diff options
| -rw-r--r-- | config/sshdcond/sshdcond.inc | 131 | ||||
| -rw-r--r-- | config/sshdcond/sshdcond.xml | 80 | ||||
| -rwxr-xr-x | config/sshdcond/sshdcond_sync.xml | 68 | ||||
| -rw-r--r-- | pkg_config.10.xml | 2 |
4 files changed, 138 insertions, 143 deletions
diff --git a/config/sshdcond/sshdcond.inc b/config/sshdcond/sshdcond.inc index 7ff911c1..756f1556 100644 --- a/config/sshdcond/sshdcond.inc +++ b/config/sshdcond/sshdcond.inc @@ -1,14 +1,10 @@ <?php - /* sshdcond.inc - part of pfSense (http://www.pfSense.com) + part of pfSense (https://www.pfsense.org/) Copyright (C) 2012 Marcello Coutinho Copyright (C) 2012 Han Van (namezero@afim.info) - All rights reserved. - - Based on m0n0wall (http://m0n0.ch/wall) - Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>. + Copyright (C) 2015 ESF, LLC All rights reserved. Redistribution and use in source and binary forms, with or without @@ -45,57 +41,59 @@ function sshdcond_custom_php_install_command() { conf_mount_rw(); - // We need to generate an outfile for our extra commands - // The patched g_szSSHDFileGenerate php file then reads and appends that config + /* We need to generate an outfile for our extra commands. + The patched g_szSSHDFileGenerate php file then reads and appends that config. + */ $fd = fopen("/etc/ssh/sshd_extra", 'w'); fclose($fd); conf_mount_ro(); - } +} function sshdcond_custom_php_deinstall_command() { global $g, $config; conf_mount_rw(); - // 1. Delete our config file + /* Delete our config file. */ unlink_if_exists("/etc/ssh/sshd_extra"); - // 2. Re-run sshd config generation script + /* Re-run sshd config generation script. */ restart_sshd(); conf_mount_ro(); - } +} function sshdcond_custom_php_write_config() { - global $g, $config; + global $g, $config, $pkg_interface; - # detect boot process - if (is_array($_POST)) { - if (!preg_match("/\w+/",$_POST['__csrf_magic'])) - return; - } + /* Detect boot process, do nothing during boot. */ + if (platform_booting()) { + return; + } + + conf_mount_rw(); - $sshd_extra=""; + $sshd_extra = ""; if (is_array($config['installedpackages']['sshdcond']['config'])) { - // Mount Read-only - conf_mount_rw(); - // Read config + /* Read config. */ foreach ($config['installedpackages']['sshdcond']['config'] as $sshdcond) { if ($sshdcond['enable'] && is_array($sshdcond['row'])) { $sshd_extra.= "Match {$sshdcond['matchtype']} {$sshdcond['matchvalue']}\n"; foreach ($sshdcond['row'] as $sshd) { - //check if there is spaces on sshd value - if(preg_match ("/\s+/",$sshd['sshdvalue'])) - $sshd['sshdvalue']='"'.$sshd['sshdvalue'].'"'; + /* Check sshd value for spaces. */ + if (preg_match ("/\s+/",$sshd['sshdvalue'])) { + $sshd['sshdvalue'] = '"' . $sshd['sshdvalue'] . '"'; + } - //check if value is not empty - if($sshd['sshdvalue']!="") - $sshd_extra.="\t {$sshd['sshdoption']} {$sshd['sshdvalue']}\n"; + /* Check that sshdvalue is not empty. */ + if ($sshd['sshdvalue'] != "") { + $sshd_extra .= "\t {$sshd['sshdoption']} {$sshd['sshdvalue']}\n"; + } - //apply file permission if option is ChrootDirectory - if ($sshd['sshdoption']=="ChrootDirectory" && file_exists($sshd['sshdvalue'])) { + /* Apply file permission if option is ChrootDirectory. */ + if ($sshd['sshdoption'] == "ChrootDirectory" && file_exists($sshd['sshdvalue'])) { chown($sshd['sshdvalue'], 'root'); chgrp($sshd['sshdvalue'], 'operator'); } @@ -104,92 +102,95 @@ function sshdcond_custom_php_write_config() { } } - //Save /etc/ssh/sshd_extra - file_put_contents("/etc/ssh/sshd_extra",$sshd_extra,LOCK_EX); - - + /* Save /etc/ssh/sshd_extra. */ + file_put_contents("/etc/ssh/sshd_extra", $sshd_extra, LOCK_EX); - // Restart sshd + /* Restart sshd and re-mount read-only. */ restart_sshd(); - - // Mount Read-only conf_mount_ro(); - //sync config with other pfsense servers + /* Sync config with other pfSense servers. */ sshdcond_sync_on_changes(); - } +} -/* Uses XMLRPC to synchronize the changes to a remote node */ +/* Uses XMLRPC to synchronize the changes to a remote node. */ function sshdcond_sync_on_changes() { global $config, $g; - if (is_array($config['installedpackages']['sshdcondsync'])) - if (!$config['installedpackages']['sshdcondsync']['config'][0]['synconchanges']) + if (is_array($config['installedpackages']['sshdcondsync'])) { + if (!$config['installedpackages']['sshdcondsync']['config'][0]['synconchanges']) { return; + } + } log_error("[sshdcond] xmlrpc sync is starting."); - foreach ($config['installedpackages']['sshdcondsync']['config'] as $rs ) { + foreach ($config['installedpackages']['sshdcondsync']['config'] as $rs) { foreach($rs['row'] as $sh) { $sync_to_ip = $sh['ipaddress']; $password = $sh['password']; - if($password && $sync_to_ip) + if ($password && $sync_to_ip) { sshdcond_do_xmlrpc_sync($sync_to_ip, $password); } + } } log_error("[sshdcond] xmlrpc sync is ending."); } -/* Do the actual XMLRPC sync */ +/* Do the actual XMLRPC sync. */ function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { global $config, $g; - if(!$password) + if (!$password) { return; + } - if(!$sync_to_ip) + if (!$sync_to_ip) { return; + } $username='admin'; $xmlrpc_sync_neighbor = $sync_to_ip; - if($config['system']['webgui']['protocol'] != "") { + if ($config['system']['webgui']['protocol'] != "") { $synchronizetoip = $config['system']['webgui']['protocol']; $synchronizetoip .= "://"; } $port = $config['system']['webgui']['port']; - /* if port is empty lets rely on the protocol selection */ - if($port == "") { - if($config['system']['webgui']['protocol'] == "http") + /* If port is empty, let's rely on the protocol selection. */ + if ($port == "") { + if ($config['system']['webgui']['protocol'] == "http") { $port = "80"; - else + } else { $port = "443"; + } } $synchronizetoip .= $sync_to_ip; - /* xml will hold the sections to sync */ + /* xml will hold the sections to sync. */ $xml = array(); $xml['sshdcond'] = $config['installedpackages']['sshdcond']; - /* assemble xmlrpc payload */ + /* Assemble XMLRPC payload. */ $params = array( XML_RPC_encode($password), XML_RPC_encode($xml) ); - /* set a few variables needed for sync code borrowed from filter.inc */ + /* Set a few variables needed for sync code; borrowed from filter.inc. */ $url = $synchronizetoip; log_error("Beginning sshdcond XMLRPC sync to {$url}:{$port}."); $method = 'pfsense.merge_installedpackages_section_xmlrpc'; $msg = new XML_RPC_Message($method, $params); $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); $cli->setCredentials($username, $password); - if($g['debug']) + if ($g['debug']) { $cli->setDebug(1); - /* send our XMLRPC message and timeout after 250 seconds */ + } + /* Send our XMLRPC message and timeout after 250 seconds. */ $resp = $cli->send($msg, "250"); - if(!$resp) { + if (!$resp) { $error = "A communications error occurred while attempting sshdcond XMLRPC sync with {$url}:{$port}."; log_error($error); file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); - } elseif($resp->faultCode()) { + } elseif ($resp->faultCode()) { $cli->setDebug(1); $resp = $cli->send($msg, "250"); $error = "An error code was received while attempting sshdcond XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); @@ -199,11 +200,11 @@ function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { log_error("sshdcond XMLRPC sync successfully completed with {$url}:{$port}."); } - /* tell sshdcond to reload our settings on the destionation sync host. */ + /* Tell sshdcond to reload our settings on the destination sync host. */ $method = 'pfsense.exec_php'; - $execcmd = "require_once('/usr/local/pkg/sshdcond.inc');\n"; + $execcmd = "require_once('/usr/local/pkg/sshdcond.inc');\n"; $execcmd .= "sshdcond_custom_php_write_config();"; - /* assemble xmlrpc payload */ + /* Assemble XMLRPC payload. */ $params = array( XML_RPC_encode($password), XML_RPC_encode($execcmd) @@ -214,11 +215,11 @@ function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); $cli->setCredentials($username, $password); $resp = $cli->send($msg, "250"); - if(!$resp) { + if (!$resp) { $error = "A communications error occurred while attempting sshdcond XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; log_error($error); file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); - } elseif($resp->faultCode()) { + } elseif ($resp->faultCode()) { $cli->setDebug(1); $resp = $cli->send($msg, "250"); $error = "An error code was received while attempting sshdcond XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); @@ -228,4 +229,4 @@ function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { log_error("sshdcond XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); } } - ?> +?> diff --git a/config/sshdcond/sshdcond.xml b/config/sshdcond/sshdcond.xml index 17dda28d..11104e1d 100644 --- a/config/sshdcond/sshdcond.xml +++ b/config/sshdcond/sshdcond.xml @@ -1,49 +1,49 @@ <?xml version="1.0" encoding="utf-8" ?> +<!DOCTYPE packagegui SYSTEM "../schema/packages.dtd"> +<?xml-stylesheet type="text/xsl" href="../xsl/package.xsl"?> <packagegui> -<copyright> - <![CDATA[ + <copyright> + <![CDATA[ /* $Id$ */ -/* ========================================================================== */ +/* ====================================================================================== */ /* - sshdcond.xml - part of pfSense (http://www.pfSense.com) - Copyright (C) 2012 Marcello Coutinho - Copyright (C) 2012 Han Van (namezero@afim.info) - All rights reserved. - - Based on m0n0wall (http://m0n0.ch/wall) - Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>. - All rights reserved. - */ -/* ========================================================================== */ + sshdcond.xml + part of pfSense (https://www.pfSense.org/) + Copyright (C) 2012 Marcello Coutinho + Copyright (C) 2012 Han Van (namezero@afim.info) + Copyright (C) 2015 ESF, LLC + All rights reserved. +*/ +/* ====================================================================================== */ /* - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - */ -/* ========================================================================== */ - ]]> - </copyright> + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ +/* ====================================================================================== */ + ]]> + </copyright> <name>sshdcond</name> - <version>1.0</version> + <version>1.0.2</version> <title>SSH Conditional</title> <description>SSH Conditional blocks</description> <savetext>Save</savetext> @@ -56,15 +56,12 @@ <url>/pkg.php?xml=sshdcond.xml</url> </menu> <configpath>installedpackages->package->sshdcond</configpath> - <additional_files_needed> <prefix>/usr/local/pkg/</prefix> - <chmod>755</chmod> <item>https://packages.pfsense.org/packages/config/sshdcond/sshdcond.inc</item> </additional_files_needed> <additional_files_needed> <prefix>/usr/local/pkg/</prefix> - <chmod>755</chmod> <item>https://packages.pfsense.org/packages/config/sshdcond/sshdcond_sync.xml</item> </additional_files_needed> <tabs> @@ -107,7 +104,7 @@ <field> <fielddescr>Match Type</fielddescr> <fieldname>matchtype</fieldname> - <description>See Match keyword at http://www.manpagez.com/man/5/sshd_config/ for options</description> + <description><![CDATA[See <a href="http://www.manpagez.com/man/5/sshd_config/">ssh_config(5)</a> manpage for valid options.]]></description> <type>select</type> <options> <option><name>User</name><value>User</value></option> @@ -193,5 +190,4 @@ <custom_php_command_before_form> unset($_POST['temp']); </custom_php_command_before_form> - -</packagegui>
\ No newline at end of file +</packagegui> diff --git a/config/sshdcond/sshdcond_sync.xml b/config/sshdcond/sshdcond_sync.xml index 2bd4a26b..511df25b 100755 --- a/config/sshdcond/sshdcond_sync.xml +++ b/config/sshdcond/sshdcond_sync.xml @@ -1,48 +1,48 @@ <?xml version="1.0" encoding="utf-8" ?> -<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd"> -<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?> +<!DOCTYPE packagegui SYSTEM "../schema/packages.dtd"> +<?xml-stylesheet type="text/xsl" href="../xsl/package.xsl"?> <packagegui> <copyright> <![CDATA[ /* $Id$ */ -/* ========================================================================== */ +/* ====================================================================================== */ /* - sshdcond_sync.xml - part of the sarg package for pfSense - Copyright (C) 2012 Marcello Coutinho - All rights reserved. - */ -/* ========================================================================== */ + sshdcond_sync.xml + part of pfSense (https://www.pfSense.org/) + Copyright (C) 2012 Marcello Coutinho + Copyright (C) 2015 ESF, LLC + All rights reserved. +*/ +/* ====================================================================================== */ /* - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - */ -/* ========================================================================== */ + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ +/* ====================================================================================== */ ]]> </copyright> - <description>Describe your package here</description> - <requirements>Describe your package requirements here</requirements> - <faq>Currently there are no FAQ items provided.</faq> <name>sshdcondsync</name> - <version>1.0</version> + <version>1.0.2</version> <title>SSH Conditional - Sync</title> <include_file>/usr/local/pkg/sshdcond.inc</include_file> <tabs> @@ -75,7 +75,7 @@ <rowhelperfield> <fielddescr>IP Address</fielddescr> <fieldname>ipaddress</fieldname> - <description>IP Address of remote server</description> + <description>IP Address of remote server.</description> <type>input</type> <size>20</size> </rowhelperfield> @@ -89,8 +89,6 @@ </rowhelper> </field> </fields> - <custom_php_validation_command> - </custom_php_validation_command> <custom_php_resync_config_command> sshdcond_custom_php_write_config(); </custom_php_resync_config_command> diff --git a/pkg_config.10.xml b/pkg_config.10.xml index 60883e9c..90c3850a 100644 --- a/pkg_config.10.xml +++ b/pkg_config.10.xml @@ -1308,7 +1308,7 @@ <descr><![CDATA[Allows to define SSH overrides for users,groups,hosts and addresses using Match in a convenient way.<br /> This package acts as an access list frontend for ssh connections]]></descr> <category>Enhancements</category> - <version>1.0.1</version> + <version>1.0.2</version> <status>Beta</status> <required_version>2.2</required_version> <config_file>https://packages.pfsense.org/packages/config/sshdcond/sshdcond.xml</config_file> |