From 11c488215620d12c1f79fc9b05deb9928d2cab39 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Mon, 16 Nov 2020 14:03:21 +0100
Subject: [sysconfig] SSH: Split pubkey and rest of config, add more options

Now we can have exactly one SSH-Config per sysconfig, which avoids
confusion due to config mismatch regarding "allow pw" and "port".
The install include takes care of splitting the key into a new module
for existing modules, but doesn't remove duplicate SshConfig modules
from sysconfigs, as this might lead to additional confusion. Next time
the user edits a sysconfig, they are forced to pick exactly one
SshConfig module.

The "allow password login" option was extended to allow password login
for non-root users only in addition to simply being "yes" or "no".
There's an additional option that can entirely limit the group of users
allowed to log in via SSH.
---
 .../sysconfig/inc/configmodule/sshkey.inc.php      | 55 ++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 modules-available/sysconfig/inc/configmodule/sshkey.inc.php

(limited to 'modules-available/sysconfig/inc/configmodule/sshkey.inc.php')

diff --git a/modules-available/sysconfig/inc/configmodule/sshkey.inc.php b/modules-available/sysconfig/inc/configmodule/sshkey.inc.php
new file mode 100644
index 00000000..2d212d25
--- /dev/null
+++ b/modules-available/sysconfig/inc/configmodule/sshkey.inc.php
@@ -0,0 +1,55 @@
+<?php
+
+ConfigModule::registerModule(
+	ConfigModule_SshKey::MODID, // ID
+	Dictionary::translateFileModule('sysconfig', 'config-module', 'sshkey_title'), // Title
+	Dictionary::translateFileModule('sysconfig', 'config-module', 'sshkey_description'), // Description
+	Dictionary::translateFileModule('sysconfig', 'config-module', 'group_sshkey'), // Group
+	false, // Only one per config?
+	510
+);
+
+class ConfigModule_SshKey extends ConfigModule
+{
+	const MODID = 'SshKey';
+	const VERSION = 1;
+
+	protected function generateInternal($tgz, $parent)
+	{
+		if (!$this->validateConfig())
+			return false;
+		$config = array(
+				'files' => [
+					'/root/.ssh/authorized_keys.d/sshkey_' . $this->id() . '_' . Util::sanitizeFilename($this->title()) . '.pub'
+						=> $this->moduleData['publicKey']],
+				'destination' => $tgz,
+				'failOnParentFail' => false,
+				'parent' => $parent
+			);
+		// Create config module, which will also check if the pubkey is valid
+		return Taskmanager::submit('MakeTarball', $config);
+	}
+
+	protected function moduleVersion()
+	{
+		return self::VERSION;
+	}
+
+	protected function validateConfig()
+	{
+		return isset($this->moduleData['publicKey']);
+	}
+
+	public function setData($key, $value)
+	{
+		switch ($key) {
+		case 'publicKey':
+			break;
+		default:
+			return false;
+		}
+		$this->moduleData[$key] = $value;
+		return true;
+	}
+
+}
-- 
cgit v1.2.3-55-g7522