clowncar

#! /bin/bash
# clowncar (BASH script) -- wrapper for useradd that manages SSH public key
#
# Version: 1.3
# Copyright: (c) 2014 Alastair Irvine <alastair@plug.org.au>
# Keywords: ssh security user
# Notice: Can cause security weaknesses in some cases.  See Warnings below.
# Licence: This file is released under the GNU General Public License
#
# Description:
# clowncar accepts all useradd options, and a few of its own (which must come
# first on the command line).  In addition, it accepts an SSH public key on
# standard input.  This is prompted for if stdin is a terminal.
#
# When the user is (eventually) created, .ssh/authorized_keys will be created
# in the user's home directory, containing the supplied public key.  This will
# work even if the user already exists, and even if they already have a
# .ssh/authorized_keys file (but not if the same key is already present).
#
# The script operates in one of two modes.  By default, "clowncar mode" is
# used; this creates a user immediately, on the system it is being run on.
# clowncar must be run as root in this case.
#
# If -O is supplied, "clowncar factory mode" is used; this accepts similar
# useradd options as the other mode, but does not create a user.  (Therefore
# root isn't required.)  Instead, it creates a script (e.g. clowncar-bill) that
# has those options and the public key "baked in", which will create the user when
# run without options.
#
# Because clowncar is mostly used for creating accounts for people, by default
# it will create the user with an (unlocked) empty password and mark it as
# expired so that the user will be prompted to set a new password when they log
# in.  (The session will close after setting the password so they'll need to
# log in again.)  This was a conscious trade-off between security and
# usability, and might not be appropriate for all use cases; see the -L option.
# HUGE WARNING:
#   On non-Debian systems, edit /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth-ac
#   and remove the "nullok" keyword.  This prevents other users on the system
#   from using "su" etc. to switch to the new user without having to put in a
#   password.
#   (/etc/pam.d/common-auth on Debian/Ubuntu doesn't suffer from this problem.)
# WARNING:
#   It is highly recommended to ensure that /etc/ssh/sshd_config contains
#   "PermitEmptyPasswords no", which it does by default on most systems.
#
# WARNING:
#   It is highly recommended to ensure that the user has logged in (and
#   therefore been forced to set a password).
#
# Options:
#   -L   Create the account with a locked & empty password (default useradd behaviour)
#   -O <output_filename>     Instead of running the commands, save them to a script file
#   -P <file.yml>            Generate an Ansible playbook to create the user
#   -V   (debug mode) Displays the command line before execution (amongst other things)
#
#
# Licence details:
#     This program is free software; you can redistribute it and/or modify
#     it under the terms of the GNU General Public License as published by
#     the Free Software Foundation; either version 2 of the License, or (at
#     your option) any later version.
#
#     See http://www.gnu.org/licenses/gpl-2.0.html for more information.
#
#     You can find the complete text of the GPLv2 in the file
#     /usr/share/common-licenses/GPL-2 on Debian systems.
#     Or see the file COPYING in the same directory as this program.
#
#
# TO-DO:
#   + Provide option to fail if user already exists
#   + Handle cases where group is missing when -g is specified, and vice versa
#       - if -g present, specifies group
#       - if -N present, read GROUP (default=100) from /etc/default/useradd
#       - if -U present, group is username
#       - if none present, read USERGROUPS_ENAB from /etc/login.defs: yes=-U; no=-N

self=$0
## ... clowncar

USERADD=/usr/sbin/useradd


# creates a version of this script that acts similarly, but has the parameters
# and SSH key "baked in"
clowncar_factory()
{
  # Wrap args in single quotes.  For each existing single quote within an arg,
  #   1) end quoting
  #   2) inserted a backslash-quoted single quote
  #   3) restart quoting
  # Note that the first argument doesn't have a single quote added, because
  # that's done by the concatenation of subsequent arguments.
  args="'${1//\'/\'\\\'\'}"
  shift
  if [ $debug -gt 0 ] ; then echo "$args" ; fi

  for arg ; do
    args="$args' '${arg//\'/\'\\\'\'}"
    if [ $debug -gt 0 ] ; then echo "$args" ; fi
  done

  # Add the final argument's single quote
  args="$args'"

  # Splice all info currently held into the output
  sed -e "s%^set_ssh_key$%ssh_key='$ssh_key'%" \
      -e "2 s/clowncar/clowncar_$username/" \
      -e "/^set_ssh_key()/,/^}/ d" \
      -e "/^clowncar_factory()/,/^}/ d" \
      -e '/^# -- option handling --/ i\
set -e' \
      -e "/^# -- option handling --/,/^# == sanity checking ==/ d" \
      -e "/^# -- defaults --/,/^# -- end defaults --/ c\\
locked=$locked\n\
username=$username\n\
set -- $args" \
    $self > "$output_filename"
  chmod a+x "$output_filename"
}


clowncar_ansible_factory()
{
  ALLOWED_OPTIONS=c:g:G:mMs:d:u:
  ALLOWED_LONG_OPTIONS=help,verbose

  # -- function option handling --
  set -e
  orthogonal_opts=$(getopt --shell=sh --name=$SELF \
    --options=+$ALLOWED_OPTIONS --longoptions=$ALLOWED_LONG_OPTIONS -- "$@")
  eval set -- "$orthogonal_opts"
  set +e      # getopt would have already reported the error

  while [ x"$1" != x-- ] ; do
    case "$1" in
      -c) comment="$2" ; shift ;;
      -g) group="$2" ; shift ;;
      -G) groups="$2" ; shift ;;
      -m) create_home=yes ;;
      -M) create_home=no ;;
      -s) shell="$2" ; shift ;;
      -u) uid="$2" ; shift ;;
      -d) home="$2" ; shift ;;
    esac
    shift     # get rid of option (or if the inner shift already did, get rid of arg)
  done
  shift       # get rid of the "--"

  exec > "$output_filename"

  cat <<EOT1
---
  - hosts: all
    gather_facts: false
    become: true

    tasks:
      - user:
          name:        $username
EOT1

  [ -n "$comment" ] &&     echo "          comment:     '$comment'"
  [ -n "$shell" ] &&       echo "          shell:       $shell"
  [ -n "$create_home" ] && echo "          create_home: $create_home"
  [ -n "$home" ] &&        echo "          home:        $home"
  [ -n "$uid" ] &&         echo "          uid:         $uid"
  [ -n "$group" ] &&       echo "          group:       $group"
  [ -n "$groups" ] &&      echo "          groups:      $groups"

  if [ $locked = y ] ; then
    echo "          password_lock: yes"
  else
    echo "          password: ''"
  fi

  if [ $locked = n ] ; then
    cat << EOT_EXPIRE

      - command: chage -d 0 $username
EOT_EXPIRE
  fi

  cat << EOT_KEY

      - authorized_key:
          user: $username
          key:  "$ssh_key"
EOT_KEY
}


set_ssh_key()
{
  # Only prompt if running on a terminal
  if [ -t 0 ] ; then
    echo "Please paste in the desired SSH key (including command-forcing):"
  fi
  read ssh_key
}


# *** MAINLINE ***
# == pre-check ==
if [ -z "$BASH_VERSION" ] ; then
  echo "${self}: Error: script must be run as a program" >&2
  exit 4
fi

# == command-line parsing ==
# -- defaults --
locked=n
# -- end defaults --
ansible=n
debug=0

# -- option handling --
# this is handled strangely because the rest of the arguments are passed to
# useradd (which uses the following capital letter options: D, G, K, M, N, U, Z)
while [ "$1" = -L -o "$1" = -O -o "$1" = -V -o "$1" = -P ] ; do
  case "$1" in
    -O)
      output_filename="$2"
      shift   # get rid of the option; argument gets done below
      ;;
    -P)
      output_filename="$2"
      ansible=y
      shift   # get rid of the option; argument gets done below
      ;;
    -L)
      locked=y
      ;;
    -V)
      debug=1
      ;;
  esac

  shift
done

# -- argument checking --
if [ $# -lt 1 ] ; then
  echo "${self}: Error: username (and other useradd arguments) required" >&2
  exit 1
fi

set -e

# -- argument handling --
username="${@: -1}"
# ... in sh, use "eval last=\${$#}" or "for username; do : ; done" instead of the previous line

# == preparation ==
if [ -n "$output_filename" ] ; then
  set_ssh_key

  # mode switch!
  if [ $ansible = y ] ; then
    clowncar_ansible_factory "$@"
  else
    clowncar_factory "$@"
  fi
  exit $?
fi

# == sanity checking ==
# TO-DO: test for valid username

# == processing ==
if getent passwd $username > /dev/null
then
  echo "Notice: User $username already exists."
else
  echo "Creating user $username."
  $USERADD "$@"
  if [ $locked = y ] ; then
    # This isn't done by default on RedHat
    passwd -l $username
  else
    # delete the user's password and mark it as expired
    passwd -d $username
    ## passwd -e $username
    chage -d 0 $username
  fi
fi

homedir=$(getent passwd $username | cut -f6 -d:)
group=$(id --group --name $username)

if [ ! -d $homedir ] ; then
  echo "${self}: Error: User $username's home directory doesn't exist" >&2
  exit 3
fi

set_ssh_key

install_it=y
if [ -f $homedir/.ssh/authorized_keys ] ; then
  if grep -q "$ssh_key" $homedir/.ssh/authorized_keys
  then
    echo "Notice: User's key is already installed"
    install_it=n
  fi
else
  # Create an empty authorized_keys file (and the directory if needed) with the
  # correct ownership and permissions
  if [ ! -d $homedir/.ssh ] ; then
    install -o $username -g $group -d $homedir/.ssh
  fi
  install -o $username -g $group -m 600 /dev/null $homedir/.ssh/authorized_keys
fi

if [ $install_it = y ] ; then
  echo "Installing key"
  echo "$ssh_key" >> $homedir/.ssh/authorized_keys
fi