diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc index 0d695055ea..3bb00e7e4e 100644 --- a/etc/inc/auth.inc +++ b/etc/inc/auth.inc @@ -187,8 +187,8 @@ function local_user_set(& $user) { $user_group = "nobody"; /* configure shell type */ - if (!hasPrivilegeShell($user)) { - if (!hasPrivilegeCopyFiles($user)) + if (!userHasPrivilege($user, "user-shell-access")) { + if (!userHasPrivilege($user, "user-copy-files")) $user_shell = "/sbin/nologin"; else $user_shell = "/usr/local/bin/scponly"; @@ -227,14 +227,17 @@ function local_user_set(& $user) { /* create user directory if required */ if (!is_dir($user_home)) - mkdir($user_home, 0755); + mkdir($user_home, 0700); chown($user_home, $user_name); chgrp($user_home, $user_group); - chmod($user_home, 0700); - /* FIXME : ssh keys should be per-admin user */ - if(isset($config['system']['ssh']['sshdkeyonly']) && hasPrivilegeShell($user)) - create_authorized_keys($user_name, $user_home); + /* write out ssh authorized key file */ + if($user['authorizedkeys']) { + if (!is_dir("{$user_home}/.ssh")) + mkdir("{$user_home}/.ssh", 0700); + $keys = base64_decode($user['authorizedkeys']); + file_put_contents("{$user_home}/.ssh/authorized_keys", $keys); + } } function local_user_del($user) { diff --git a/etc/inc/config.inc b/etc/inc/config.inc index da5bea6cdc..62a6a89130 100644 --- a/etc/inc/config.inc +++ b/etc/inc/config.inc @@ -1926,6 +1926,42 @@ endif; $config['version'] = "5.2"; } + /* Convert 5.2 -> 5.3 */ + if ($config['version'] <= 5.2) { + + if (!is_array($config['system']['ca'])) + $config['system']['ca'] = array(); + if (!is_array($config['system']['cert'])) + $config['system']['cert'] = array(); + + /* migrate advanced admin page webui ssl to certifcate mngr */ + if ($config['system']['webgui']['certificate'] && + $config['system']['webgui']['private-key']) { + + /* create cert entry */ + $cert = array(); + $cert['refid'] = uniqid(); + $cert['name'] = "webConfigurator SSL Certificate"; + $cert['crt'] = $config['system']['webgui']['certificate']; + $cert['prv'] = $config['system']['webgui']['private-key']; + $config['system']['cert'][] = $cert; + + /* create cert reference */ + unset($config['system']['webgui']['certificate']); + unset($config['system']['webgui']['private-key']); + $config['system']['webgui']['ssl-certref'] = $cert['refid']; + } + + /* migrate advanced admin page ssh keys to user manager */ + if ($config['system']['ssh']['authorizedkeys']) { + $admin_user =& getUserEntryByUID(0); + $admin_user['authorizedkeys'] = $config['system']['ssh']['authorizedkeys']; + unset($config['system']['ssh']['authorizedkeys']); + } + + $config['version'] = "5.3"; + } + $now = date("H:i:s"); log_error("Ended Configuration upgrade at $now"); diff --git a/etc/inc/priv.inc b/etc/inc/priv.inc index 89701aa099..824ea7bd55 100644 --- a/etc/inc/priv.inc +++ b/etc/inc/priv.inc @@ -279,20 +279,4 @@ function userHasPrivilege($userent, $privid = false) { return true; } -function hasPrivilegeLock($userent) { - return userHasPrivilege($userent, "user-lock-webcfg"); -} - -function hasPrivilegeLockPages($userent) { - return userHasPrivilege($userent, "user-lock-ipages"); -} - -function hasPrivilegeShell($userent) { - return userHasPrivilege($userent, "user-shell-access"); -} - -function hasPrivilegeCopyFiles($userent) { - return userHasPrivilege($userent, "user-copy-files"); -} - ?> diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 3b19b48da3..0a4c5d1f4a 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -496,72 +496,30 @@ function system_webgui_start() { chdir($g['www_path']); + /* defaults */ + $portarg = "80"; + $crt = ""; + $key = ""; + /* non-standard port? */ if ($config['system']['webgui']['port']) $portarg = "{$config['system']['webgui']['port']}"; - else - $portarg = ""; if ($config['system']['webgui']['protocol'] == "https") { - if(!$config['system']['webgui']['port']) - $portarg = "443"; - - if ($config['system']['webgui']['certificate'] && $config['system']['webgui']['private-key']) { - $cert = base64_decode($config['system']['webgui']['certificate']); - $key = base64_decode($config['system']['webgui']['private-key']); - } else { - /* default certificate/key */ - $cert = << 0) write_config($changedesc); - if ($restart_webgui) { - global $_SERVER; - list($host) = explode(":", $_SERVER['HTTP_HOST']); - if ($config['system']['webgui']['port']) { - $url="{$config['system']['webgui']['protocol']}://{$host}:{$config['system']['webgui']['port']}/system.php"; - } else { - $url = "{$config['system']['webgui']['protocol']}://{$host}/system.php"; - } - } - $retval = 0; config_lock(); $retval = system_hostname_configure(); @@ -206,8 +186,6 @@ if ($_POST) { config_unlock(); $savemsg = get_std_save_message($retval); - if ($restart_webgui) - $savemsg .= "
One moment...redirecting to {$url} in 10 seconds."; } } @@ -294,20 +272,6 @@ include("head.inc"); the DNS forwarder). They will not be assigned to DHCP and PPTP VPN clients, though.

- - webConfigurator protocol - > - HTTP     > - HTTPS - - - webConfigurator port - -
- Enter a custom port number for the webConfigurator - above if you want to override the default (80 for HTTP, 443 - for HTTPS). Changes will take effect immediately after save. - Time zone + + onClick="prot_change()"> + HTTP +     + onClick="prot_change()"> + HTTPS +
- Paste a signed certificate in X.509 PEM format here. Create certificates automatically. + No Certificates have been defined. You must + Create or Import + a Certificate before SSL can be enabled. + + + + + SSL Certificate + + - Key - - -
- Paste an RSA private key in PEM format here. + TCP port + + +
+ + Enter a custom port number for the webConfigurator + above if you want to override the default (80 for HTTP, 443 + for HTTPS). Changes will take effect immediately after save. + @@ -246,9 +312,9 @@ include("head.inc"); /> Disable Password login for Secure Shell (rsa key only)
- When this option is enabled, you will need to configure - allowed keys for each user that has secure shell - access. + When enabled, authorized keys need to be configured for each + user + that has been granted secure shell access. @@ -259,14 +325,6 @@ include("head.inc"); Note: Leave this blank for the default of 22 - - - - -
- Paste an authorized keys file here. - -   @@ -311,22 +369,35 @@ include("head.inc"); + +"; +?> diff --git a/usr/local/www/system_usermanager.php b/usr/local/www/system_usermanager.php index 54265244ff..cdb2c35ac5 100644 --- a/usr/local/www/system_usermanager.php +++ b/usr/local/www/system_usermanager.php @@ -197,12 +197,7 @@ if (isAllowedPage("system_usermanager")) { } } - if(is_array($_POST['groups'])) - foreach($_POST['groups'] as $groupname) - if ($pconfig['utype'] <> "system" && !isset($groupindex[$groupname])) - $input_errors[] = gettext("group {$groupname} does not exist, please define the group before assigning users."); - - if (isset($config['system']['ssh']['sshdkeyonly']) && empty($_POST['authorizedkeys'])) + if (isset($config['system']['ssh']['sshdkeyonly']) && empty($_POST['authorizedkeys'])) $input_errors[] = gettext("You must provide an authorized key otherwise you won't be able to login into this system."); /* if this is an AJAX caller then handle via JSON */ @@ -216,6 +211,8 @@ if (isAllowedPage("system_usermanager")) { if (isset($id) && $a_user[$id]) $userent = $a_user[$id]; + isset($_POST['utype']) ? $userent['scope'] = $_POST['utype'] : $userent['scope'] = "system"; + /* the user name was modified */ if ($_POST['usernamefld'] <> $_POST['oldusername']) $_SERVER['REMOTE_USER'] = $_POST['usernamefld']; @@ -226,11 +223,7 @@ if (isAllowedPage("system_usermanager")) { $userent['name'] = $_POST['usernamefld']; $userent['fullname'] = $_POST['fullname']; - - isset($_POST['utype']) ? $userent['scope'] = $_POST['utype'] : $userent['scope'] = "system"; - - if(isset($config['system']['ssh']['sshdkeyonly'])) - $userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']); + $userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']); if (isset($id) && $a_user[$id]) $a_user[$id] = $userent; @@ -367,20 +360,6 @@ function presubmit() { - - - - - - - -
- - - - - - @@ -551,6 +530,14 @@ function presubmit() { + + + + +
+ + +