diff options
Diffstat (limited to 'config/sshdcond')
-rw-r--r-- | config/sshdcond/sshdcond.inc | 254 | ||||
-rw-r--r-- | config/sshdcond/sshdcond.xml | 197 | ||||
-rwxr-xr-x | config/sshdcond/sshdcond_sync.xml | 97 |
3 files changed, 548 insertions, 0 deletions
diff --git a/config/sshdcond/sshdcond.inc b/config/sshdcond/sshdcond.inc new file mode 100644 index 00000000..2caa39cc --- /dev/null +++ b/config/sshdcond/sshdcond.inc @@ -0,0 +1,254 @@ +<?php + +/* ========================================================================== */ +/* + sshdcond.inc + part of pfSense (http://www.pfSense.com) + Copyright (C) 2012 Marcello Coutinho + Copyright (C) 2012 Han Van (namezero@afim.info) + All rights reserved. + + Based on m0n0wall (http://m0n0.ch/wall) + Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>. + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + require_once("config.inc"); + require_once("util.inc"); + +function restart_sshd(){ + #backup /etc/sshd before any change + $etc_sshd="/etc/sshd"; + $pfsense_version=preg_replace("/\s/","",file_get_contents("/etc/version")); + if (!file_exists('/root/'.$pfsense_version.'.sshd.backup')){ + copy ($etc_sshd,'/root/'.$pfsense_version.'.sshd.backup'); + } + + #patch /etc/sshd if need + $sshd_file=file($etc_sshd); + $sshd_new_file=""; + foreach ($sshd_file as $line){ + if (preg_match('/sshconf .= "Port/',$line)){ + $sshd_new_file.= $line; + $sshd_new_file.= "\t".'if(file_exists("/etc/ssh/sshd_extra")){$sshconf.=file_get_contents("/etc/ssh/sshd_extra");}'."\n"; + } + elseif(!preg_match('/sshd_extra/',$line)){ + $sshd_new_file.= $line; + } + } + file_put_contents($etc_sshd,$sshd_new_file,LOCK_EX); + mwexec_bg($etc_sshd); + } + +function sshdcond_custom_php_install_command(){ + global $g, $config; + + conf_mount_rw(); + + // We need to generate an outfile for our extra commands + // The patched g_szSSHDFileGenerate php file then reads and appends that config + $fd = fopen("/etc/ssh/sshd_extra", 'w'); + fclose($fd); + + conf_mount_ro(); + } + +function sshdcond_custom_php_deinstall_command(){ + global $g, $config; + + conf_mount_rw(); + + // 1. Delete our config file + unlink_if_exists("/etc/ssh/sshd_extra"); + + // 2. Re-run sshd config generation script + restart_sshd(); + + conf_mount_ro(); + } + +function sshdcond_custom_php_write_config(){ + global $g, $config; + + # detect boot process + if (is_array($_POST)){ + if (!preg_match("/\w+/",$_POST['__csrf_magic'])) + return; + } + + $sshd_extra=""; + if (is_array($config['installedpackages']['sshdcond']['config'])){ + // Mount Read-only + conf_mount_rw(); + + // Read config + foreach ($config['installedpackages']['sshdcond']['config'] as $sshdcond){ + if ($sshdcond['enable'] && is_array($sshdcond['row'])){ + $sshd_extra.= "Match {$sshdcond['matchtype']} {$sshdcond['matchvalue']}\n"; + foreach ($sshdcond['row'] as $sshd){ + //check if there is spaces on sshd value + if(preg_match ("/\s+/",$sshd['sshdvalue'])) + $sshd['sshdvalue']='"'.$sshd['sshdvalue'].'"'; + + //check if value is not empty + if($sshd['sshdvalue']!="") + $sshd_extra.="\t {$sshd['sshdoption']} {$sshd['sshdvalue']}\n"; + + //apply file permission if option is ChrootDirectory + if ($sshd['sshdoption']=="ChrootDirectory" && file_exists($sshd['sshdvalue'])){ + chown($sshd['sshdvalue'], 'root'); + chgrp($sshd['sshdvalue'], 'operator'); + } + } + } + } + } + + //Save /etc/ssh/sshd_extra + file_put_contents("/etc/ssh/sshd_extra",$sshd_extra,LOCK_EX); + + + + // Restart sshd + restart_sshd(); + + // Mount Read-only + conf_mount_ro(); + + //sync config with other pfsense servers + sshdcond_sync_on_changes(); + } + +/* Uses XMLRPC to synchronize the changes to a remote node */ +function sshdcond_sync_on_changes() { + global $config, $g; + + if (is_array($config['installedpackages']['sshdcondsync'])) + if (!$config['installedpackages']['sshdcondsync']['config'][0]['synconchanges']) + return; + + log_error("[sshdcond] xmlrpc sync is starting."); + foreach ($config['installedpackages']['sshdcondsync']['config'] as $rs ){ + foreach($rs['row'] as $sh){ + $sync_to_ip = $sh['ipaddress']; + $password = $sh['password']; + if($password && $sync_to_ip) + sshdcond_do_xmlrpc_sync($sync_to_ip, $password); + } + } + log_error("[sshdcond] xmlrpc sync is ending."); +} + +/* Do the actual XMLRPC sync */ +function sshdcond_do_xmlrpc_sync($sync_to_ip, $password) { + global $config, $g; + + if(!$password) + return; + + if(!$sync_to_ip) + return; + + $username='admin'; + $xmlrpc_sync_neighbor = $sync_to_ip; + if($config['system']['webgui']['protocol'] != "") { + $synchronizetoip = $config['system']['webgui']['protocol']; + $synchronizetoip .= "://"; + } + $port = $config['system']['webgui']['port']; + /* if port is empty lets rely on the protocol selection */ + if($port == "") { + if($config['system']['webgui']['protocol'] == "http") + $port = "80"; + else + $port = "443"; + } + $synchronizetoip .= $sync_to_ip; + + /* xml will hold the sections to sync */ + $xml = array(); + $xml['sshdcond'] = $config['installedpackages']['sshdcond']; + /* assemble xmlrpc payload */ + $params = array( + XML_RPC_encode($password), + XML_RPC_encode($xml) + ); + + /* set a few variables needed for sync code borrowed from filter.inc */ + $url = $synchronizetoip; + log_error("Beginning sshdcond XMLRPC sync to {$url}:{$port}."); + $method = 'pfsense.merge_installedpackages_section_xmlrpc'; + $msg = new XML_RPC_Message($method, $params); + $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); + $cli->setCredentials($username, $password); + if($g['debug']) + $cli->setDebug(1); + /* send our XMLRPC message and timeout after 250 seconds */ + $resp = $cli->send($msg, "250"); + if(!$resp) { + $error = "A communications error occurred while attempting sshdcond XMLRPC sync with {$url}:{$port}."; + log_error($error); + file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); + } elseif($resp->faultCode()) { + $cli->setDebug(1); + $resp = $cli->send($msg, "250"); + $error = "An error code was received while attempting sshdcond XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); + log_error($error); + file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); + } else { + log_error("sshdcond XMLRPC sync successfully completed with {$url}:{$port}."); + } + + /* tell sshdcond to reload our settings on the destionation sync host. */ + $method = 'pfsense.exec_php'; + $execcmd = "require_once('/usr/local/pkg/sshdcond.inc');\n"; + $execcmd .= "sshdcond_custom_php_write_config();"; + /* assemble xmlrpc payload */ + $params = array( + XML_RPC_encode($password), + XML_RPC_encode($execcmd) + ); + + log_error("sshdcond XMLRPC reload data {$url}:{$port}."); + $msg = new XML_RPC_Message($method, $params); + $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); + $cli->setCredentials($username, $password); + $resp = $cli->send($msg, "250"); + if(!$resp) { + $error = "A communications error occurred while attempting sshdcond XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; + log_error($error); + file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); + } elseif($resp->faultCode()) { + $cli->setDebug(1); + $resp = $cli->send($msg, "250"); + $error = "An error code was received while attempting sshdcond XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); + log_error($error); + file_notice("sync_settings", $error, "sshdcond Settings Sync", ""); + } else { + log_error("sshdcond XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); + } +} + ?>
\ No newline at end of file diff --git a/config/sshdcond/sshdcond.xml b/config/sshdcond/sshdcond.xml new file mode 100644 index 00000000..eeb35d75 --- /dev/null +++ b/config/sshdcond/sshdcond.xml @@ -0,0 +1,197 @@ +<?xml version="1.0" encoding="utf-8" ?> +<packagegui> +<copyright> + <![CDATA[ +/* $Id$ */ +/* ========================================================================== */ +/* + sshdcond.xml + part of pfSense (http://www.pfSense.com) + Copyright (C) 2012 Marcello Coutinho + Copyright (C) 2012 Han Van (namezero@afim.info) + All rights reserved. + + Based on m0n0wall (http://m0n0.ch/wall) + Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>. + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + </copyright> + + <name>sshdcond</name> + <version>1.0</version> + <title>SSH Conditional</title> + <description>SSH Conditional blocks</description> + <savetext>Save</savetext> + <include_file>/usr/local/pkg/sshdcond.inc</include_file> + + <menu> + <name>SSH Conditions</name> + <tooltiptext>Configure SSH conditional exceptions</tooltiptext> + <section>Services</section> + <url>/pkg.php?xml=sshdcond.xml</url> + </menu> + <configpath>installedpackages->package->sshdcond</configpath> + + <additional_files_needed> + <prefix>/usr/local/pkg/</prefix> + <chmod>755</chmod> + <item>http://www.pfsense.com/packages/config/sshdcond/sshdcond.inc</item> + </additional_files_needed> + <additional_files_needed> + <prefix>/usr/local/pkg/</prefix> + <chmod>755</chmod> + <item>http://www.pfsense.com/packages/config/sshdcond/sshdcond_sync.xml</item> + </additional_files_needed> + <tabs> + <tab> + <text>General</text> + <url>/pkg.php?xml=sshdcond.xml</url> + <active/> + </tab> + <tab> + <text>Sync</text> + <url>/pkg_edit.php?xml=sshdcond_sync.xml</url> + </tab> + </tabs> + <adddeleteeditpagefields> + <columnitem> + <fielddescr>Status</fielddescr> + <fieldname>enable</fieldname> + </columnitem> + <columnitem> + <fielddescr>Match Type</fielddescr> + <fieldname>matchtype</fieldname> + </columnitem> + <columnitem> + <fielddescr>Match Value</fielddescr> + <fieldname>matchvalue</fieldname> + </columnitem> + </adddeleteeditpagefields> + <fields> + <field> + <type>listtopic</type> + <name>Conditional SSH Options</name> + <fieldname>temp</fieldname> + </field> + <field> + <fielddescr>Enable</fielddescr> + <fieldname>enable</fieldname> + <type>checkbox</type> + <description>Enable this ssh conditional option for specified options.</description> + </field> + <field> + <fielddescr>Match Type</fielddescr> + <fieldname>matchtype</fieldname> + <description>See Match keyword at http://www.manpagez.com/man/5/sshd_config/ for options</description> + <type>select</type> + <options> + <option><name>User</name><value>User</value></option> + <option><name>Group</name><value>Group</value></option> + <option><name>Host</name><value>Host</value></option> + <option><name>Address</name><value>Address</value></option> + </options> + <required/> + </field> + <field> + <fielddescr>Match Value</fielddescr> + <fieldname>matchvalue</fieldname> + <description>Insert Match Value. Do not use spaces or special characters.</description> + <type>input</type> + <size>40</size> + <required/> + </field> + <field> + <fielddescr>Match Config</fielddescr> + <fieldname>none</fieldname> + <type>rowhelper</type> + <rowhelper> + <rowhelperfield> + <fielddescr>sshd option</fielddescr> + <fieldname>sshdoption</fieldname> + <type>select</type> + <options> + <option><name>AllowAgentForwarding</name><value>AllowAgentForwarding</value></option> + <option><name>AllowTcpForwarding</name><value>AllowTcpForwarding</value></option> + <option><name>AuthorizedKeysFile</name><value>AuthorizedKeysFile</value></option> + <option><name>AuthorizedPrincipalsFile</name><value>AuthorizedPrincipalsFile</value></option> + <option><name>Banner</name><value>Banner</value></option> + <option><name>ChrootDirectory</name><value>ChrootDirectory</value></option> + <option><name>ForceCommand</name><value>ForceCommand</value></option> + <option><name>GatewayPorts</name><value>GatewayPorts</value></option> + <option><name>GSSAPIAuthentication</name><value>GSSAPIAuthentication</value></option> + <option><name>HostbasedAuthentication</name><value>HostbasedAuthentication</value></option> + <option><name>HostbasedUsesNameFromPacketOnly</name><value>HostbasedUsesNameFromPacketOnly</value></option> + <option><name>KbdInteractiveAuthentication</name><value>KbdInteractiveAuthentication</value></option> + <option><name>KerberosAuthentication</name><value>KerberosAuthentication</value></option> + <option><name>MaxAuthTries</name><value>MaxAuthTries</value></option> + <option><name>MaxSessions</name><value>MaxSessions</value></option> + <option><name>PasswordAuthentication</name><value>PasswordAuthentication</value></option> + <option><name>PermitEmptyPasswords</name><value>PermitEmptyPasswords</value></option> + <option><name>PermitOpen</name><value>PermitOpen</value></option> + <option><name>PermitRootLogin</name><value>PermitRootLogin</value></option> + <option><name>PermitTunnel</name><value>PermitTunnel</value></option> + <option><name>PubkeyAuthentication</name><value>PubkeyAuthentication</value></option> + <option><name>RhostsRSAAuthentication</name><value>RhostsRSAAuthentication</value></option> + <option><name>RSAAuthentication</name><value>RSAAuthentication</value></option> + <option><name>X11DisplayOffset</name><value>X11DisplayOffset</value></option> + <option><name>X11Forwarding</name><value>X11Forwarding</value></option> + <option><name>X11UseLocalHost</name><value>X11UseLocalHost</value></option> + </options> + <required/> + </rowhelperfield> + <rowhelperfield> + <fielddescr>sshd value</fielddescr> + <fieldname>sshdvalue</fieldname> + <type>input</type> + <size>60</size> + <required/> + </rowhelperfield> + </rowhelper> + </field> + </fields> + + <custom_delete_php_command> + sshdcond_custom_php_write_config(); + </custom_delete_php_command> + <custom_add_php_command> + sshdcond_custom_php_write_config(); + </custom_add_php_command> + <custom_php_install_command> + sshdcond_custom_php_install_command(); + </custom_php_install_command> + <custom_php_deinstall_command> + sshdcond_custom_php_deinstall_command(); + </custom_php_deinstall_command> + <custom_php_resync_config_command> + sshdcond_custom_php_write_config(); + </custom_php_resync_config_command> + <custom_php_command_before_form> + unset($_POST['temp']); + </custom_php_command_before_form> + +</packagegui>
\ No newline at end of file diff --git a/config/sshdcond/sshdcond_sync.xml b/config/sshdcond/sshdcond_sync.xml new file mode 100755 index 00000000..2bd4a26b --- /dev/null +++ b/config/sshdcond/sshdcond_sync.xml @@ -0,0 +1,97 @@ +<?xml version="1.0" encoding="utf-8" ?> +<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd"> +<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?> +<packagegui> + <copyright> + <![CDATA[ +/* $Id$ */ +/* ========================================================================== */ +/* + sshdcond_sync.xml + part of the sarg package for pfSense + Copyright (C) 2012 Marcello Coutinho + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + </copyright> + <description>Describe your package here</description> + <requirements>Describe your package requirements here</requirements> + <faq>Currently there are no FAQ items provided.</faq> + <name>sshdcondsync</name> + <version>1.0</version> + <title>SSH Conditional - Sync</title> + <include_file>/usr/local/pkg/sshdcond.inc</include_file> + <tabs> + <tab> + <text>General</text> + <url>/pkg.php?xml=sshdcond.xml</url> + </tab> + <tab> + <text>Sync</text> + <url>/pkg_edit.php?xml=sshdcond_sync.xml</url> + <active/> + </tab> + </tabs> + <fields> + <field> + <name>XMLRPC Sync</name> + <type>listtopic</type> + </field> + <field> + <fielddescr>Automatically sync configuration changes</fielddescr> + <fieldname>synconchanges</fieldname> + <description>Automatically sync changes to the hosts defined below.</description> + <type>checkbox</type> + </field> + <field> + <fielddescr>Remote Server</fielddescr> + <fieldname>none</fieldname> + <type>rowhelper</type> + <rowhelper> + <rowhelperfield> + <fielddescr>IP Address</fielddescr> + <fieldname>ipaddress</fieldname> + <description>IP Address of remote server</description> + <type>input</type> + <size>20</size> + </rowhelperfield> + <rowhelperfield> + <fielddescr>Password</fielddescr> + <fieldname>password</fieldname> + <description>Password for remote server.</description> + <type>password</type> + <size>20</size> + </rowhelperfield> + </rowhelper> + </field> + </fields> + <custom_php_validation_command> + </custom_php_validation_command> + <custom_php_resync_config_command> + sshdcond_custom_php_write_config(); + </custom_php_resync_config_command> +</packagegui> |