mirror of
https://github.com/linuxserver/docker-openssh-server.git
synced 2026-02-20 04:33:38 +08:00
adding password based auth
This commit is contained in:
thelamer
parent
ccb7e133eb
commit
112da4b732
25
README.md
25
README.md
@ -68,8 +68,9 @@ docker create \
|
||||
-e PUBLIC_KEY=yourpublickey `#optional` \
|
||||
-e PUBLIC_KEY_FILE=/path/to/file `#optional` \
|
||||
-e SUDO_ACCESS=false `#optional` \
|
||||
-e SUDO_PASSWORD=password `#optional` \
|
||||
-e SUDO_PASSWORD_FILE=/path/to/file `#optional` \
|
||||
-e PASSWORD_ACCESS=false `#optional` \
|
||||
-e USER_PASSWORD=password `#optional` \
|
||||
-e USER_PASSWORD_FILE=/path/to/file `#optional` \
|
||||
-e USER_NAME=linuxserver.io `#optional` \
|
||||
-p 2222:2222 \
|
||||
-v /path/to/appdata/config:/config \
|
||||
@ -96,8 +97,9 @@ services:
|
||||
- PUBLIC_KEY=yourpublickey #optional
|
||||
- PUBLIC_KEY_FILE=/path/to/file #optional
|
||||
- SUDO_ACCESS=false #optional
|
||||
- SUDO_PASSWORD=password #optional
|
||||
- SUDO_PASSWORD_FILE=/path/to/file #optional
|
||||
- PASSWORD_ACCESS=false #optional
|
||||
- USER_PASSWORD=password #optional
|
||||
- USER_PASSWORD_FILE=/path/to/file #optional
|
||||
- USER_NAME=linuxserver.io #optional
|
||||
volumes:
|
||||
- /path/to/appdata/config:/config
|
||||
@ -118,9 +120,10 @@ Container images are configured using parameters passed at runtime (such as thos
|
||||
| `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London |
|
||||
| `-e PUBLIC_KEY=yourpublickey` | Optional ssh public key, which will automatically be added to authorized_keys. |
|
||||
| `-e PUBLIC_KEY_FILE=/path/to/file` | Optionally specify a file containing the public key (works with docker secrets). |
|
||||
| `-e SUDO_ACCESS=false` | Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `SUDO_PASSWORD` set, this will allow passwordless sudo access. |
|
||||
| `-e SUDO_PASSWORD=password` | Optionally set a sudo password for `abc`, the ssh user. If this or `SUDO_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access. |
|
||||
| `-e SUDO_PASSWORD_FILE=/path/to/file` | Optionally specify a file that contains the password. This setting supersedes the `SUDO_PASSWORD` option (works with docker secrets). |
|
||||
| `-e SUDO_ACCESS=false` | Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `USER_PASSWORD` set, this will allow passwordless sudo access. |
|
||||
| `-e PASSWORD_ACCESS=false` | Set to `true` to allow user/password ssh access you will want to set `USER_PASSWORD` or `USER_PASSWORD_FILE` as well. |
|
||||
| `-e USER_PASSWORD=password` | Optionally set a sudo password for `abc`, the ssh user. If this or `USER_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access. |
|
||||
| `-e USER_PASSWORD_FILE=/path/to/file` | Optionally specify a file that contains the password. This setting supersedes the `USER_PASSWORD` option (works with docker secrets). |
|
||||
| `-e USER_NAME=linuxserver.io` | Optionally specify a user name (Default:`linuxserver.io`) |
|
||||
| `-v /config` | Contains all relevant configuration files. |
|
||||
|
||||
@ -141,12 +144,14 @@ In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as bel
|
||||
|
||||
## Application Setup
|
||||
|
||||
If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted.
|
||||
If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted.
|
||||
Removing `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables from docker run environment variables will not remove the keys from `authorized_keys`. `PUBLIC_KEY_FILE` can be used with docker secrets.
|
||||
|
||||
Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP`
|
||||
We provide the ability to set and allow password based acces via the `PASSWORD_ACCESS` and `USER_PASSWORD` variables, though we as an organization discourage using password auth for public facing ssh endpoints.
|
||||
|
||||
Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `SUDO_PASSWORD` and `SUDO_PASSWORD_FILE` allow setting an optional sudo password.
|
||||
Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP`
|
||||
|
||||
Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `USER_PASSWORD` and `USER_PASSWORD_FILE` allow setting an optional sudo password.
|
||||
|
||||
The users only have access to the folders mapped and the processes running inside this container.
|
||||
Add any volume mappings you like for the users to have access to.
|
||||
|
||||
@ -40,9 +40,10 @@ opt_param_usage_include_env: true
|
||||
opt_param_env_vars:
|
||||
- { env_var: "PUBLIC_KEY", env_value: "yourpublickey", desc: "Optional ssh public key, which will automatically be added to authorized_keys."}
|
||||
- { env_var: "PUBLIC_KEY_FILE", env_value: "/path/to/file", desc: "Optionally specify a file containing the public key (works with docker secrets)."}
|
||||
- { env_var: "SUDO_ACCESS", env_value: "false", desc: "Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `SUDO_PASSWORD` set, this will allow passwordless sudo access."}
|
||||
- { env_var: "SUDO_PASSWORD", env_value: "password", desc: "Optionally set a sudo password for `abc`, the ssh user. If this or `SUDO_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access."}
|
||||
- { env_var: "SUDO_PASSWORD_FILE", env_value: "/path/to/file", desc: "Optionally specify a file that contains the password. This setting supersedes the `SUDO_PASSWORD` option (works with docker secrets)."}
|
||||
- { env_var: "SUDO_ACCESS", env_value: "false", desc: "Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `USER_PASSWORD` set, this will allow passwordless sudo access."}
|
||||
- { env_var: "PASSWORD_ACCESS", env_value: "false", desc: "Set to `true` to allow user/password ssh access you will want to set `USER_PASSWORD` or `USER_PASSWORD_FILE` as well."}
|
||||
- { env_var: "USER_PASSWORD", env_value: "password", desc: "Optionally set a sudo password for `abc`, the ssh user. If this or `USER_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access."}
|
||||
- { env_var: "USER_PASSWORD_FILE", env_value: "/path/to/file", desc: "Optionally specify a file that contains the password. This setting supersedes the `USER_PASSWORD` option (works with docker secrets)."}
|
||||
- { env_var: "USER_NAME", env_value: "linuxserver.io", desc: "Optionally specify a user name (Default:`linuxserver.io`)"}
|
||||
|
||||
optional_block_1: false
|
||||
@ -51,12 +52,14 @@ optional_block_1_items: ""
|
||||
# application setup block
|
||||
app_setup_block_enabled: true
|
||||
app_setup_block: |
|
||||
If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted.
|
||||
If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted.
|
||||
Removing `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables from docker run environment variables will not remove the keys from `authorized_keys`. `PUBLIC_KEY_FILE` can be used with docker secrets.
|
||||
|
||||
Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP`
|
||||
We provide the ability to set and allow password based acces via the `PASSWORD_ACCESS` and `USER_PASSWORD` variables, though we as an organization discourage using password auth for public facing ssh endpoints.
|
||||
|
||||
Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `SUDO_PASSWORD` and `SUDO_PASSWORD_FILE` allow setting an optional sudo password.
|
||||
Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP`
|
||||
|
||||
Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `USER_PASSWORD` and `USER_PASSWORD_FILE` allow setting an optional sudo password.
|
||||
|
||||
The users only have access to the folders mapped and the processes running inside this container.
|
||||
Add any volume mappings you like for the users to have access to.
|
||||
|
||||
@ -6,12 +6,12 @@ mkdir -p \
|
||||
|
||||
USER_NAME=${USER_NAME:-linuxserver.io}
|
||||
echo "User name is set to $USER_NAME"
|
||||
sed -i "s/su linuxserver.io linuxserver.io/su ${USER_NAME} ${USER_NAME}" /etc/logrotate.d/openssh
|
||||
sed -i "s/su linuxserver.io linuxserver.io/su ${USER_NAME} ${USER_NAME}/g" /etc/logrotate.d/openssh
|
||||
|
||||
# set password for abc to unlock it and set sudo access
|
||||
sed -i "/${USER_NAME} ALL.*/d" /etc/sudoers
|
||||
if [ "$SUDO_ACCESS" == "true" ]; then
|
||||
if [ -n "$SUDO_PASSWORD" ] || [ -n "$SUDO_PASSWORD_FILE" -a -f "$SUDO_PASSWORD_FILE" ]; then
|
||||
if [ -n "$USER_PASSWORD" ] || [ -n "$USER_PASSWORD_FILE" -a -f "$USER_PASSWORD_FILE" ]; then
|
||||
echo "${USER_NAME} ALL=(ALL) ALL" >> /etc/sudoers
|
||||
echo "Sudo is enabled with password."
|
||||
else
|
||||
@ -21,13 +21,13 @@ if [ "$SUDO_ACCESS" == "true" ]; then
|
||||
else
|
||||
echo "Sudo is disabled."
|
||||
fi
|
||||
|
||||
[[ -n "$SUDO_PASSWORD_FILE" ]] && [[ -f "$SUDO_PASSWORD_FILE" ]] && \
|
||||
SUDO_PASSWORD=$(cat "$SUDO_PASSWORD_FILE") && \
|
||||
[[ -n "$USER_PASSWORD_FILE" ]] && [[ -f "$USER_PASSWORD_FILE" ]] && \
|
||||
USER_PASSWORD=$(cat "$USER_PASSWORD_FILE") && \
|
||||
echo "Sudo password is retrieved from file."
|
||||
SUDO_PASSWORD=${SUDO_PASSWORD:-$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-8};echo;)}
|
||||
echo "${USER_NAME}:${SUDO_PASSWORD}" | chpasswd
|
||||
USER_PASSWORD=${USER_PASSWORD:-$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-8};echo;)}
|
||||
echo "${USER_NAME}:${USER_PASSWORD}" | chpasswd
|
||||
|
||||
# symlink out ssh config directory
|
||||
if [ ! -L /etc/ssh ];then
|
||||
if [ ! -f /config/ssh_host_keys/sshd_config ]; then
|
||||
sed -i '/#PidFile/c\PidFile \/config\/sshd.pid' /etc/ssh/sshd_config
|
||||
@ -38,6 +38,20 @@ if [ ! -L /etc/ssh ];then
|
||||
ssh-keygen -A
|
||||
fi
|
||||
|
||||
# password access
|
||||
if [ "$PASSWORD_ACCESS" == "true" ]; then
|
||||
sed -i '/^PasswordAuthentication/c\PasswordAuthentication yes' /etc/ssh/sshd_config
|
||||
sed -i '/UsePAM/c\UsePAM yes' /etc/ssh/sshd_config
|
||||
chown root:"${USER_NAME}" \
|
||||
/etc/shadow
|
||||
else
|
||||
sed -i '/^PasswordAuthentication/c\PasswordAuthentication no' /etc/ssh/sshd_config
|
||||
sed -i '/UsePAM/c\UsePAM no' /etc/ssh/sshd_config
|
||||
chown root:root \
|
||||
/etc/shadow
|
||||
fi
|
||||
|
||||
# set key auth in file
|
||||
if [ ! -f /config/.ssh/authorized_keys ];then
|
||||
touch /config/.ssh/authorized_keys
|
||||
fi
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user