs
l1=$(grep "^UID_MAX" /etc/login.defs) # get max UID limit from /etc/login.defs
awk -F':' -v "min=${l##UID_MIN}" -v "max=${l1##UID_MAX}" '{ if ( $3 >= min && $3 <= max ) print $0}' /etc/passwd # use awk to print if UID >= $MIN and UID <= $MAX
}
#--------------------------------sF./TP user-------------------------------------
valuecatch="0" #valuecatch receives a proper value in the function "useexistinguser", assigning 0 here allows the loop to start before it received a valid value in the function
while [[ ! ( "$nuyn" =~ (y|ye|yes)$ ) ]]; do
read -p "Would you like to create a NEW sftp user? (l to list current users) (y/N/l): " newsftpuser #newsftpuser = new sftp user
case $newsftpuser in
y|ye|yes )
read -p "What username would you like for the new user? " username
while [[ !( "$nuyn" =~ (y|ye|yes)$ ) ]]; do #while nuyn (new user yes no) is not equal to yes, then keep looping ??&& usernameval??
newuseryestest
done
;;
n|no )
while [ "$valuecatch" -lt 1 ]; do #while valuecatch (valuecatch=$( grep -c "^$currentuser:" /etc/passwd )) is not equal to a valid user, keep looping
read -p "What is the current user you wish to chroot? " currentuser
useexistinguser
done
break #this breaks out of the main while loop as the condition !( "$nuyn" =~ (y|ye|yes)$ will not be met however the loop is complete
;;
l|list) #calls a function to list all of the current non-system users
printf "\nCurrent users are:\n"
listusers
printf " ----------------------------------------------\n"
;;
*)
printf " -------Please enter a valid option!-------\n"
printf " ----Try again---- \n"
;;
esac
done
###################################################################################
###########################"Edit" User [Functions]###################################
###################################################################################
editchrootyes() {
mkdir -p $globalg1$globaluser
usermod -d $globalg1$globaluser -s /sbin/nologin -G $globalgroup $globaluser
printf "\n"
egrep "^$globaluser:" /etc/passwd
eus=$(egrep -i "^$globaluser" /etc/passwd)
}
editchrootno() {
printf "\nPlease remember to set up the correct user configuration after the script has run \n"
usermod -G $globalgroup $globaluser
eus="Please remember to edit the home directory and group of $globaluser"
}
editcustomchroot() {
if [ ! "$ccd" = "" ] && [ -d "$ccd" ]; then
read -p "Are you sure you want to chroot the user $globaluser to $ccd (y/N) " ccyn
case $ccyn in
y|ye|yes )
mkdir -p $ccd$globaluser
usermod -d "$ccd" -G $globalgroup $globaluser
printf "\n"
grep "$globaluser:" /etc/passwd
printf " ----------------------------------------------\n"
eus=$(egrep -i "^$globaluser" /etc/passwd)
globalg1=$ccd
while [[ ! ( $sbinyn =~ (y|ye|yes|n|no)$ ) ]]; do
editcustomchrootshell
done
;;
n|no )
printf "Please try again\n"
printf "\n----------------------------------------------\n"
printf "What location would you like to chroot the user $globaluser to? \n"
read -p "Please finish the directory location with a / eg. /home/: " ccd
;;
*)
printf "Please enter a valid option\n"
printf "\n----------------------------------------------\n"
;;
esac
else
printf "\nPlease enter a valid directory \n"
printf "\n----------------------------------------------\n"
printf "What location would you like to chroot the user $globaluser to? \n"
read -p "Please finish the directory location with a / eg. /home/: " ccd
fi
}
editcustomchrootshell() {
read -p "Would you like to change the user to /sbin/nologin? Yes/No/Custom (y/N) " sbinyn
case $sbinyn in
y|ye|yes)
usermod -s /sbin/nologin $globaluser
;;
n|no)
printf "\nThe sFTP user created will still be able to ssh into the system\n"
;;
*)
printf "\nPlease can you enter a valid input\n"
printf "\n----------------------------------------------\n"
;;
esac
}
#------------------------------Edit User ---------------------------------
while [[ ! ( "$chrootyn" =~ (y|ye|yes)$ ) ]]; do
printf "Chroot the user $globaluser to a home directory of $globalg1$globaluser\n"
printf "and a shell of /sbin/nologin? "
read -p "Yes, No, Custom Directory (y/N/c): " chrootyn
case $chrootyn in
y|ye|yes)
editchrootyes
printf " ----------------------------------------------\n"
break #comment out once main loop is changed?
;;
n|no )
editchrootno
break
;;
c|custom)
printf ""
printf "What location would you like to chroot the user $globaluser to? \n"
read -p "Please finish the directory location with a / eg. /home/: " ccd
while [[ ! ("$ccyn" =~ (y|ye|yes)$ ) ]]; do
editcustomchroot
done
break
;;
*)
printf "Please enter a valid option\n"
printf " ----------------------------------------------\n"
;;
esac
done
##################################################################################
#########################directory permissions [Functions]#########################
###################################################################################
setdirectorypermissions() {
printf "Users home directory: $globalg1$globaluser \n"
globalg2="$globalg1$globaluser/"
read -p "Would you like to automatically set permissions or manually set permissions? (a/M): " permissionsam
case $permissionsam in
a|auto|automatic )
chmod 711 $globalg1
chmod 755 $globalg2
chown root:root $globalg2
printf "\nThe following permissions have been set:"
printf "\nchmod 711 $globalg1"
printf "\nchmod 755 $globalg2\nchroot root:root $globalg2"
printf "\n----------------------------------------------\n"
;;
m|man|manually )
printf "Please remember to change the permissions after the script has run"
printf "\n----------------------------------------------\n"
break
;;
* )
printf "Please enter a valid input (a/m)"
printf "\n----------------------------------------------\n"
;;
esac
}
#-----------------------directory permissions---------------------------------
# The following section is for setting the permissions on the directories
shopt -s nocasematch; #this command configures the shell option -s (set enable) no-case-match which allows for case insensitivity.
while [[ ! ( $permissionsam =~ (a|auto|automatic)$ ) ]]; do
setdirectorypermissions
done
###################################################################################
########################Setting Mount Binds [functions]############################
###################################################################################
confirmmountsyesno() {
printf "What directory would you like to mount e.g. /var/www/vhost/website1 ? \n"
read -p "Please enter the directory starting and ending with / e.g. /var/www/ " mountdirectory
mdirectory=$mountdirectory
if [ -d "$mdirectory" ] && [ ! "$mdirectory" = "" ]; then
printf "$mdirectory"" Exists!! :)"
printf "\n---------------------------------------------\n"
while [[ ! ( "$myn" =~ (y|ye|yes)$ ) ]]; do
read -p "Are you sure you would like to mount the directory $mdirectory? (y/N): " myn #mount yes no
case $myn in
y|ye|yes )
printf "Thank You"
printf "\n---------------------------------------------"
while [[ ! ( "$wmdyn" =~ (y|ye|yes)$ ) ]]; do #while
mountdirectoryyesno #function
done
;;
n|no )
printf "Please try again!\n\n"
break
;;
*)
printf "\nPlease enter yes or no (y/n) \n"
;;
esac
done
else
printf "$mdirectory Does not exist, please try again!"
printf "\n---------------------------------------------\n"
fi
}
mountdirectoryyesno() {
printf "\nWhat directory would you like to CREATE for this mount?\n"
printf "Please enter this location WITHOUT / before or after \n"
read -p "Examples: $globalg2 website1 or domain1.co.uk: " wmd #wd = what mount directory
while [[ ! ( "$wmdyn" =~ (y|ye|yes)$ ) ]]; do
if [ ! "$wmd" = "" ]; then
read -p "Are you sure you would like to mount to the following location $globalg2$wmd (y/N)? " wmdyn #wdyn = what mount directory yes no
case $wmdyn in
y|ye|yes )
printf "\nThank You!"
printf "\n---------------------------------------------"
printf "\n\nMaking directory "$globalg2$wmd"....\n"
mkdir -p $globalg2$wmd
echo "$mdirectory " "$globalg2$wmd " "none bind 0 0" >> /etc/fstab
printf "Configuring fstab....\n"
mount $globalg2$wmd #this command mounts the location that has been confirmed and then written to /etc/fstab
chown $globaluser:$globalgroup $globalg2$wmd #changing ownsership of the mounted directory to allow the chrooted user to edit the files
printf "Setting permissions on the directory....\n"
printf "Mounting the directory....\n"
printf "Setting correct permissions on the mount....\n"
;;
n|no )
printf "\nPlease try again!\n"
break
;;
*)
printf "\nPlease enter yes or no (y/n) \n"
printf "\n---------------------------------------------\n"
;;
esac
else
printf "Please enter a directory you wish to create for this mount"
printf "\n---------------------------------------------\n"
fi
done
}
#--------------------------Setting Mount Binds---------------------------------
printf "\nSetting bind mounts\n"
printf "\n---------------------------------------------\n"
while [[ !( "$wmdyn" =~ (y|ye|yes)$ ) ]]; do #while the mount directory is not confirmed (yes) keep looping
read -p "Would you like to set bind mount? (y/N) " mountyn
case $mountyn in
y|ye|yes )
while [[ !( "$myn" =~ (y|ye|yes)$ ) ]]; do #while mount directory (eg /var/) is not equal to yes then keep looping the function
confirmmountsyesno #function
done
;;
n|no )
break #breaks the while loop as the following will not be met: !( "$wdyn" =~ (y|ye|yes)$ )
;;
*)
printf "\nPlease enter yes or no \n"
printf "\n---------------------------------------------\n"
;;
esac
done
printf "\n---------------------------------------------\n"
###################################################################################
################################ Summary Sections##################################
###################################################################################
printf "\n\n\n-----------------------------------------------------------------"
printf "\n-------------------------Summary Section-------------------------"
printf "\n-----------------------------------------------------------------"
printf "\nThe following group was used: $globalgroup"
printf "\nThe following user was added to that group: $globaluser "
printf "\nIf you have created a new user please REMEMBER to change the password for the user"
printf "\nChroot Directory: $globalg2"
case $permissionsam in
a|auto|automatic )
printf "\n-----------------------------------------------------------------"
printf "\n\nThe following permissions have been set:"
printf "\nchmod 711 $globalg1"
printf "\nchmod 755 / chroot root:root $globalg2"
;;
*)
printf "\n------------Permissions------------"
printf "\nYou chose to manually set permissions, please remember to do this now."
;;
esac
case $mountyn in
a|auto|automatic )
printf "\n\n------------bind mounts------------"
printf "\nYou configured:\n $mdirectory to mount to the location: $globalg2$wmd\n"
;;
*)
printf "\n----You chose NOT to set up bind mounts----\n"
;;
esac
printf "\n-----------------------------------------------------------------"
printf "\n--Please remember to manually configure /etc/ssh/sshd_config file--\n"
printf "Visit the following domain for an example configuration guide for sFTP"
printf "\nhttp://lukeslinuxlessons.co.uk/sftp-chroot/#sshconfig\n"
printf "\n-----------------------------------------------------------------\n"
###################################################################################