github/vim-ale
1
0
Fork 0
mirror of https://github.com/webinstall/webi-installers.git synced 2026-08-19 03:56:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

security(ssh-adduser): disable UsePAM on macOS (otherwise passwords are still allowed)

Browse Source
This commit is contained in:
AJ ONeal
2021-11-14 08:18:45 +00:00
parent 0d3bff0ad5
commit dd60d23154
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssh-utils/ssh-adduser.sh
+17 -4
View File
@@ -53,14 +53,24 @@ function __run_ssh_adduser() {
sudo -i -u "$my_new_user" bash -c "wget -q -O - '$WEBI_HOST/webi' | bash"
# TODO ensure that ssh-password login is off
my_user="$(grep 'PasswordAuthentication yes' /etc/ssh/sshd_config)"
if [[ -n ${my_user} ]]; then
my_pass="$(grep 'PasswordAuthentication yes' /etc/ssh/sshd_config)"
my_pam=""
if [[ "Darwin" == "$(uname -s)" ]]; then
# Turn off PAM for macOS or it will allow password login
my_pam="$(grep 'UsePAM yes' /etc/ssh/sshd_config)"
fi
if [[ -n ${my_pass} ]] || [[ -n ${my_pam} ]]; then
echo "######################################################################"
echo "# #"
echo "# WARNING #"
echo "# #"
echo "# Found /etc/ssh/sshd_config: PasswordAuthentication yes #"
echo "# Found /etc/ssh/sshd_config: #"
if [[ -n ${my_pass} ]]; then
echo "# PasswordAuthentication yes #"
fi
if [[ -n ${my_pam} ]]; then
echo "# UsePAM yes #"
fi
echo "# #"
echo "# This is EXTREMELY DANGEROUS and insecure. #"
echo "# We'll attempt to fix this now... #"
@@ -69,6 +79,9 @@ function __run_ssh_adduser() {
sed -i 's/#\?PasswordAuthentication \(yes\|no\)/PasswordAuthentication no/' \
/etc/ssh/sshd_config
sed -i 's/#\?UsePAM \(yes\|no\)/UsePAM no/' \
/etc/ssh/sshd_config
if grep "PasswordAuthentication yes" /etc/ssh/sshd_config; then
echo "# FAILED. Please check /etc/ssh/sshd_config manually. #"
else