61 lines
1.9 KiB
Bash
61 lines
1.9 KiB
Bash
user_add student
|
|
user_add alice
|
|
state_set start "$(date '+%Y-%m-%d %H:%M:%S')"
|
|
peer_up
|
|
hosts_add "$LE_PEER_ADDR server1.lab.example server1"
|
|
mkdir -p /etc/ssh/server1/sshd_config.d
|
|
keys=''
|
|
for t in ed25519 ecdsa rsa; do
|
|
[ -f /etc/ssh/ssh_host_${t}_key ] && keys="${keys}HostKey /etc/ssh/ssh_host_${t}_key
|
|
"
|
|
done
|
|
[ -n "$keys" ] || { ssh-keygen -A >/dev/null; keys='HostKey /etc/ssh/ssh_host_ed25519_key
|
|
'; }
|
|
cat >/etc/ssh/server1/sshd_config <<X
|
|
# sshd configuration of the lab's server1 (10.99.0.2).
|
|
# Files in sshd_config.d come first: the first value set for an option wins.
|
|
Include /etc/ssh/server1/sshd_config.d/*.conf
|
|
|
|
ListenAddress 10.99.0.2
|
|
PidFile none
|
|
${keys}PermitRootLogin no
|
|
PasswordAuthentication yes
|
|
KbdInteractiveAuthentication no
|
|
PubkeyAuthentication yes
|
|
UsePAM yes
|
|
SyslogFacility AUTHPRIV
|
|
Subsystem sftp /usr/libexec/openssh/sftp-server
|
|
X
|
|
command -v restorecon >/dev/null && restorecon -R /etc/ssh/server1
|
|
cat >/etc/systemd/system/le-lab-server1-sshd.service <<'X'
|
|
[Unit]
|
|
Description=Practice lab sshd on server1
|
|
Requires=le-lab-peer.service
|
|
After=le-lab-peer.service network.target
|
|
|
|
[Service]
|
|
NetworkNamespacePath=/run/netns/lepeer
|
|
ExecStartPre=/usr/sbin/sshd -t -f /etc/ssh/server1/sshd_config
|
|
ExecStart=/usr/sbin/sshd -D -f /etc/ssh/server1/sshd_config
|
|
KillMode=process
|
|
Restart=on-failure
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
# The journal may not be kept across reboots: copy sshd's complaints about
|
|
# file modes for the check.
|
|
cat >/etc/systemd/system/le-lab-server1-log.service <<X
|
|
[Unit]
|
|
Description=Practice lab: keep server1's file-mode complaints
|
|
After=systemd-journald.service
|
|
|
|
[Service]
|
|
ExecStart=/bin/sh -c 'journalctl -f -n 0 -q -u le-lab-server1-sshd | grep --line-buffered "bad ownership or modes" >>$LAB_STATE/bad-modes'
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet le-lab-server1-log.service le-lab-server1-sshd.service
|