gitlabFork/ISPConfig3.git - Solinfo Gitblit

Marius Burkard

2016-04-20 4569cae57f127afd093794310ccd290d2d9fdf36

commit \| author \| age
396f0e	1	<?php
T	2
	3	/*
	4	Copyright (c) 2007, Till Brehm, projektfarm Gmbh
	5	All rights reserved.
	6
	7	Redistribution and use in source and binary forms, with or without modification,
	8	are permitted provided that the following conditions are met:
	9
	10	* Redistributions of source code must retain the above copyright notice,
	11	this list of conditions and the following disclaimer.
	12	* Redistributions in binary form must reproduce the above copyright notice,
	13	this list of conditions and the following disclaimer in the documentation
	14	and/or other materials provided with the distribution.
	15	* Neither the name of ISPConfig nor the names of its contributors
	16	may be used to endorse or promote products derived from this software without
	17	specific prior written permission.
	18
	19	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
	20	ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	21	WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	22	IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
	23	INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
	24	BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	25	DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	26	OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	27	NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
	28	EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	29	*/
	30
	31	class shelluser_jailkit_plugin {
7fe908	32
396f0e	33	//* $plugin_name and $class_name have to be the same then the name of this class
T	34	var $plugin_name = 'shelluser_jailkit_plugin';
	35	var $class_name = 'shelluser_jailkit_plugin';
b79d24	36	var $min_uid = 499;
7fe908	37
396f0e	38	//* This function is called during ispconfig installation to determine
T	39	// if a symlink shall be created for this plugin.
	40	function onInstall() {
	41	global $conf;
7fe908	42
396f0e	43	if($conf['services']['web'] == true) {
T	44	return true;
	45	} else {
	46	return false;
	47	}
7fe908	48
396f0e	49	}
7fe908	50
MC	51
396f0e	52	/*
T	53	This function is called when the plugin is loaded
	54	*/
7fe908	55
396f0e	56	function onLoad() {
T	57	global $app;
7fe908	58
396f0e	59	/*
T	60	Register for the events
	61	*/
9edea9	62
7fe908	63	$app->plugins->registerEvent('shell_user_insert', $this->plugin_name, 'insert');
MC	64	$app->plugins->registerEvent('shell_user_update', $this->plugin_name, 'update');
	65	$app->plugins->registerEvent('shell_user_delete', $this->plugin_name, 'delete');
9edea9	66
7fe908	67
396f0e	68	}
7fe908	69
396f0e	70	//* This function is called, when a shell user is inserted in the database
7fe908	71	function insert($event_name, $data) {
396f0e	72	global $app, $conf;
7fe908	73
9edea9	74	$app->uses('system,getconf');
TB	75
	76	$security_config = $app->getconf->get_security_config('permissions');
	77	if($security_config['allow_shell_user'] != 'yes') {
	78	$app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
	79	return false;
	80	}
	81
	82
cc7a82	83	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ?", $data['new']['parent_domain_id']);
7fe908	84
64ea56	85	if(!$app->system->is_allowed_user($data['new']['username'], false, false)
MC	86	\|\| !$app->system->is_allowed_user($data['new']['puser'], true, true)
	87	\|\| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
	88	$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
	89	return false;
	90	}
	91
b79d24	92	if($app->system->is_user($data['new']['puser'])) {
FT	93	// Get the UID of the parent user
	94	$uid = intval($app->system->getuid($data['new']['puser']));
	95	if($uid > $this->min_uid) {
	96
	97	if($app->system->is_user($data['new']['username'])) {
7fe908	98
b79d24	99	/**
FT	100	* Setup Jailkit Chroot System If Enabled
	101	*/
	102
	103	if ($data['new']['chroot'] == "jailkit")
	104	{
7fe908	105
MC	106
b79d24	107	// load the server configuration options
FT	108	$app->uses("getconf");
	109	$this->data = $data;
	110	$this->app = $app;
	111	$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908	112
b79d24	113	$this->_update_website_security_level();
7fe908	114
b79d24	115	$app->system->web_folder_protection($web['document_root'], false);
7fe908	116
b79d24	117	$this->_setup_jailkit_chroot();
7fe908	118
b79d24	119	$this->_add_jailkit_user();
7fe908	120
b79d24	121	//* call the ssh-rsa update function
FT	122	$this->_setup_ssh_rsa();
7fe908	123
b79d24	124	//$command .= 'usermod -s /usr/sbin/jk_chrootsh -U '.escapeshellcmd($data['new']['username']);
FT	125	//exec($command);
	126	$app->system->usermod($data['new']['username'], 0, 0, '', '/usr/sbin/jk_chrootsh', '', '');
7fe908	127
b79d24	128	//* Unlock user
FT	129	$command = 'usermod -U '.escapeshellcmd($data['new']['username']).' 2>/dev/null';
	130	exec($command);
7fe908	131
b79d24	132	$this->_update_website_security_level();
FT	133	$app->system->web_folder_protection($web['document_root'], true);
	134	}
7fe908	135
b79d24	136	$app->log("Jailkit Plugin -> insert username:".$data['new']['username'], LOGLEVEL_DEBUG);
7fe908	137
b79d24	138	} else {
FT	139	$app->log("Jailkit Plugin -> insert username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
	140	}
	141	} else {
	142	$app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
396f0e	143	}
T	144	} else {
b79d24	145	$app->log("Skipping insertion of user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
396f0e	146	}
7fe908	147
396f0e	148	}
7fe908	149
396f0e	150	//* This function is called, when a shell user is updated in the database
7fe908	151	function update($event_name, $data) {
396f0e	152	global $app, $conf;
7fe908	153
9edea9	154	$app->uses('system,getconf');
TB	155
	156	$security_config = $app->getconf->get_security_config('permissions');
	157	if($security_config['allow_shell_user'] != 'yes') {
	158	$app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
	159	return false;
	160	}
	161
cc7a82	162	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ?", $data['new']['parent_domain_id']);
7fe908	163
64ea56	164	if(!$app->system->is_allowed_user($data['new']['username'], false, false)
MC	165	\|\| !$app->system->is_allowed_user($data['new']['puser'], true, true)
	166	\|\| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
	167	$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
	168	return false;
	169	}
	170
b79d24	171	if($app->system->is_user($data['new']['puser'])) {
FT	172	// Get the UID of the parent user
	173	$uid = intval($app->system->getuid($data['new']['puser']));
	174	if($uid > $this->min_uid) {
	175
	176
	177	if($app->system->is_user($data['new']['username'])) {
7fe908	178
b79d24	179	/**
FT	180	* Setup Jailkit Chroot System If Enabled
	181	*/
	182	if ($data['new']['chroot'] == "jailkit")
	183	{
7fe908	184
b79d24	185	// load the server configuration options
FT	186	$app->uses("getconf");
	187	$this->data = $data;
	188	$this->app = $app;
	189	$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908	190
b79d24	191	$this->_update_website_security_level();
7fe908	192
b79d24	193	$app->system->web_folder_protection($web['document_root'], false);
7fe908	194
b79d24	195	$this->_setup_jailkit_chroot();
FT	196	$this->_add_jailkit_user();
7fe908	197
b79d24	198	//* call the ssh-rsa update function
FT	199	$this->_setup_ssh_rsa();
7fe908	200
b79d24	201	$this->_update_website_security_level();
7fe908	202
b79d24	203	$app->system->web_folder_protection($web['document_root'], true);
FT	204	}
7fe908	205
b79d24	206	$app->log("Jailkit Plugin -> update username:".$data['new']['username'], LOGLEVEL_DEBUG);
7fe908	207
b79d24	208	} else {
FT	209	$app->log("Jailkit Plugin -> update username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
	210	}
	211	} else {
	212	$app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
396f0e	213	}
T	214	} else {
b79d24	215	$app->log("Skipping update for user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
396f0e	216	}
7fe908	217
396f0e	218	}
7fe908	219
396f0e	220	//* This function is called, when a shell user is deleted in the database
T	221	/**
	222	* TODO: Remove chroot user home and from the chroot passwd file
7fe908	223	*/
MC	224	function delete($event_name, $data) {
396f0e	225	global $app, $conf;
7fe908	226
9edea9	227	$app->uses('system,getconf');
TB	228
	229	$security_config = $app->getconf->get_security_config('permissions');
	230	if($security_config['allow_shell_user'] != 'yes') {
	231	$app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
	232	return false;
	233	}
7fe908	234
cc7a82	235	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ?", $data['old']['parent_domain_id']);
7fe908	236
396f0e	237	if ($data['old']['chroot'] == "jailkit")
T	238	{
	239	$app->uses("getconf");
	240	$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908	241
396f0e	242	$jailkit_chroot_userhome = $this->_get_home_dir($data['old']['username']);
7fe908	243
396f0e	244	//commented out proved to be dangerous on config errors
T	245	//exec('rm -rf '.$data['old']['dir'].$jailkit_chroot_userhome);
7fe908	246
MC	247	$app->system->web_folder_protection($web['document_root'], false);
	248
396f0e	249	if(@is_dir($data['old']['dir'].$jailkit_chroot_userhome)) {
a7e4ec	250	$userid = intval($app->system->getuid($data['old']['username']));
c65384	251	$command = 'killall -u '.escapeshellcmd($data['old']['username']).' ; userdel -f';
526b99	252	$command .= ' '.escapeshellcmd($data['old']['username']).' &> /dev/null';
396f0e	253	exec($command);
a7e4ec	254
TB	255	$this->_delete_homedir($data['old']['dir'].$jailkit_chroot_userhome,$userid,$data['old']['parent_domain_id']);
	256
7fe908	257	$app->log("Jailkit Plugin -> delete chroot home:".$data['old']['dir'].$jailkit_chroot_userhome, LOGLEVEL_DEBUG);
396f0e	258	}
7fe908	259
MC	260	$app->system->web_folder_protection($web['document_root'], true);
	261
396f0e	262	}
7fe908	263
MC	264	$app->log("Jailkit Plugin -> delete username:".$data['old']['username'], LOGLEVEL_DEBUG);
	265
	266
396f0e	267	}
7fe908	268
396f0e	269	function _setup_jailkit_chroot()
T	270	{
7fe908	271	global $app;
MC	272
	273	//check if the chroot environment is created yet if not create it with a list of program sections from the config
	274	if (!is_dir($this->data['new']['dir'].'/etc/jailkit'))
	275	{
	276	$command = '/usr/local/ispconfig/server/scripts/create_jailkit_chroot.sh';
	277	$command .= ' '.escapeshellcmd($this->data['new']['dir']);
	278	$command .= ' \''.$this->jailkit_config['jailkit_chroot_app_sections'].'\'';
	279	exec($command.' 2>/dev/null');
	280
	281	$this->app->log("Added jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
	282
	283	$this->_add_jailkit_programs();
	284
	285	//add bash.bashrc script
	286	//we need to collect the domain name to be used as the HOSTNAME in the bashrc script
cc7a82	287	$web = $this->app->db->queryOneRecord("SELECT domain FROM web_domain WHERE domain_id = ?", $this->data['new']["parent_domain_id"]);
7fe908	288
MC	289	$this->app->load('tpl');
	290
	291	$tpl = new tpl();
	292	$tpl->newTemplate("bash.bashrc.master");
	293
	294	$tpl->setVar('jailkit_chroot', true);
	295	$tpl->setVar('domain', $web['domain']);
	296	$tpl->setVar('home_dir', $this->_get_home_dir(""));
	297
	298	$bashrc = escapeshellcmd($this->data['new']['dir']).'/etc/bash.bashrc';
	299	if(@is_file($bashrc) \|\| @is_link($bashrc)) unlink($bashrc);
	300
	301	file_put_contents($bashrc, $tpl->grab());
	302	unset($tpl);
	303
d22277	304	$this->app->log("Added bashrc script: ".$bashrc, LOGLEVEL_DEBUG);
7fe908	305
MC	306	$tpl = new tpl();
	307	$tpl->newTemplate("motd.master");
	308
	309	$tpl->setVar('domain', $web['domain']);
	310
	311	$motd = escapeshellcmd($this->data['new']['dir']).'/var/run/motd';
	312	if(@is_file($motd) \|\| @is_link($motd)) unlink($motd);
	313
	314	$app->system->file_put_contents($motd, $tpl->grab());
	315
	316	}
396f0e	317	}
7fe908	318
396f0e	319	function _add_jailkit_programs()
T	320	{
d22277	321	$jailkit_chroot_app_programs = preg_split("/[\s,]+/", $this->jailkit_config['jailkit_chroot_app_programs']);
MB	322	if(is_array($jailkit_chroot_app_programs) && !empty($jailkit_chroot_app_programs)){
	323	foreach($jailkit_chroot_app_programs as $jailkit_chroot_app_program){
	324	$jailkit_chroot_app_program = trim($jailkit_chroot_app_program);
	325	if(is_file($jailkit_chroot_app_program) \|\| is_dir($jailkit_chroot_app_program)){
	326	//copy over further programs and its libraries
	327	$command = '/usr/local/ispconfig/server/scripts/create_jailkit_programs.sh';
	328	$command .= ' '.escapeshellcmd($this->data['new']['dir']);
	329	$command .= ' '.$jailkit_chroot_app_program;
	330	exec($command.' 2>/dev/null');
7fe908	331
d22277	332	$this->app->log("Added programs to jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
MB	333	}
	334	}
	335	}
396f0e	336	}
7fe908	337
396f0e	338	function _get_home_dir($username)
T	339	{
7fe908	340	return str_replace("[username]", escapeshellcmd($username), $this->jailkit_config['jailkit_chroot_home']);
396f0e	341	}
7fe908	342
396f0e	343	function _add_jailkit_user()
T	344	{
7fe908	345	global $app;
MC	346
	347	//add the user to the chroot
	348	$jailkit_chroot_userhome = $this->_get_home_dir($this->data['new']['username']);
	349	$jailkit_chroot_puserhome = $this->_get_home_dir($this->data['new']['puser']);
	350
	351	if(!is_dir($this->data['new']['dir'].'/etc')) mkdir($this->data['new']['dir'].'/etc', 0755);
	352	if(!is_file($this->data['new']['dir'].'/etc/passwd')) touch($this->data['new']['dir'].'/etc/passwd', 0755);
	353
	354	// IMPORTANT!
	355	// ALWAYS create the user. Even if the user was created before
	356	// if we check if the user exists, then a update (no shell -> jailkit) will not work
	357	// and the user has FULL ACCESS to the root of the server!
	358	$command = '/usr/local/ispconfig/server/scripts/create_jailkit_user.sh';
	359	$command .= ' '.escapeshellcmd($this->data['new']['username']);
	360	$command .= ' '.escapeshellcmd($this->data['new']['dir']);
	361	$command .= ' '.$jailkit_chroot_userhome;
	362	$command .= ' '.escapeshellcmd($this->data['new']['shell']);
	363	$command .= ' '.$this->data['new']['puser'];
	364	$command .= ' '.$jailkit_chroot_puserhome;
	365	exec($command.' 2>/dev/null');
	366
	367	//* Change the homedir of the shell user and parent user
	368	//* We have to do this manually as the usermod command fails
	369	//* when the user is logged in or a command is running under that user
	370	/*
8cf78b	371	$passwd_file_array = file('/etc/passwd');
T	372	$passwd_out = '';
	373	if(is_array($passwd_file_array)) {
	374	foreach($passwd_file_array as $line) {
	375	$line = trim($line);
	376	$parts = explode(':',$line);
	377	if($parts[0] == $this->data['new']['username']) {
	378	$parts[5] = escapeshellcmd($this->data['new']['dir'].'/.'.$jailkit_chroot_userhome);
	379	$parts[6] = escapeshellcmd('/usr/sbin/jk_chrootsh');
	380	$new_line = implode(':',$parts);
	381	copy('/etc/passwd','/etc/passwd~');
	382	chmod('/etc/passwd~',0600);
	383	$app->uses('system');
	384	$app->system->replaceLine('/etc/passwd',$line,$new_line,1,0);
	385	}
	386	}
ff6a68	387	}*/
7fe908	388
a71305	389	$shell = '/usr/sbin/jk_chrootsh';
MB	390	if($this->data['new']['active'] != 'y') $shell = '/bin/false';
	391
	392	$app->system->usermod($this->data['new']['username'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, $shell);
7fe908	393	$app->system->usermod($this->data['new']['puser'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, '/usr/sbin/jk_chrootsh');
MC	394
	395	$this->app->log("Added jailkit user to chroot with command: ".$command, LOGLEVEL_DEBUG);
	396
	397	if(!is_dir($this->data['new']['dir'].$jailkit_chroot_userhome)) mkdir(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), 0755, true);
	398	$app->system->chown(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), $this->data['new']['username']);
	399	$app->system->chgrp(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), $this->data['new']['pgroup']);
	400
	401	$this->app->log("Added created jailkit user home in : ".$this->data['new']['dir'].$jailkit_chroot_userhome, LOGLEVEL_DEBUG);
	402
	403	if(!is_dir($this->data['new']['dir'].$jailkit_chroot_puserhome)) mkdir(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), 0755, true);
	404	$app->system->chown(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), $this->data['new']['puser']);
	405	$app->system->chgrp(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), $this->data['new']['pgroup']);
	406
	407	$this->app->log("Added jailkit parent user home in : ".$this->data['new']['dir'].$jailkit_chroot_puserhome, LOGLEVEL_DEBUG);
	408
8cf78b	409
396f0e	410	}
7fe908	411
8db8f3	412	//* Update the website root directory permissions depending on the security level
T	413	function _update_website_security_level() {
7fe908	414	global $app, $conf;
MC	415
8db8f3	416	// load the server configuration options
T	417	$app->uses("getconf");
	418	$web_config = $app->getconf->get_server_config($conf["server_id"], 'web');
7fe908	419
8db8f3	420	// Get the parent website of this shell user
cc7a82	421	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ?", $this->data['new']['parent_domain_id']);
7fe908	422
8db8f3	423	//* If the security level is set to high
ff6a68	424	if($web_config['security_level'] == 20 && is_array($web)) {
7fe908	425	$app->system->web_folder_protection($web["document_root"], false);
MC	426	$app->system->chmod($web["document_root"], 0755);
	427	$app->system->chown($web["document_root"], 'root');
	428	$app->system->chgrp($web["document_root"], 'root');
	429	$app->system->web_folder_protection($web["document_root"], true);
8db8f3	430	}
7fe908	431
8db8f3	432	}
7fe908	433
07bdbd	434	//* Wrapper for exec function for easier debugging
T	435	private function _exec($command) {
	436	global $app;
7fe908	437	$app->log('exec: '.$command, LOGLEVEL_DEBUG);
07bdbd	438	exec($command);
T	439	}
396f0e	440
00a055	441	private function _setup_ssh_rsa() {
8ab3cd	442	global $app;
7fe908	443	$this->app->log("ssh-rsa setup shelluser_jailkit", LOGLEVEL_DEBUG);
00a055	444	// Get the client ID, username, and the key
cc7a82	445	$domain_data = $this->app->db->queryOneRecord('SELECT sys_groupid FROM web_domain WHERE web_domain.domain_id = ?', $this->data['new']['parent_domain_id']);
MC	446	$sys_group_data = $this->app->db->queryOneRecord('SELECT * FROM sys_group WHERE sys_group.groupid = ?', $domain_data['sys_groupid']);
00a055	447	$id = intval($sys_group_data['client_id']);
L	448	$username= $sys_group_data['name'];
cc7a82	449	$client_data = $this->app->db->queryOneRecord('SELECT * FROM client WHERE client.client_id = ?', $id);
00a055	450	$userkey = $client_data['ssh_rsa'];
L	451	unset($domain_data);
	452	unset($client_data);
7fe908	453
00a055	454	// ssh-rsa authentication variables
8ab3cd	455	$sshrsa = $this->data['new']['ssh_rsa'];
00a055	456	$usrdir = escapeshellcmd($this->data['new']['dir']).'/'.$this->_get_home_dir($this->data['new']['username']);
8ab3cd	457	$sshdir = $usrdir.'/.ssh';
T	458	$sshkeys= $usrdir.'/.ssh/authorized_keys';
7fe908	459
8ab3cd	460	$app->uses('file');
T	461	$sshrsa = $app->file->unix_nl($sshrsa);
7fe908	462	$sshrsa = $app->file->remove_blank_lines($sshrsa, 0);
MC	463
00a055	464	// If this user has no key yet, generate a pair
8ab3cd	465	if ($userkey == '' && $id > 0){
00a055	466	//Generate ssh-rsa-keys
L	467	exec('ssh-keygen -t rsa -C '.$username.'-rsa-key-'.time().' -f /tmp/id_rsa -N ""');
7fe908	468
8ab3cd	469	// use the public key that has been generated
4bd960	470	$userkey = $app->system->file_get_contents('/tmp/id_rsa.pub');
7fe908	471
00a055	472	// save keypair in client table
cc7a82	473	$this->app->db->query("UPDATE client SET created_at = UNIX_TIMESTAMP(), id_rsa = ? ssh_rsa = ? WHERE client_id = ?", $app->system->file_get_contents('/tmp/id_rsa'), $userkey, $id);
8ab3cd	474
4bd960	475	$app->system->unlink('/tmp/id_rsa');
T	476	$app->system->unlink('/tmp/id_rsa.pub');
7fe908	477	$this->app->log("ssh-rsa keypair generated for ".$username, LOGLEVEL_DEBUG);
00a055	478	};
7fe908	479
8ab3cd	480	if (!file_exists($sshkeys)){
00a055	481	// add root's key
8ab3cd	482	$app->file->mkdirs($sshdir, '0755');
4bd960	483	if(is_file('/root/.ssh/authorized_keys')) $app->system->file_put_contents($sshkeys, $app->system->file_get_contents('/root/.ssh/authorized_keys'));
7fe908	484
8ab3cd	485	// Remove duplicate keys
26c0fc	486	$existing_keys = @file($sshkeys);
8ab3cd	487	$new_keys = explode("\n", $userkey);
26c0fc	488	$final_keys_arr = @array_merge($existing_keys, $new_keys);
8ab3cd	489	$new_final_keys_arr = array();
T	490	if(is_array($final_keys_arr) && !empty($final_keys_arr)){
	491	foreach($final_keys_arr as $key => $val){
	492	$new_final_keys_arr[$key] = trim($val);
	493	}
	494	}
	495	$final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
7fe908	496
00a055	497	// add the user's key
8ab3cd	498	file_put_contents($sshkeys, $final_keys);
T	499	$app->file->remove_blank_lines($sshkeys);
7fe908	500	$this->app->log("ssh-rsa authorisation keyfile created in ".$sshkeys, LOGLEVEL_DEBUG);
00a055	501	}
8cf78b	502	//* Get the keys
T	503	$existing_keys = file($sshkeys);
	504	$new_keys = explode("\n", $sshrsa);
7fe908	505	$old_keys = explode("\n", $this->data['old']['ssh_rsa']);
MC	506
8cf78b	507	//* Remove all old keys
T	508	if(is_array($old_keys)) {
	509	foreach($old_keys as $key => $val) {
7fe908	510	$k = array_search(trim($val), $existing_keys);
8cf78b	511	unset($existing_keys[$k]);
T	512	}
00a055	513	}
7fe908	514
8cf78b	515	//* merge the remaining keys and the ones fom the ispconfig database.
T	516	if(is_array($new_keys)) {
	517	$final_keys_arr = array_merge($existing_keys, $new_keys);
	518	} else {
	519	$final_keys_arr = $existing_keys;
	520	}
7fe908	521
8cf78b	522	$new_final_keys_arr = array();
T	523	if(is_array($final_keys_arr) && !empty($final_keys_arr)){
	524	foreach($final_keys_arr as $key => $val){
	525	$new_final_keys_arr[$key] = trim($val);
	526	}
	527	}
	528	$final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
7fe908	529
MC	530	// add the custom key
4bd960	531	$app->system->file_put_contents($sshkeys, $final_keys);
8cf78b	532	$app->file->remove_blank_lines($sshkeys);
7fe908	533	$this->app->log("ssh-rsa key updated in ".$sshkeys, LOGLEVEL_DEBUG);
MC	534
00a055	535	// set proper file permissions
8cf78b	536	exec("chown -R ".escapeshellcmd($this->data['new']['puser']).":".escapeshellcmd($this->data['new']['pgroup'])." ".$sshdir);
T	537	exec("chmod 700 ".$sshdir);
00a055	538	exec("chmod 600 '$sshkeys'");
7fe908	539
00a055	540	}
a7e4ec	541
TB	542	private function _delete_homedir($homedir,$userid,$parent_domain_id) {
	543	global $app, $conf;
	544
	545	// check if we have to delete the dir
cc7a82	546	$check = $app->db->queryOneRecord('SELECT shell_user_id FROM `shell_user` WHERE `dir` = ?', $homedir);
a7e4ec	547
TB	548	if(!$check && is_dir($homedir)) {
cc7a82	549	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ?", $parent_domain_id);
a7e4ec	550	$app->system->web_folder_protection($web['document_root'], false);
TB	551
	552	// delete dir
	553	if(substr($homedir, -1) !== '/') $homedir .= '/';
	554	$files = array('.bash_logout', '.bash_history', '.bashrc', '.profile');
65a0b9	555	$dirs = array('.ssh', '.cache');
a7e4ec	556	foreach($files as $delfile) {
TB	557	if(is_file($homedir . $delfile) && fileowner($homedir . $delfile) == $userid) unlink($homedir . $delfile);
	558	}
	559	foreach($dirs as $deldir) {
	560	if(is_dir($homedir . $deldir) && fileowner($homedir . $deldir) == $userid) exec('rm -rf ' . escapeshellarg($homedir . $deldir));
	561	}
	562	$empty = true;
	563	$dirres = opendir($homedir);
	564	if($dirres) {
	565	while(($entry = readdir($dirres)) !== false) {
	566	if($entry != '.' && $entry != '..') {
	567	$empty = false;
	568	break;
	569	}
	570	}
	571	closedir($dirres);
	572	}
	573	if($empty == true) {
	574	rmdir($homedir);
	575	}
	576	unset($files);
	577	unset($dirs);
	578
	579	$app->system->web_folder_protection($web['document_root'], true);
	580	}
	581
	582	}
7fe908	583
396f0e	584	} // end class
T	585
8e725d	586	?>