diff options
Diffstat (limited to 'zarb-ml/mageia-sysadm/attachments/20101102/51ca00d6/attachment-0001.html')
| -rw-r--r-- | zarb-ml/mageia-sysadm/attachments/20101102/51ca00d6/attachment-0001.html | 284 |
1 files changed, 284 insertions, 0 deletions
diff --git a/zarb-ml/mageia-sysadm/attachments/20101102/51ca00d6/attachment-0001.html b/zarb-ml/mageia-sysadm/attachments/20101102/51ca00d6/attachment-0001.html new file mode 100644 index 000000000..26d37d0f1 --- /dev/null +++ b/zarb-ml/mageia-sysadm/attachments/20101102/51ca00d6/attachment-0001.html @@ -0,0 +1,284 @@ +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" +"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> +<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /> +<title>[78] add module to install shell to restrict access to only svn, git, and later package submit</title> +</head> +<body> + +<style type="text/css"><!-- +#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; } +#msg dl.meta dt { float: left; width: 6em; font-weight: bold; } +#msg dt:after { content:':';} +#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; } +#msg dl a { font-weight: bold} +#msg dl a:link { color:#fc3; } +#msg dl a:active { color:#ff0; } +#msg dl a:visited { color:#cc6; } +h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; } +#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; } +#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; } +#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; } +#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; } +#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; } +#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; } +#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; } +#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; } +#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; } +#logmsg pre { background: #eee; padding: 1em; } +#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;} +#logmsg dl { margin: 0; } +#logmsg dt { font-weight: bold; } +#logmsg dd { margin: 0; padding: 0 0 0.5em 0; } +#logmsg dd:before { content:'\00bb';} +#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; } +#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; } +#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; } +#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; } +#logmsg table th.Corner { text-align: left; } +#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; } +#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; } +#patch { width: 100%; } +--></style> +<div id="msg"> +<dl class="meta"> +<dt>Revision</dt> <dd>78</dd> +<dt>Author</dt> <dd>boklm</dd> +<dt>Date</dt> <dd>2010-11-02 18:55:53 +0100 (Tue, 02 Nov 2010)</dd> +</dl> + +<h3>Log Message</h3> +<pre>add module to install shell to restrict access to only svn, git, and later package submit</pre> + +<h3>Added Paths</h3> +<ul> +<li>puppet/modules/restrictshell/</li> +<li>puppet/modules/restrictshell/manifests/</li> +<li><a href="#puppetmodulesrestrictshellmanifestsinitpp">puppet/modules/restrictshell/manifests/init.pp</a></li> +<li>puppet/modules/restrictshell/templates/</li> +<li><a href="#puppetmodulesrestrictshelltemplatesmembershconfpl">puppet/modules/restrictshell/templates/membersh-conf.pl</a></li> +<li><a href="#puppetmodulesrestrictshelltemplatessv_membershpl">puppet/modules/restrictshell/templates/sv_membersh.pl</a></li> +</ul> + +</div> +<div id="patch"><pre> +<a id="puppetmodulesrestrictshellmanifestsinitpp">Added: puppet/modules/restrictshell/manifests/init.pp</a> +=================================================================== +--- puppet/modules/restrictshell/manifests/init.pp (rev 0) ++++ puppet/modules/restrictshell/manifests/init.pp 2010-11-02 17:55:53 UTC (rev 78) +@@ -0,0 +1,29 @@ ++#TODO: add support for pkgsubmit ++class restrictshell { ++ $allow_svn = "0" ++ $allow_git = "0" ++ $allow_rsync = "0" ++ $allow_pkgsubmit = "0" ++ ++ class allow_svn_git_pkgsubmit { ++ $allow_svn = "1" ++ $allow_git = "1" ++ $allow_pkgsubmit = "1" ++ } ++ ++ file { '/usr/local/bin/sv_membersh.pl': ++ ensure => present, ++ owner => root, ++ group => root, ++ mode => 755, ++ content => template("restrictshell/sv_membersh.pl"), ++ } ++ ++ file { '/etc/membersh-conf.pl': ++ ensure => present, ++ owner => root, ++ group => root, ++ mode => 755, ++ content => template("restrictshell/membersh-conf.pl"), ++ } ++} + +<a id="puppetmodulesrestrictshelltemplatesmembershconfpl">Added: puppet/modules/restrictshell/templates/membersh-conf.pl</a> +=================================================================== +--- puppet/modules/restrictshell/templates/membersh-conf.pl (rev 0) ++++ puppet/modules/restrictshell/templates/membersh-conf.pl 2010-11-02 17:55:53 UTC (rev 78) +@@ -0,0 +1,13 @@ ++$use_svn = "<%= allow_svn %>"; ++$bin_svn = "/usr/bin/svnserve"; ++$regexp_svn = "^svnserve -t\$"; ++#@prepend_args_svn = ( '-r', '/svn' ); ++@prepend_args_svn = (); ++ ++$use_git = "<%= allow_git %>"; ++$bin_git = "/usr/bin/git-shell"; ++ ++$use_rsync = "<%= allow_rsync %>"; ++$bin_rsync = "/usr/bin/rsync"; ++$regexp_rsync = "^rsync --server"; ++$regexp_dir_rsync = "^/.*"; + + +Property changes on: puppet/modules/restrictshell/templates/membersh-conf.pl +___________________________________________________________________ +<a id="svnexecutable">Added: svn:executable</a> + + * + +<a id="puppetmodulesrestrictshelltemplatessv_membershpl">Added: puppet/modules/restrictshell/templates/sv_membersh.pl</a> +=================================================================== +--- puppet/modules/restrictshell/templates/sv_membersh.pl (rev 0) ++++ puppet/modules/restrictshell/templates/sv_membersh.pl 2010-11-02 17:55:53 UTC (rev 78) +@@ -0,0 +1,150 @@ ++#!/usr/bin/perl ++# This file is part of the Savane project ++# <http://gna.org/projects/savane/> ++# ++# $Id$ ++# ++# Copyright 2004-2005 (c) Loic Dachary <loic--gnu.org> ++# Mathieu Roy <yeupou--gnu.org> ++# Timothee Besset <ttimo--ttimo.net> ++# ++# The Savane project is free software; you can redistribute it and/or ++# modify it under the terms of the GNU General Public License ++# as published by the Free Software Foundation; either version 2 ++# of the License, or (at your option) any later version. ++# ++# The Savane project is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with the Savane project; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++# ++# ++ ++# Login shell for people who should only have limited access. ++# You probably should add/modify the following option of your sshd_config ++# like below (see sshd_config manual for more details): ++# PermitEmptyPasswords no ++# PasswordAuthentication no ++# AllowTcpForwarding no ++ ++use strict; ++ ++$ENV{PATH}="/bin:/usr/bin"; ++$ENV{CVSEDITOR}="/bin/false"; ++ ++# Import conf options ++our $use_cvs = "0"; ++our $bin_cvs = "/usr/bin/cvs"; ++ ++our $use_scp = "0"; ++our $bin_scp = "/usr/bin/scp"; ++our $regexp_scp = "^(scp .*-t /upload)|(scp .*-t /var/ftp)"; ++ ++our $use_sftp = "0"; ++our $bin_sftp = "/usr/lib/sftp-server"; ++our $regexp_sftp = "^(/usr/lib/ssh/sftp-server|/usr/lib/sftp-server|/usr/libexec/sftp-server|/usr/lib/openssh/sftp-server)"; ++ ++our $use_rsync = "0"; ++our $bin_rsync = "/usr/bin/rsync"; ++our $regexp_rsync = "^rsync --server"; ++our $regexp_dir_rsync = "^(/upload)|(/var/ftp)"; ++ ++our $use_svn = "0"; ++our $bin_svn = "/usr/bin/svnserve"; ++our $regexp_svn = "^svnserve -t"; ++our @prepend_args_svn = ( '-r', '/svn' ); ++ ++our $use_git = "0"; ++our $bin_git = "/usr/bin/git-shell"; ++ ++# Open configuration file ++if (-e "/etc/membersh-conf.pl") { ++ do "/etc/membersh-conf.pl" or die "System misconfiguration, contact administrators. Exiting"; ++} else { ++ die "System misconfiguration, contact administrators. Exiting"; ++} ++ ++# A configuration file /etc/membersh-conf.pl must exists and be executable. ++# Here come an example: ++# ++# $use_cvs = "1"; ++# $bin_cvs = "/usr/bin/cvs"; ++# ++# $use_scp = "1"; ++# $bin_scp = "/usr/bin/scp"; ++# $regexp_scp = "^scp .*-t (/upload)|(/var/ftp)"; ++ ++# $use_sftp = "1"; ++# $bin_sftp = "/usr/lib/sftp-server"; ++# $regexp_sftp = "^(/usr/lib/ssh/sftp-server|/usr/lib/sftp-server|/usr/libexec/sftp-server)"; ++# ++# $use_rsync = "1"; ++# $bin_rsync = "/usr/bin/rsync"; ++# $regexp_rsync = "^rsync --server"; ++# $regexp_dir_rsync = "^(/upload)|(/var/ftp)"; ++ ++ ++if ($#ARGV == 1 and $ARGV[0] eq "-c") { ++ if ($use_cvs and $ARGV[1] eq 'cvs server') { ++ ++ # Run a cvs server command ++ exec($bin_cvs, 'server') or die("Failed to exec $bin_cvs: $!"); ++ ++ } elsif ($use_scp and ++ $ARGV[1] =~ m:$regexp_scp:) { ++ ++ # Authorize scp command ++ my (@args) = split(' ', $ARGV[1]); ++ shift(@args); ++ exec($bin_scp, @args); ++ ++ } elsif ($use_sftp and ++ $ARGV[1] =~ m:$regexp_sftp:) { ++ ++ # Authorize sftp login ++ exec($bin_sftp) or die("Failed to exec $bin_sftp: $!"); ++ ++ } elsif ($use_rsync and ++ $ARGV[1] =~ m:$regexp_rsync:) { ++ ++ my ($rsync, @rest) = split(' ', $ARGV[1]); ++ my ($dir) = $rest[$#rest]; ++ ++ # Authorize rsync command, if the directory is acceptable ++ if ($dir =~ m:$regexp_dir_rsync:) { ++ exec($bin_rsync, @rest) or die("Failed to exec $bin_rsync: $!"); ++ } ++ ++ } elsif ($use_svn and ++ $ARGV[1] =~ m:$regexp_svn:) { ++ ++ # authorize svnserve in tunnel mode, with the svn root prepended ++ my (@args) = @prepend_args_svn; ++ my (@args_user) = split(' ', $ARGV[1]); ++ shift( @args_user ); ++ push( @args, @args_user ); ++ exec($bin_svn, @args) or die("Failed to exec $bin_svn: $!"); ++ ++ } elsif ($use_git and $ARGV[1] =~ m:git-.+:) { ++ ++ # Delegate filtering to git-shell ++ exec($bin_git, @ARGV) or die("Failed to exec $bin_git: $!"); ++ ++ } ++} ++ ++unless (-e "/etc/membersh-errormsg") { ++ print STDERR "You tried to execute: @ARGV[1..$#ARGV]\n"; ++ print STDERR "Sorry, you are not allowed to execute that command.\n"; ++} else { ++ open(ERRORMSG, "< /etc/membersh-errormsg"); ++ while (<ERRORMSG>) { ++ print STDERR $_; ++ } ++ close(ERRORMSG); ++} ++exit(1); + +</pre></div> + +</body> +</html>
\ No newline at end of file |