55 lines
1.7 KiB
Bash
55 lines
1.7 KiB
Bash
for u in alice bob; do
|
|
id "$u" >/dev/null 2>&1 && refuse "user $u exists already; remove it first (userdel -r $u)"
|
|
done
|
|
listening 8000 tcp && refuse "something listens on TCP port 8000 already; stop it first"
|
|
user_add alice
|
|
user_add bob
|
|
echo "The launch code is 0000." >/home/alice/secret.txt
|
|
printf 'Meeting notes\nEverything is on schedule.\n' >/home/alice/notes.txt
|
|
chown alice: /home/alice/secret.txt /home/alice/notes.txt
|
|
|
|
# The peer, with its own sshd configuration and host keys in
|
|
# /etc/netns/lepeer/ssh, which "ip netns exec lepeer" mounts on /etc/ssh.
|
|
peer_up
|
|
mkdir -p /etc/netns/lepeer/ssh
|
|
k=$(mktemp -d)
|
|
mkdir -p "$k/etc/ssh"
|
|
ssh-keygen -A -f "$k" >/dev/null
|
|
mv "$k"/etc/ssh/ssh_host_* /etc/netns/lepeer/ssh/
|
|
rm -rf "$k"
|
|
cat >/etc/netns/lepeer/ssh/sshd_config <<'X'
|
|
# The peer's sshd configuration.
|
|
ListenAddress 10.99.0.2
|
|
HostKey /etc/ssh/ssh_host_ed25519_key
|
|
HostKey /etc/ssh/ssh_host_ecdsa_key
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
PubkeyAuthentication yes
|
|
PasswordAuthentication yes
|
|
KbdInteractiveAuthentication no
|
|
UsePAM yes
|
|
X11Forwarding no
|
|
Subsystem sftp internal-sftp
|
|
X
|
|
command -v restorecon >/dev/null && restorecon -R /etc/netns 2>/dev/null
|
|
state_set hostkey "$(ssh-keygen -lf /etc/netns/lepeer/ssh/ssh_host_ed25519_key.pub | awk '{print $2}')"
|
|
cat >/etc/systemd/system/le-lab-peer-sshd.service <<'X'
|
|
[Unit]
|
|
Description=Practice lab sshd on the peer
|
|
Requires=le-lab-peer.service
|
|
After=le-lab-peer.service network.target
|
|
|
|
[Service]
|
|
NetworkNamespacePath=/run/netns/lepeer
|
|
BindPaths=/etc/netns/lepeer/ssh:/etc/ssh
|
|
ExecStartPre=/bin/mkdir -p /run/sshd
|
|
ExecStart=/usr/sbin/sshd -D -o PidFile=none
|
|
KillMode=process
|
|
Restart=on-failure
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet le-lab-peer-sshd.service
|
|
true
|