Improved compatibility with Fedora about borgwarehouse HOT 15 CLOSED

journalctl -u borgwarehouse

su borgwarehouse
cd /home/borgwarehouse/borgwarehouse
npm run start

at ChildProcess.exithandler (node:child_process:412:12)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1091:16)
at Socket.<anonymous> (node:internal/child_process:449:11)
at Socket.emit (node:events:513:28)
at Pipe.<anonymous> (node:net:313:12) {

#!/bin/bash

# Shell created by Raven for BorgWarehouse.
# This shell takes 3 arguments : [reponame] X [SSH pub key] X [quota]
# Main steps are :
# - check if args are present
# - check the ssh pub key format
# - check if borgbackup package is install
# - generate a random username, check if it exists in /etc/passwd
# - add the user (with random name), group, shell and home
# - create a pool which is the folder where all the repositories for a user are located (only one by user for borgwarehouse usage)
# - create the authorized_keys
# - add the SSH public key in the authorized_keys with borg restriction for repository and storage quota.
# This simple method prevents the user from connecting to the server with a shell in SSH.
# He can only use the borg command. Moreover, he will not be able to leave his repository or create a new one.
# It is similar to a jail and that is the goal.

# Exit when any command fails
set -e

# Check args
if [ "$1" == "" ] || [ "$2" == "" ] || [ "$3" == "" ];then
    echo "This shell takes 3 argument : Reponame, SSH Public Key, Quota in Go [e.g. : 10] "
    exit 1
fi

# Check if the SSH public key is a valid format
# This pattern validates SSH public keys for : rsa, ed25519, ed25519-sk
pattern='(ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|[email protected] AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29t|ssh-rsa AAAAB3NzaC1yc2)[0-9A-Za-z+/]+[=]{0,3}(\s.*)?'
if [[ ! "$2" =~ $pattern ]]
then	
    echo "Invalid public SSH KEY format. Provide a key in OpenSSH format (rsa, ed25519, ed25519-sk)"
    exit 2
fi

# Check if borgbackup is installed
if ! [ -x "$(command -v borg)" ]; then
  echo "You must install borgbackup package."
  exit 3
fi

# Generation of a random for username
randUsername () {
    openssl rand -hex 4
}
user=$(randUsername)

# Check if the random is already a username.
while grep -q $user /etc/passwd
do
    user=$(randUsername)
done

# Some variables
group="${user}"
home="/var/borgwarehouse/${user}"
pool="${home}/repos"

## add user and create homedirectory ${user} - [shell=/bin/bash home=${home} group=${group}]
sudo useradd -d ${home} -s "/bin/bash" -m ${user}

## Create directory ${home}/.ssh
sudo mkdir -p ${home}/.ssh

## Create autorized_keys file
sudo touch ${home}/.ssh/authorized_keys

## Create ${pool}
sudo mkdir -p ${pool}

## Create the repo
sudo mkdir -p "${pool}/$1"

## Check if authorized_keys exists
authorized_keys="${home}/.ssh/authorized_keys"
if [ ! -f "${authorized_keys}" ];then
    echo "${authorized_keys} must be present"
    exit 4
fi

## Change permissions
sudo chmod -R 700 ${home}
sudo chmod 600 ${authorized_keys}
sudo chown -R ${user}:${user} ${home}

## Add ssh public key in authorized_keys with borg restriction for only 1 repository (:$1) and storage quota
sudo -u ${user} bash -c "echo 'command=\"cd ${pool};borg serve --restrict-to-repository ${pool}/$1 --storage-quota $3G\",restrict $2' >> ${authorized_keys}"

## Return the unix user
echo ${user}

at ChildProcess.exithandler (node:child_process:412:12)
at ChildProcess.emit (node:events:513:28)
at maybeClose (node:internal/child_process:1091:16)
at Socket.<anonymous> (node:internal/child_process:449:11)
at Socket.emit (node:events:513:28)
at Pipe.<anonymous> (node:net:313:12) {

[root@cygnus shells]# ll /var/borgwarehouse/78e0ccf7/
total 44
drwx------ 5 78e0ccf7 78e0ccf7 4096 Dec 19 11:58 .
drwxr-xr-x 3 root     root     4096 Dec 19 11:58 ..
-rw-r--r-- 1 78e0ccf7 78e0ccf7   18 Nov 18 15:24 .bash_logout
-rw-r--r-- 1 78e0ccf7 78e0ccf7  141 Nov 18 15:24 .bash_profile
-rw-r--r-- 1 78e0ccf7 78e0ccf7  492 Nov 18 15:24 .bashrc
-rw-r--r-- 1 78e0ccf7 78e0ccf7  172 Sep 19 12:42 .kshrc
drwxr-xr-x 4 78e0ccf7 78e0ccf7 4096 Jul 22 01:56 .mozilla
drwxr-xr-x 3 root     root     4096 Dec 19 11:58 repos
drwxr-xr-x 2 root     root     4096 Dec 19 11:58 .ssh
-rw-r--r-- 1 78e0ccf7 78e0ccf7  299 Jul 23 16:08 .zprofile
-rw-r--r-- 1 78e0ccf7 78e0ccf7  658 Jul 23 16:08 .zshrc
[root@cygnus shells]# ll /var/borgwarehouse/
total 12
drwxr-xr-x  3 root     root     4096 Dec 19 11:58 .
drwxr-xr-x 34 root     root     4096 Dec 18 22:57 ..
drwx------  5 78e0ccf7 78e0ccf7 4096 Dec 19 11:58 78e0ccf7
[root@cygnus shells]# ll /var/borgwarehouse/78e0ccf7/repos/
total 12
drwxr-xr-x 3 root     root     4096 Dec 19 11:58 .
drwx------ 5 78e0ccf7 78e0ccf7 4096 Dec 19 11:58 ..
drwxr-xr-x 2 root     root     4096 Dec 19 11:58 repo0
[root@cygnus shells]# ll /var/borgwarehouse/78e0ccf7/repos/repo0/
total 8
drwxr-xr-x 2 root root 4096 Dec 19 11:58 .
drwxr-xr-x 3 root root 4096 Dec 19 11:58 ..
[root@cygnus shells]# 
[root@cygnus shells]# ll /var/borgwarehouse/78e0ccf7/.ssh/
total 8
drwxr-xr-x 2 root     root     4096 Dec 19 11:58 .
drwx------ 5 78e0ccf7 78e0ccf7 4096 Dec 19 11:58 ..
-rw-r--r-- 1 root     root        0 Dec 19 11:58 authorized_keys

[root@cygnus shells]# ll /var/borgwarehouse/78e0ccf7/.ssh/authorized_keys
-rw-r--r-- 1 root root 0 Dec 19 11:58 /var/borgwarehouse/78e0ccf7/.ssh/authorized_keys

[borgwarehouse@cygnus borgwarehouse]$ npm run start

> [email protected] start
> next start -H 127.0.0.1 -p 7689

ready - started server on 127.0.0.1:7689, url: http://127.0.0.1:7689
info  - Loaded env from /home/borgwarehouse/borgwarehouse/.env.local

git pull

borgwarehouse ALL=(ALL) NOPASSWD: /usr/sbin/userdel -rf [[\:xdigit\:]]*
borgwarehouse ALL=(ALL) NOPASSWD: /usr/sbin/useradd -d /var/borgwarehouse/[[\:xdigit\:]]* -s /bin/bash -m --badname [[\:xdigit\:]]*
borgwarehouse ALL=(ALL) NOPASSWD: /usr/bin/mkdir -p /var/borgwarehouse/[[\:xdigit\:]]*/repos/repo[[\:digit\:]]*, /usr/bin/mkdir -p /var/borgwarehouse/[[\:xdigit\:]]*/.ssh
borgwarehouse ALL=(ALL) NOPASSWD: /usr/bin/touch /var/borgwarehouse/[[\:xdigit\:]]*/.ssh/authorized_keys
borgwarehouse ALL=(ALL) NOPASSWD: /usr/bin/chmod -R 750 /var/borgwarehouse/[[\:xdigit\:]]*, /usr/bin/chmod 600 /var/borgwarehouse/[[\:xdigit\:]]*/.ssh/authorized_keys
borgwarehouse ALL=(ALL) NOPASSWD: /usr/bin/chown -R [[\:xdigit\:]]*\:borgwarehouse /var/borgwarehouse/[[\:xdigit\:]]*
borgwarehouse ALL=(ALL) NOPASSWD: /usr/bin/tee /var/borgwarehouse/[[\:xdigit\:]]*/.ssh/authorized_keys
borgwarehouse ALL=(ALL) NOPASSWD: /usr/bin/sed -ri s|*|g /var/borgwarehouse/[[\:xdigit\:]]*/.ssh/authorized_keys
borgwarehouse ALL=(ALL) NOPASSWD: /usr/bin/jc du -s *