myb_usermgmt

#!/usr/local/bin/cbsd
MYARG="user"
MYOPTARG=
MYDESC="Manage CBSD API whitelist file via mcedit"
CBSDMODULE="myb"
ADDHELP="

${H3_COLOR}Description${N0_COLOR}:

Manage /usr/local/etc/cbsd-mq-api.allow content via mcedit.

"
EXTHELP=

. ${subrdir}/tools.subr
user=
. ${subrdir}/cbsdinit.subr
. ${subrdir}/system.subr
. ${dialog}

failed()
{
	echo
	echo "Interrupted"
	_res=$( ${ID_CMD} -P ${user} 2>/dev/null )
	_ret=$?
	if [ ${_ret} -eq 0 ]; then
		${PW_CMD} userdel ${user}
		[ -d /home/${user} ] && ${RM_CMD} -rf /home/${user}
	fi

	exit 0
}

dialog_menu_main()
{
	local title=" Client SSH user: ${user} "
	hline=
	local defaultitem=

	f_dialog_default_fetch defaultitem

	local menu_list=

	menu_list="${menu_list} 'credential_link'	'credential_link'	'Generate one-time credential URL (e.g. for MyBee-QT)'"
	menu_list="${menu_list} 'pubkey'		'show pubkey'		'Show/print pubkey for user ${user}'"
	menu_list="${menu_list} 'password'		'Change password'	'Change password for ${user} user'"
	menu_list="${menu_list} 'REMOVE'		'REMOVE'		'Remove ${user} user'"
	menu_list="${menu_list} '-'			'-'			''"
	menu_list="${menu_list} 'EXIT'			'EXIT'			'EXIT'"
	cbsd_menubox
	retval=$?

	f_dialog_data_sanitize menu_choice
	f_dialog_menutag_store "$menu_choice"
	f_dialog_default_store "$menu_choice"

	return $retval
}

add_user_pubkey_acl()
{
	local _ret= _ssh_user=

	WHITELIST_FILE="/usr/local/etc/cbsd-mq-api.allow"

	if [ -r /home/${user}/.ssh/id_ed25519.pub ]; then
		_ssh_user=$( ${GREP_CMD} -v '^#' /home/${user}/.ssh/id_ed25519.pub | ${GREP_CMD} . )
	fi

	[ -z "${_ssh_user}" ] && return 0

	if [ -r ${WHITELIST_FILE} ]; then
		${CP_CMD} -a ${WHITELIST_FILE}.bak
		echo "${_ssh_user}" >> ${WHITELIST_FILE}
		${SERVICE_CMD} cbsd-mq-api restart
	else
		echo "${_ssh_user}" > ${WHITELIST_FILE}
		${SERVICE_CMD} cbsd-mq-api restart
	fi
}

show_pubkey()
{
	local _ret= _ssh_user= _cid=

	if [ -r /home/${user}/.ssh/id_ed25519.pub ]; then
		_ssh_user=$( ${GREP_CMD} -v '^#' /home/${user}/.ssh/id_ed25519.pub | ${GREP_CMD} . )
	fi

	if [ -z "${_ssh_user}" ]; then
		echo "no pubkey"
		read p
		return 0
	fi

	_cid=$( ${miscdir}/cbsd_md5 "${_ssh_user}" )

	echo
	echo "CID: ${_cid}"
	echo "${_ssh_user}"
	echo
	read p

	return 0
}

remove_user_pubkey_acl()
{
	local _ret= _ssh_user=
	WHITELIST_FILE="/usr/local/etc/cbsd-mq-api.allow"

	if [ -r /home/${user}/.ssh/id_ed25519.pub ]; then
		_ssh_user=$( ${GREP_CMD} -v '^#' /home/${user}/.ssh/id_ed25519.pub | ${GREP_CMD} . )
	fi

	[ -z "${_ssh_user}" ] && return 0

	if [ -r ${WHITELIST_FILE} ]; then
		${CP_CMD} -a ${WHITELIST_FILE}.bak
		${GREP_CMD} "${_ssh_user}" ${WHITELIST_FILE}.bak > ${WHITELIST_FILE}
		_ret=$?
		[ ${_ret} -eq 0 ] && ${SERVICE_CMD} cbsd-mq-api restart
	fi
}


remove_user()
{
	if ! getyesno "Remove user ${user} ?"; then
		return 1
	fi

	${PW_CMD} userdel ${user}
	[ -d /home/${user} ] && ${RM_CMD} -rf /home/${user}

	remove_user_pubkey_acl

	return 0
}

mgmt_tui()
{
	while [ 1 ]; do
		dialog_menu_main || f_die

		index=${mtag%% *}
		mychoice=${mtag##* }

		case "${mychoice}" in
			"-")
				continue
				;;
			pubkey)
				show_pubkey
				;;
			REMOVE)
				remove_user && exit 0
				;;
			credential_link)
				credential_link
				read p
				exit 0
				;;
			EXIT)
				exit 0
				;;
		esac
	done
}

add_user()
{
	echo "Create new SSH user"

	while [ 1 ]; do
		printf "Username: "
		read user

		user_len=${#user}

		if [ ${user_len} -gt 8 ]; then
			echo "Username length too long, please use a shorter"
			continue
		fi

		_res=$( ${ID_CMD} -P ${user} 2>/dev/null )
		_ret=$?
		if [ ${_ret} -eq 0 ]; then
			echo "Username already exist:"
			echo "${_res}"
			continue
		fi

		if getyesno "Add user [${user}], OK?"; then
			${PW_CMD} useradd ${user} -d /home/${user} -G cbsd -u 10000 -s /bin/sh -m
			_ret=$?
			if [ ${_ret} -ne 0 ]; then
				echo "Error"
				read p
				exit ${_ret}
			fi
			if ! getyesno "Do you want to block the password in favor of SSH key-only access?"; then
				trap "failed" HUP INT ABRT BUS TERM EXIT
				while [ 1 ]; do
					/usr/bin/passwd ${user}
					_ret=$?
					if [ ${_ret} -eq 0 ]; then
						trap "" HUP INT ABRT BUS TERM EXIT
						break
					fi
				done
				break
			else
				break
			fi
		fi
	done

	# keygen
	_keyfile="/home/${user}/.ssh/id_ed25519"

	if [ ! -r "${_keyfile}" ]; then
		keygen
	fi

	add_user_pubkey_acl
}

credential_link()
{
	local _lnk= _myurl=
	local _host= _res= _scheme=
	_lnk=$( random_password_gen -l 6 | ${TR_CMD} -d '+')
	[ -r /etc/rc.conf ] && . /etc/rc.conf

	# /etc/rc.conf vars
	case "${API_FQDN}" in
		disabled|'')
			if [ -z "${ip4}" -a -z "${ip6}" ]; then
				${ECHO} "${N1_COLOR}no such API_FQDN variable${N0_COLOR}"
				read p
				exit 1
			fi
			_myurl="${ip4}/c/${_lnk}"
			_host="http://${ip4}"
			_scheme="http"
			;;
		*)
			_myurl="${API_FQDN}/c/${_lnk}"
			_host="https://${API_FQDN}"
			_scheme="https"
			;;
	esac

	if [ ! -d /usr/local/www/config/c ]; then
		${MKDIR_CMD} -m 0700 /usr/local/www/config/c
		${CHOWN_CMD} cbsd:cbsd /usr/local/www/config/c
	fi

	_res=$( ${CAT_CMD} ~/.ssh/id_ed25519 | ${UUENCODE_CMD} -mr - | ${TR_CMD} -d '\r\n' )

	${FIND_CMD} /usr/local/www/config/c/ -mindepth 1 -maxdepth 1 -type f -delete

	${CAT_CMD} > /usr/local/www/config/c/${_lnk} <<EOF
{
  "host": "${_host}",
  "http_port": 443,
  "private_key": "${_res}",
  "scheme": "${_scheme}",
  "ssh_port": 22,
  "ssh_user": "${user}"
}
EOF

	${CHMOD_CMD} 0600 /usr/local/www/config/c/${_lnk}
	${CHOWN_CMD} cbsd:cbsd /usr/local/www/config/c/${_lnk}

	echo "One-time link, do not open! Paste into the MyBee-QT credential import button:"
	echo
	echo " ${_scheme}://${_myurl} "
	echo
}

keygen()
{
	[ ! -d /home/${user}/.ssh ] && ${MKDIR_CMD} -m 0750 /home/${user}/.ssh
	${SSH_KEYGEN_CMD} -t ed25519 -f ${_keyfile} -N '' > /dev/null 2>&1
	_ret=$?
	if [ ${_ret} -ne 0 ]; then
		echo "error: ${SSH_KEYGEN_CMD} -t ed25519 -f ${_keyfile} -N ''"
		exit 0
	fi

	return 0
}

_res=$( ${ID_CMD} -P 10000 2>/dev/null )
_ret=$?
if [ ${_ret} -eq 0 ]; then
	user=$( echo ${_res} | ${TR_CMD} ":" " " | ${AWK_CMD} '{printf $1}' )

	if [ ! -r /home/${user}/.ssh/id_ed25519 ]; then
		keygen
		add_user_pubkey_acl
	fi

	mgmt_tui
else
	add_user
	credential_link
	exit 0
fi

exit 0