diff --git a/README.md b/README.md index 3b9db5b..61aeeca 100644 --- a/README.md +++ b/README.md @@ -68,8 +68,9 @@ docker create \ -e PUBLIC_KEY=yourpublickey `#optional` \ -e PUBLIC_KEY_FILE=/path/to/file `#optional` \ -e SUDO_ACCESS=false `#optional` \ - -e SUDO_PASSWORD=password `#optional` \ - -e SUDO_PASSWORD_FILE=/path/to/file `#optional` \ + -e PASSWORD_ACCESS=false `#optional` \ + -e USER_PASSWORD=password `#optional` \ + -e USER_PASSWORD_FILE=/path/to/file `#optional` \ -e USER_NAME=linuxserver.io `#optional` \ -p 2222:2222 \ -v /path/to/appdata/config:/config \ @@ -96,8 +97,9 @@ services: - PUBLIC_KEY=yourpublickey #optional - PUBLIC_KEY_FILE=/path/to/file #optional - SUDO_ACCESS=false #optional - - SUDO_PASSWORD=password #optional - - SUDO_PASSWORD_FILE=/path/to/file #optional + - PASSWORD_ACCESS=false #optional + - USER_PASSWORD=password #optional + - USER_PASSWORD_FILE=/path/to/file #optional - USER_NAME=linuxserver.io #optional volumes: - /path/to/appdata/config:/config @@ -118,9 +120,10 @@ Container images are configured using parameters passed at runtime (such as thos | `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London | | `-e PUBLIC_KEY=yourpublickey` | Optional ssh public key, which will automatically be added to authorized_keys. | | `-e PUBLIC_KEY_FILE=/path/to/file` | Optionally specify a file containing the public key (works with docker secrets). | -| `-e SUDO_ACCESS=false` | Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `SUDO_PASSWORD` set, this will allow passwordless sudo access. | -| `-e SUDO_PASSWORD=password` | Optionally set a sudo password for `abc`, the ssh user. If this or `SUDO_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access. | -| `-e SUDO_PASSWORD_FILE=/path/to/file` | Optionally specify a file that contains the password. This setting supersedes the `SUDO_PASSWORD` option (works with docker secrets). | +| `-e SUDO_ACCESS=false` | Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `USER_PASSWORD` set, this will allow passwordless sudo access. | +| `-e PASSWORD_ACCESS=false` | Set to `true` to allow user/password ssh access you will want to set `USER_PASSWORD` or `USER_PASSWORD_FILE` as well. | +| `-e USER_PASSWORD=password` | Optionally set a sudo password for `abc`, the ssh user. If this or `USER_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access. | +| `-e USER_PASSWORD_FILE=/path/to/file` | Optionally specify a file that contains the password. This setting supersedes the `USER_PASSWORD` option (works with docker secrets). | | `-e USER_NAME=linuxserver.io` | Optionally specify a user name (Default:`linuxserver.io`) | | `-v /config` | Contains all relevant configuration files. | @@ -141,12 +144,14 @@ In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as bel   ## Application Setup -If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted. +If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted. Removing `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables from docker run environment variables will not remove the keys from `authorized_keys`. `PUBLIC_KEY_FILE` can be used with docker secrets. -Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP` +We provide the ability to set and allow password based acces via the `PASSWORD_ACCESS` and `USER_PASSWORD` variables, though we as an organization discourage using password auth for public facing ssh endpoints. -Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `SUDO_PASSWORD` and `SUDO_PASSWORD_FILE` allow setting an optional sudo password. +Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP` + +Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `USER_PASSWORD` and `USER_PASSWORD_FILE` allow setting an optional sudo password. The users only have access to the folders mapped and the processes running inside this container. Add any volume mappings you like for the users to have access to. diff --git a/readme-vars.yml b/readme-vars.yml index f8aed14..7fa857e 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -40,9 +40,10 @@ opt_param_usage_include_env: true opt_param_env_vars: - { env_var: "PUBLIC_KEY", env_value: "yourpublickey", desc: "Optional ssh public key, which will automatically be added to authorized_keys."} - { env_var: "PUBLIC_KEY_FILE", env_value: "/path/to/file", desc: "Optionally specify a file containing the public key (works with docker secrets)."} - - { env_var: "SUDO_ACCESS", env_value: "false", desc: "Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `SUDO_PASSWORD` set, this will allow passwordless sudo access."} - - { env_var: "SUDO_PASSWORD", env_value: "password", desc: "Optionally set a sudo password for `abc`, the ssh user. If this or `SUDO_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access."} - - { env_var: "SUDO_PASSWORD_FILE", env_value: "/path/to/file", desc: "Optionally specify a file that contains the password. This setting supersedes the `SUDO_PASSWORD` option (works with docker secrets)."} + - { env_var: "SUDO_ACCESS", env_value: "false", desc: "Set to `true` to allow `linuxserver.io`, the ssh user, sudo access. Without `USER_PASSWORD` set, this will allow passwordless sudo access."} + - { env_var: "PASSWORD_ACCESS", env_value: "false", desc: "Set to `true` to allow user/password ssh access you will want to set `USER_PASSWORD` or `USER_PASSWORD_FILE` as well."} + - { env_var: "USER_PASSWORD", env_value: "password", desc: "Optionally set a sudo password for `abc`, the ssh user. If this or `USER_PASSWORD_FILE` are not set but `SUDO_ACCESS` is set to true, the user will have passwordless sudo access."} + - { env_var: "USER_PASSWORD_FILE", env_value: "/path/to/file", desc: "Optionally specify a file that contains the password. This setting supersedes the `USER_PASSWORD` option (works with docker secrets)."} - { env_var: "USER_NAME", env_value: "linuxserver.io", desc: "Optionally specify a user name (Default:`linuxserver.io`)"} optional_block_1: false @@ -51,12 +52,14 @@ optional_block_1_items: "" # application setup block app_setup_block_enabled: true app_setup_block: | - If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted. + If `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables are set, they will automatically be added to `authorized_keys`. If not, the keys can manually be added to `/config/.ssh/authorized_keys` and the container should be restarted. Removing `PUBLIC_KEY` or `PUBLIC_KEY_FILE` variables from docker run environment variables will not remove the keys from `authorized_keys`. `PUBLIC_KEY_FILE` can be used with docker secrets. - Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP` + We provide the ability to set and allow password based acces via the `PASSWORD_ACCESS` and `USER_PASSWORD` variables, though we as an organization discourage using password auth for public facing ssh endpoints. - Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `SUDO_PASSWORD` and `SUDO_PASSWORD_FILE` allow setting an optional sudo password. + Connect to server via `ssh -i /path/to/private/key -p PORT USER_NAME@SERVERIP` + + Setting `SUDO_ACCESS` to `true` by itself will allow passwordless sudo. `USER_PASSWORD` and `USER_PASSWORD_FILE` allow setting an optional sudo password. The users only have access to the folders mapped and the processes running inside this container. Add any volume mappings you like for the users to have access to. diff --git a/root/etc/cont-init.d/50-config b/root/etc/cont-init.d/50-config index 6356be1..5d99964 100644 --- a/root/etc/cont-init.d/50-config +++ b/root/etc/cont-init.d/50-config @@ -6,12 +6,12 @@ mkdir -p \ USER_NAME=${USER_NAME:-linuxserver.io} echo "User name is set to $USER_NAME" -sed -i "s/su linuxserver.io linuxserver.io/su ${USER_NAME} ${USER_NAME}" /etc/logrotate.d/openssh +sed -i "s/su linuxserver.io linuxserver.io/su ${USER_NAME} ${USER_NAME}/g" /etc/logrotate.d/openssh # set password for abc to unlock it and set sudo access sed -i "/${USER_NAME} ALL.*/d" /etc/sudoers if [ "$SUDO_ACCESS" == "true" ]; then - if [ -n "$SUDO_PASSWORD" ] || [ -n "$SUDO_PASSWORD_FILE" -a -f "$SUDO_PASSWORD_FILE" ]; then + if [ -n "$USER_PASSWORD" ] || [ -n "$USER_PASSWORD_FILE" -a -f "$USER_PASSWORD_FILE" ]; then echo "${USER_NAME} ALL=(ALL) ALL" >> /etc/sudoers echo "Sudo is enabled with password." else @@ -21,13 +21,13 @@ if [ "$SUDO_ACCESS" == "true" ]; then else echo "Sudo is disabled." fi - -[[ -n "$SUDO_PASSWORD_FILE" ]] && [[ -f "$SUDO_PASSWORD_FILE" ]] && \ - SUDO_PASSWORD=$(cat "$SUDO_PASSWORD_FILE") && \ +[[ -n "$USER_PASSWORD_FILE" ]] && [[ -f "$USER_PASSWORD_FILE" ]] && \ + USER_PASSWORD=$(cat "$USER_PASSWORD_FILE") && \ echo "Sudo password is retrieved from file." -SUDO_PASSWORD=${SUDO_PASSWORD:-$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-8};echo;)} -echo "${USER_NAME}:${SUDO_PASSWORD}" | chpasswd +USER_PASSWORD=${USER_PASSWORD:-$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-8};echo;)} +echo "${USER_NAME}:${USER_PASSWORD}" | chpasswd +# symlink out ssh config directory if [ ! -L /etc/ssh ];then if [ ! -f /config/ssh_host_keys/sshd_config ]; then sed -i '/#PidFile/c\PidFile \/config\/sshd.pid' /etc/ssh/sshd_config @@ -38,6 +38,20 @@ if [ ! -L /etc/ssh ];then ssh-keygen -A fi +# password access +if [ "$PASSWORD_ACCESS" == "true" ]; then + sed -i '/^PasswordAuthentication/c\PasswordAuthentication yes' /etc/ssh/sshd_config + sed -i '/UsePAM/c\UsePAM yes' /etc/ssh/sshd_config + chown root:"${USER_NAME}" \ + /etc/shadow +else + sed -i '/^PasswordAuthentication/c\PasswordAuthentication no' /etc/ssh/sshd_config + sed -i '/UsePAM/c\UsePAM no' /etc/ssh/sshd_config + chown root:root \ + /etc/shadow +fi + +# set key auth in file if [ ! -f /config/.ssh/authorized_keys ];then touch /config/.ssh/authorized_keys fi