updated structure

2026-07-24 06:22:31 +10:00
parent 5361a82634
commit a6a419bad7
34 changed files with 3834 additions and 0 deletions
@@ -0,0 +1,82 @@
+#!/bin/bash
+# Create a Linux system user for SSH access and sudo, and install their
+# authorized SSH public key. Run this before harden-ssh.sh so that
+# key-based access is in place before password authentication is disabled.
+#
+# Idempotent - safe to re-run. Run as root on the PVE host.
+#
+# Usage:
+#   ./setup-linux-admin-user.sh <username> <ssh-public-key>
+#   ./setup-linux-admin-user.sh <username> --key-file <path-to-.pub>
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+USERNAME="${1:-}"
+if [ -z "$USERNAME" ]; then
+    echo "Usage: $0 <username> <ssh-public-key>" >&2
+    echo "       $0 <username> --key-file <path-to-.pub>" >&2
+    exit 1
+fi
+
+shift
+SSH_KEY=""
+if [ "${1:-}" = "--key-file" ]; then
+    KEY_FILE="${2:-}"
+    [ -z "$KEY_FILE" ] && { echo "ERROR: --key-file requires a path." >&2; exit 1; }
+    [ -f "$KEY_FILE" ] || { echo "ERROR: key file not found: $KEY_FILE" >&2; exit 1; }
+    SSH_KEY="$(cat "$KEY_FILE")"
+else
+    SSH_KEY="${1:-}"
+fi
+
+if [ -z "$SSH_KEY" ]; then
+    echo "ERROR: an SSH public key is required (key string or --key-file <path>)." >&2
+    exit 1
+fi
+
+if ! echo "$SSH_KEY" | grep -qE '^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp[0-9]+) [A-Za-z0-9+/=]'; then
+    echo "ERROR: argument doesn't look like a valid SSH public key." >&2
+    exit 1
+fi
+
+# --- create Linux user if missing ---
+if id "$USERNAME" >/dev/null 2>&1; then
+    echo "User '${USERNAME}' already exists - skipping useradd."
+else
+    useradd --create-home --shell /bin/bash "$USERNAME"
+    echo "Created Linux user '${USERNAME}'."
+fi
+
+# --- sudo group membership ---
+if id -nG "$USERNAME" | grep -qw sudo; then
+    echo "User '${USERNAME}' is already in the sudo group."
+else
+    usermod --append --groups sudo "$USERNAME"
+    echo "Added '${USERNAME}' to the sudo group."
+fi
+
+# --- install authorized SSH key ---
+HOME_DIR="$(getent passwd "$USERNAME" | cut -d: -f6)"
+SSH_DIR="${HOME_DIR}/.ssh"
+AUTH_FILE="${SSH_DIR}/authorized_keys"
+
+mkdir -p "$SSH_DIR"
+chmod 700 "$SSH_DIR"
+touch "$AUTH_FILE"
+chmod 600 "$AUTH_FILE"
+chown -R "${USERNAME}:${USERNAME}" "$SSH_DIR"
+
+if grep -qF "$SSH_KEY" "$AUTH_FILE" 2>/dev/null; then
+    echo "SSH key is already present in ${AUTH_FILE}."
+else
+    echo "$SSH_KEY" >> "$AUTH_FILE"
+    echo "Installed SSH key in ${AUTH_FILE}."
+fi
+
+echo
+echo "Linux user '${USERNAME}' is ready for SSH key-based login with sudo access."
+echo "Next: run setup-admin-sudo.sh ${USERNAME} to grant NOPASSWD for pvesh/qm/pct."