diff --git a/conf/ssh_regenconf_hook b/conf/ssh_regenconf_hook index b1978e8..5666bd5 100644 --- a/conf/ssh_regenconf_hook +++ b/conf/ssh_regenconf_hook @@ -1,50 +1,21 @@ #!/bin/bash -force=${2:-0} # 0/1 --force argument -dryrun=${3:-0} # 0/1 --dry-run argument -pending_conf=$4 # Path of the pending conf file +action=$1 +pending_dir=$4 +ssh_conf=$pending_dir/../ssh/etc/ssh/sshd_config -# https://github.com/YunoHost/yunohost/blob/c7eaeca6486e6240c832b8863791f8b03520a0f0/data/hooks/conf_regen/43-dnsmasq +[[ $action == "pre" ]] || exit 0 +[[ -e $ssh_conf ]] || exit 0 -do_pre_regen() { - if [ $dryrun -eq 0 ] - then - # Remove added lines into the sshd config - sed -i "/##-> __APP__/,/##<- __APP__/d" /etc/ssh/sshd_config - fi -} +echo " -do_post_regen() { - # Harden SSH connection for the user - if ! grep --quiet "^##-> __APP__$" /etc/ssh/sshd_config - then - echo "##-> __APP__ - # Hardening user connection - Match User __USER__ +##-> __APP__ +# Hardening user connection +Match User __USER__ ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no PermitTunnel no X11Forwarding no PasswordAuthentication yes -##<- __APP__" | tee -a "/etc/ssh/sshd_config" >/dev/null - - # Reload sshd - systemctl reload ssh - fi -} - -case "$1" in - pre) - do_pre_regen - ;; - post) - do_post_regen - ;; - *) - echo "Hook called with unknown argument \`$1'" >&2 - exit 1 - ;; -esac - -exit 0 +##<- __APP__" >> $ssh_conf