[SSPS] Modernize; switch default user to openslx + sudo

12 files changed, 71 insertions, 109 deletions

diff --git a/satellit_installer/includes/00-dirs.inc b/satellit_installer/includes/00-dirs.inc
index cd6d383..3ad0f9a 100644
--- a/satellit_installer/includes/00-dirs.inc
+++ b/satellit_installer/includes/00-dirs.inc
@@ -1,15 +1,14 @@
-# Do not rename this file, it is copied later on by the script dropper
-export CONFIGDIR="$BASEDIR/config"
-export DMSDDIR="/opt/dmsd/"
-export DNBD3DIR="/opt/openslx/dnbd3/"
-export TASKMANDIR="/opt/taskmanager/"
-export OPENSLXDIR="/opt/openslx/"
-export OPENSLXSRVDIR="/srv/openslx/"
-export LDADPDIR="/opt/ldadp/"
-export TFTPDIR="$OPENSLXSRVDIR/tftp"
-export WWWDIR="$OPENSLXSRVDIR/www"
-export PATH_SLXADMIN="$WWWDIR/slx-admin"
-export IPXEDIR="$OPENSLXDIR/ipxe"
-export SLXADMINCACHE="/var/cache/slx-admin"
-readonly CONFIGDIR DMSDDIR DNBD3DIR TASKMANDIR OPENSLXDIR OPENSLXSRVDIR LDADPDIR SYNCDAEMONDIR TFTPDIR WWWDIR PATH_SLXADMIN
+CONFIG_FILE="/opt/openslx/config.install"
+DMSDDIR="/opt/dmsd/"
+DNBD3DIR="/opt/openslx/dnbd3/"
+TASKMANDIR="/opt/taskmanager/"
+OPENSLXDIR="/opt/openslx/"
+OPENSLXSRVDIR="/srv/openslx/"
+LDADPDIR="/opt/ldadp/"
+TFTPDIR="$OPENSLXSRVDIR/tftp"
+WWWDIR="$OPENSLXSRVDIR/www"
+SLXADMINDIR="$WWWDIR/slx-admin"
+IPXEDIR="$OPENSLXDIR/ipxe"
+SLXADMINCACHE="/var/cache/slx-admin"
+readonly CONFIG_FILE DMSDDIR DNBD3DIR TASKMANDIR OPENSLXDIR OPENSLXSRVDIR LDADPDIR SYNCDAEMONDIR TFTPDIR WWWDIR SLXADMINDIR
 
diff --git a/satellit_installer/includes/00-variables.inc b/satellit_installer/includes/00-variables.inc
index a826ad7..e22ed94 100644
--- a/satellit_installer/includes/00-variables.inc
+++ b/satellit_installer/includes/00-variables.inc
@@ -9,6 +9,11 @@
 export DEBIAN_FRONTEND="noninteractive"			# Part of keeping apt quiet
 export LANG="en_US.UTF-8"
 
+# Default password for the openslx system user, user is forced to change this on first boot
+DEFAULT_OPENSLX_PASSWORD="aendermichsofort"
+# This will only be used to install the slx-admin db scheme and changed on first boot
+TEMP_DB_PASS="geheim"
+
 ### Needed Packages:
 # Set list of needed packages (scripting needs) - remember, Debian-specific so far.
 PACKAGELIST_SCRIPT="
diff --git a/satellit_installer/includes/10-handle_mysql.inc b/satellit_installer/includes/10-functions_mysql.inc
index 5b99719..5b99719 100644
--- a/satellit_installer/includes/10-handle_mysql.inc
+++ b/satellit_installer/includes/10-functions_mysql.inc
diff --git a/satellit_installer/includes/10-handle_users.inc b/satellit_installer/includes/10-handle_users.inc
index 9063a40..48dd148 100644
--- a/satellit_installer/includes/10-handle_users.inc
+++ b/satellit_installer/includes/10-handle_users.inc
@@ -30,7 +30,7 @@ kill_user() {
 	userdel -r -f $( < /etc/passwd  awk -F: '$3 == 1000 {print $1}' ) || perror "# could not kill userid ${1}!"
 }
 
-check_users() {
+kill_existing_users() {
 	echo "#"
 	echo "# Checking for users to kill with id>=1000: "
 	for userid in $( < /etc/passwd  cut -f 3 -d ":" | sort -n ); do
diff --git a/satellit_installer/includes/10-password_helper.inc b/satellit_installer/includes/10-password_helper.inc
deleted file mode 100644
index 0f52185..0000000
--- a/satellit_installer/includes/10-password_helper.inc
+++ /dev/null
@@ -1,22 +0,0 @@
-generate_password() {
-	local password="$(< /dev/urandom tr -dc A-Za-z0-9_ | head -c${1:-16};)"
-	echo "$password"
-}
-
-# This routine has to be used only in conjunction with the prepare_firstrun-script, which
-# will enforce the setting of good passwords on first root login after server start.
-set_passwords() {
-	echo -n "# Setting passwords..."
-	OPENSLX_PASS="$(generate_password)"
-	MYSQL_OPENSLX_PASS="$(generate_password)"
-	MYSQL_SAT_PASS="$(generate_password)"
-	
-	# Keep in mind the passwords stored here will be valid only temporary,
-	# as they will be changed by the dropper script.
-	# If you need the permanently valid password, you will need to 
-	# decrypt static_files/new_passwords.encrypted.
-	echo "OPENSLX_PASS=$OPENSLX_PASS"			>  "$CONFIGDIR"/config
-	echo "MYSQL_OPENSLX_PASS=$MYSQL_OPENSLX_PASS"		>> "$CONFIGDIR"/config
-	echo "MYSQL_SAT_PASS=$MYSQL_SAT_PASS"			>> "$CONFIGDIR"/config
-	echo "ok."
-}
diff --git a/satellit_installer/includes/10-script_dropper.inc b/satellit_installer/includes/10-script_dropper.inc
index 62d1b58..a991f28 100644
--- a/satellit_installer/includes/10-script_dropper.inc
+++ b/satellit_installer/includes/10-script_dropper.inc
@@ -1,24 +1,21 @@
-patch_profile() {
-	local script="/root/installer/firstrun_script.sh"
+fb_enable_firstrun() {
+	local script="/opt/openslx/firstrun.sh"
 	[ -x "$script" ] || perror "Firstrun script not found ($script)"
-	if grep -qF "$script" /root/.profile; then
-		echo "# first_run script already in root's .profile, doing nothing."
-	else
-		echo "# Patching root's .profile"
-		echo "$script" >> /root/.profile
+	if ! grep -qF "$script" "/home/openslx/.profile"; then
+		echo "# Patching openslx's .profile"
+		echo "[ -t 0 ] && $script" >> "/home/openslx/.profile"
+		chown openslx:openslx "/home/openslx/.profile"
 	fi
 }
 
-drop_script() {
-	mkdir -p "/root/installer"
-	# So we know all the paths and the mysql password
-	cat "${BASEDIR}/includes/00-dirs.inc" "${CONFIGDIR}/config" > "/root/installer/config"
-	chmod 0600 /root/installer/config
+fb_write_config() {
+	# So we know all the paths
+	declare -p DMSDDIR TASKMANDIR SLXADMINDIR VERSION >> "$CONFIG_FILE"
 }
 
-drop_firstrun_script () {
-	patch_profile
-	drop_script
+enable_firstrun_script () {
+	fb_enable_firstrun
+	fb_write_config
 	systemctl daemon-reload
 	systemctl enable firstboot.service || perror "Could not enable firstboot service"
 }
diff --git a/satellit_installer/includes/20-prerequisites.inc b/satellit_installer/includes/20-prerequisites.inc
index e0dc9e0..90189d8 100644
--- a/satellit_installer/includes/20-prerequisites.inc
+++ b/satellit_installer/includes/20-prerequisites.inc
@@ -1,29 +1,25 @@
 prerequisites() {
-	mkdir -p -m 700 "$BASEDIR"/config	# No point in testing.
-	mkdir -p -m 700 "$BASEDIR"/temp
+	mkdir -p -m 700 "$BASEDIR/temp"
+	mkdir -p "/opt/openslx"
 
-	# Old debugging config file there?
-	[ -f "$CONFIGDIR/config" ] && cp -p "$CONFIGDIR/config" "$CONFIGDIR/config.prerun" 2>/dev/null
+	# Enable en_US locale
+	# Already there? Do nothing
+	grep -q '^\s*en_US.UTF-8' /etc/locale.gen && return 0
+	# Try to enable
+	sed 's/^#\s*en_US.UTF-8/en_US.UTF-8/g' /etc/locale.gen
 
-	# Let's look whether an english locale is alread active (we choose en_US.UTF-8)
-	if [[ $(grep "en_US.UTF-8" /etc/locale.gen|cut -f 1 -d " ") == "#" ]]; then
-		echo -n "# Generating an english UTF-8 based locale (this may take some time)..."
-		# Backing up never hurts:
-		cp -p /etc/locale.gen /etc/locale.gen.orig
-		# Now patch the localization file:
-		sed -i 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/g' /etc/locale.gen
-		dpkg-reconfigure locales 2>/dev/null 1>&2
-		if [ "$ERR" -ne 0 ]; then
-			echo
-			echo "# WARNING: Could not reconfigure locales. This is annoying, as"
-			echo "#          it will yield some mixed languages, perhaps."
-			echo "#          Please make sure thy system has an UTF-8 based"
-			echo "#          character set."
-		else
-			echo " ok."
-		fi
+	if ! grep -q '^\s*en_US.UTF-8' /etc/locale.gen; then
+		# Still not there, add
+		echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen
+	fi
 
-	else
-		echo "# English locale detected; all is well."
+	# Regenerate
+	dpkg-reconfigure locales
+	if [ "$?" -ne 0 ]; then
+		echo "#"
+		echo "# WARNING: Could not reconfigure locales. This is annoying, as"
+		echo "#          it will yield some mixed languages, perhaps."
+		echo "#          Please make sure thy system has an UTF-8 based"
+		echo "#          character set."
 	fi
 }
diff --git a/satellit_installer/includes/50-add_mysql_dbs_users.inc b/satellit_installer/includes/50-add_mysql_dbs_users.inc
index 755e1b3..fccba99 100644
--- a/satellit_installer/includes/50-add_mysql_dbs_users.inc
+++ b/satellit_installer/includes/50-add_mysql_dbs_users.inc
@@ -4,8 +4,8 @@ add_mysql_dbs_users() {
 	mysql_add_db sat
 
 	# $1=user, $2=database, $3=privileges, $4=password
-	mysql_add_user sat sat "DELETE, INSERT, SELECT, UPDATE, ALTER, CREATE, DROP" "$MYSQL_SAT_PASS"
-	mysql_add_user openslx openslx ALL "$MYSQL_OPENSLX_PASS"
+	mysql_add_user sat sat "DELETE, INSERT, SELECT, UPDATE, ALTER, CREATE, DROP" "$RANDOM"
+	mysql_add_user openslx openslx "ALL" "$TEMP_DB_PASS"
 	# $1=user, $2=database, $3=privileges
 	mysql_add_privs "openslx" "sat.*" "ALL"
 	mysql_add_privs "sat" "openslx.location" "SELECT, CREATE"
diff --git a/satellit_installer/includes/50-add_users_groups.inc b/satellit_installer/includes/50-add_users_groups.inc
index 840362a..e6f92f1 100644
--- a/satellit_installer/includes/50-add_users_groups.inc
+++ b/satellit_installer/includes/50-add_users_groups.inc
@@ -15,4 +15,9 @@ add_users_groups() {
 	add_user_nohome dnbd3 10002 10002
 	adduser www-data adm # So the webif can read /var/log stuff
 	adduser dnbd3 images # Put dnbd3 user into images group so it can write the NFS share
+	adduser openslx sudo # openslx is the main user, as we disallow ssh login as root
+
+	echo "# disable root login, set default password for openslx"
+	usermod -p "*" root
+	echo "openslx:$DEFAULT_OPENSLX_PASSWORD" | chpasswd
 }
diff --git a/satellit_installer/includes/70-write_versionstring.inc b/satellit_installer/includes/70-write_versionstring.inc
index 397df2f..eb359c4 100644
--- a/satellit_installer/includes/70-write_versionstring.inc
+++ b/satellit_installer/includes/70-write_versionstring.inc
@@ -3,5 +3,5 @@ write_versionstring() {
 	# is just the date of script run time
 	VERS=$(date +%Y%j%H)
 
-	echo "$VERS" > "${PATH_SLXADMIN}/version"
+	echo "$VERS" > "${SLXADMINDIR}/version"
 }
diff --git a/satellit_installer/includes/90-patch_misc_files.inc b/satellit_installer/includes/90-patch_misc_files.inc
index 45c220f..90b00da 100644
--- a/satellit_installer/includes/90-patch_misc_files.inc
+++ b/satellit_installer/includes/90-patch_misc_files.inc
@@ -3,29 +3,17 @@ patch_bashrc() {
 	echo "# As one of the last things here we will set a new prompt to distinguish"
 	echo "# the bwLehrpool satellite server from other servers. To accomplish this"
 	echo "# we will set a very classy prompt. This will take effect at next root login."
-	local ifname=$( ifconfig | grep -oEm1 '^e\w+' )
-	echo "# Setting prompt..."
-	if grep -q '^IP=' /root/.bashrc; then
-		echo "...already done."
-	else
-		sed "s/%ifname%/$ifname/g" >> /root/.bashrc <<-"ENDO"
-			IP=$( ip -4 a show "%ifname%" 2>/dev/null | grep '^\s*inet\s' | awk -F ' ' '{print $2}' )
-			[ -z "$IP" ] && IP=$(ip -4 a | grep '^\s*inet\s'| grep -v '127.0.0' | head -n 1 | awk -F ' ' '{print $2}')
-			IP=${IP%/*}
-			[ -z "$IP" ] && IP="noip???"
-			PS1="\[\033[01;31m\]\u\[\033[00m\]@\[\033[01;32m\]\h \[\033[00m\]($IP)
-			\[\033[01;34m\]\w\[\033[00m\] # "
-		ENDO
-	fi
 
-	# aliases, dircolors
-	sed -i -r 's/# *(alias|export LS|eval ")/\1/' /root/.bashrc
-}
-
-patch_vim() {
-	sed -i -r 's/" *(syntax|set showmatch|set smartcase|set incsearch)/\1/' /etc/vim/vimrc
-	echo "set autoindent" >> /etc/vim/vimrc
-	echo "set smartindent" >> /etc/vim/vimrc
+	for f in /root/ /home/*/; do
+		[ -d "$f" ] || continue # Not dir
+		f="$f/.bashrc"
+		[ -f "$f" ] || cp /etc/skel/.bashrc "$f" # Make sure default exists
+		grep -qF '/opt/openslx/bashrc.inc' "$f" && continue # Already patched
+		# This include will set our two-line prompt including the IP address
+		echo ". /opt/openslx/bashrc.inc" >> "$f"
+		# enable aliases, dircolors
+		sed -i -r 's/^(\s*)#\s*(alias|export LS|export GCC|eval )/\1\2/' "$f"
+	done
 }
 
 patch_ldapsearch() {
@@ -37,11 +25,5 @@ patch_ldapsearch() {
 patch_java() {
 	# Fix svg renderer:
 	# java.awt.AWTError: Assistive Technology not found: org.GNOME.Accessibility.AtkWrapper
-	sed -i -e '/^assistive_technologies=/s/^/#/' /etc/java-*-openjdk/accessibility.properties &> /dev/null
-}
-
-set_version_string() {
-	echo -n "# Setting version string..."
-	echo 'VERSION="'$VERSION'"'	>> "$CONFIGDIR"/config
-	echo "ok."
+	sed -i -e '/^assistive_technologies=/s/^/#/' /etc/java-*/accessibility.properties &> /dev/null
 }
diff --git a/satellit_installer/includes/90-patch_slxadmin.inc b/satellit_installer/includes/90-setup_slxadmin.inc
index 69afbcb..0220bdc 100644
--- a/satellit_installer/includes/90-patch_slxadmin.inc
+++ b/satellit_installer/includes/90-setup_slxadmin.inc
@@ -1,5 +1,5 @@
 # Prepare files and symlinks in slx-admin www dir
-patch_slxadmin_dir () {
+enable_slxadmin_modules () {
 	# Create modules directory and link modules from modules-available according to slxadmin module list (SLXADMIN_MODULES):
 	mkdir -p "$WWWDIR/slx-admin/modules"
 	cd "$WWWDIR/slx-admin/modules" || perror "Cannot cd to slxadmin/modules"
@@ -14,7 +14,7 @@ patch_slxadmin_dir () {
 install_slxadmin_db () {
 	# Prepare temporary config
 	install_files "slxadmin"
-	sed -i "s/%MYSQL_OPENSLX_PASS%/${MYSQL_OPENSLX_PASS}/" "$WWWDIR/slx-admin/config.php" || perror "Could not write temporary DB password to config.php"
+	sed -i "s/%MYSQL_OPENSLX_PASS%/${TEMP_DB_PASS}/" "$WWWDIR/slx-admin/config.php" || perror "Could not write temporary DB password to config.php"
 	# Install slx-admin DB
 	cd "$WWWDIR/slx-admin" || perror "Cannot cd to $WWWDIR"
 	echo "# Installing slx-admin database"