gitlabFork/ISPConfig3.git - Solinfo Gitblit

Added .cache dir to removed directories list of shell users.

Till Brehm

2014-08-14 65a0b9c10da329a4c9df4f00fb7e26ce04a3c203

commit \| author \| age
396f0e	1	<?php
T	2
	3	/*
	4	Copyright (c) 2007, Till Brehm, projektfarm Gmbh
	5	All rights reserved.
	6
	7	Redistribution and use in source and binary forms, with or without modification,
	8	are permitted provided that the following conditions are met:
	9
	10	* Redistributions of source code must retain the above copyright notice,
	11	this list of conditions and the following disclaimer.
	12	* Redistributions in binary form must reproduce the above copyright notice,
	13	this list of conditions and the following disclaimer in the documentation
	14	and/or other materials provided with the distribution.
	15	* Neither the name of ISPConfig nor the names of its contributors
	16	may be used to endorse or promote products derived from this software without
	17	specific prior written permission.
	18
	19	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
	20	ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	21	WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	22	IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
	23	INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
	24	BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	25	DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	26	OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
	27	NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
	28	EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	29	*/
	30
	31	class shelluser_jailkit_plugin {
7fe908	32
396f0e	33	//* $plugin_name and $class_name have to be the same then the name of this class
T	34	var $plugin_name = 'shelluser_jailkit_plugin';
	35	var $class_name = 'shelluser_jailkit_plugin';
b79d24	36	var $min_uid = 499;
7fe908	37
396f0e	38	//* This function is called during ispconfig installation to determine
T	39	// if a symlink shall be created for this plugin.
	40	function onInstall() {
	41	global $conf;
7fe908	42
396f0e	43	if($conf['services']['web'] == true) {
T	44	return true;
	45	} else {
	46	return false;
	47	}
7fe908	48
396f0e	49	}
7fe908	50
MC	51
396f0e	52	/*
T	53	This function is called when the plugin is loaded
	54	*/
7fe908	55
396f0e	56	function onLoad() {
T	57	global $app;
7fe908	58
396f0e	59	/*
T	60	Register for the events
	61	*/
9edea9	62
7fe908	63	$app->plugins->registerEvent('shell_user_insert', $this->plugin_name, 'insert');
MC	64	$app->plugins->registerEvent('shell_user_update', $this->plugin_name, 'update');
	65	$app->plugins->registerEvent('shell_user_delete', $this->plugin_name, 'delete');
9edea9	66
7fe908	67
396f0e	68	}
7fe908	69
396f0e	70	//* This function is called, when a shell user is inserted in the database
7fe908	71	function insert($event_name, $data) {
396f0e	72	global $app, $conf;
7fe908	73
9edea9	74	$app->uses('system,getconf');
TB	75
	76	$security_config = $app->getconf->get_security_config('permissions');
	77	if($security_config['allow_shell_user'] != 'yes') {
	78	$app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
	79	return false;
	80	}
	81
	82
ff6a68	83	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
7fe908	84
64ea56	85	if(!$app->system->is_allowed_user($data['new']['username'], false, false)
MC	86	\|\| !$app->system->is_allowed_user($data['new']['puser'], true, true)
	87	\|\| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
	88	$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
	89	return false;
	90	}
	91
b79d24	92	if($app->system->is_user($data['new']['puser'])) {
FT	93	// Get the UID of the parent user
	94	$uid = intval($app->system->getuid($data['new']['puser']));
	95	if($uid > $this->min_uid) {
	96
	97	if($app->system->is_user($data['new']['username'])) {
7fe908	98
b79d24	99	/**
FT	100	* Setup Jailkit Chroot System If Enabled
	101	*/
	102
	103	if ($data['new']['chroot'] == "jailkit")
	104	{
7fe908	105
MC	106
b79d24	107	// load the server configuration options
FT	108	$app->uses("getconf");
	109	$this->data = $data;
	110	$this->app = $app;
	111	$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908	112
b79d24	113	$this->_update_website_security_level();
7fe908	114
b79d24	115	$app->system->web_folder_protection($web['document_root'], false);
7fe908	116
b79d24	117	$this->_setup_jailkit_chroot();
7fe908	118
b79d24	119	$this->_add_jailkit_user();
7fe908	120
b79d24	121	//* call the ssh-rsa update function
FT	122	$this->_setup_ssh_rsa();
7fe908	123
b79d24	124	//$command .= 'usermod -s /usr/sbin/jk_chrootsh -U '.escapeshellcmd($data['new']['username']);
FT	125	//exec($command);
	126	$app->system->usermod($data['new']['username'], 0, 0, '', '/usr/sbin/jk_chrootsh', '', '');
7fe908	127
b79d24	128	//* Unlock user
FT	129	$command = 'usermod -U '.escapeshellcmd($data['new']['username']).' 2>/dev/null';
	130	exec($command);
7fe908	131
b79d24	132	$this->_update_website_security_level();
FT	133	$app->system->web_folder_protection($web['document_root'], true);
	134	}
7fe908	135
b79d24	136	$app->log("Jailkit Plugin -> insert username:".$data['new']['username'], LOGLEVEL_DEBUG);
7fe908	137
b79d24	138	} else {
FT	139	$app->log("Jailkit Plugin -> insert username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
	140	}
	141	} else {
	142	$app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
396f0e	143	}
T	144	} else {
b79d24	145	$app->log("Skipping insertion of user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
396f0e	146	}
7fe908	147
396f0e	148	}
7fe908	149
396f0e	150	//* This function is called, when a shell user is updated in the database
7fe908	151	function update($event_name, $data) {
396f0e	152	global $app, $conf;
7fe908	153
9edea9	154	$app->uses('system,getconf');
TB	155
	156	$security_config = $app->getconf->get_security_config('permissions');
	157	if($security_config['allow_shell_user'] != 'yes') {
	158	$app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
	159	return false;
	160	}
	161
ff6a68	162	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
7fe908	163
64ea56	164	if(!$app->system->is_allowed_user($data['new']['username'], false, false)
MC	165	\|\| !$app->system->is_allowed_user($data['new']['puser'], true, true)
	166	\|\| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
	167	$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
	168	return false;
	169	}
	170
b79d24	171	if($app->system->is_user($data['new']['puser'])) {
FT	172	// Get the UID of the parent user
	173	$uid = intval($app->system->getuid($data['new']['puser']));
	174	if($uid > $this->min_uid) {
	175
	176
	177	if($app->system->is_user($data['new']['username'])) {
7fe908	178
b79d24	179	/**
FT	180	* Setup Jailkit Chroot System If Enabled
	181	*/
	182	if ($data['new']['chroot'] == "jailkit")
	183	{
7fe908	184
b79d24	185	// load the server configuration options
FT	186	$app->uses("getconf");
	187	$this->data = $data;
	188	$this->app = $app;
	189	$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908	190
b79d24	191	$this->_update_website_security_level();
7fe908	192
b79d24	193	$app->system->web_folder_protection($web['document_root'], false);
7fe908	194
b79d24	195	$this->_setup_jailkit_chroot();
FT	196	$this->_add_jailkit_user();
7fe908	197
b79d24	198	//* call the ssh-rsa update function
FT	199	$this->_setup_ssh_rsa();
7fe908	200
b79d24	201	$this->_update_website_security_level();
7fe908	202
b79d24	203	$app->system->web_folder_protection($web['document_root'], true);
FT	204	}
7fe908	205
b79d24	206	$app->log("Jailkit Plugin -> update username:".$data['new']['username'], LOGLEVEL_DEBUG);
7fe908	207
b79d24	208	} else {
FT	209	$app->log("Jailkit Plugin -> update username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
	210	}
	211	} else {
	212	$app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
396f0e	213	}
T	214	} else {
b79d24	215	$app->log("Skipping update for user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
396f0e	216	}
7fe908	217
396f0e	218	}
7fe908	219
396f0e	220	//* This function is called, when a shell user is deleted in the database
T	221	/**
	222	* TODO: Remove chroot user home and from the chroot passwd file
7fe908	223	*/
MC	224	function delete($event_name, $data) {
396f0e	225	global $app, $conf;
7fe908	226
9edea9	227	$app->uses('system,getconf');
TB	228
	229	$security_config = $app->getconf->get_security_config('permissions');
	230	if($security_config['allow_shell_user'] != 'yes') {
	231	$app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
	232	return false;
	233	}
7fe908	234
ff6a68	235	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['old']['parent_domain_id']);
7fe908	236
396f0e	237	if ($data['old']['chroot'] == "jailkit")
T	238	{
	239	$app->uses("getconf");
	240	$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908	241
396f0e	242	$jailkit_chroot_userhome = $this->_get_home_dir($data['old']['username']);
7fe908	243
396f0e	244	//commented out proved to be dangerous on config errors
T	245	//exec('rm -rf '.$data['old']['dir'].$jailkit_chroot_userhome);
7fe908	246
MC	247	$app->system->web_folder_protection($web['document_root'], false);
	248
396f0e	249	if(@is_dir($data['old']['dir'].$jailkit_chroot_userhome)) {
a7e4ec	250	$userid = intval($app->system->getuid($data['old']['username']));
c65384	251	$command = 'killall -u '.escapeshellcmd($data['old']['username']).' ; userdel -f';
526b99	252	$command .= ' '.escapeshellcmd($data['old']['username']).' &> /dev/null';
396f0e	253	exec($command);
a7e4ec	254
TB	255	$this->_delete_homedir($data['old']['dir'].$jailkit_chroot_userhome,$userid,$data['old']['parent_domain_id']);
	256
7fe908	257	$app->log("Jailkit Plugin -> delete chroot home:".$data['old']['dir'].$jailkit_chroot_userhome, LOGLEVEL_DEBUG);
396f0e	258	}
7fe908	259
MC	260	$app->system->web_folder_protection($web['document_root'], true);
	261
396f0e	262	}
7fe908	263
MC	264	$app->log("Jailkit Plugin -> delete username:".$data['old']['username'], LOGLEVEL_DEBUG);
	265
	266
396f0e	267	}
7fe908	268
396f0e	269	function _setup_jailkit_chroot()
T	270	{
7fe908	271	global $app;
MC	272
	273	//check if the chroot environment is created yet if not create it with a list of program sections from the config
	274	if (!is_dir($this->data['new']['dir'].'/etc/jailkit'))
	275	{
	276	$command = '/usr/local/ispconfig/server/scripts/create_jailkit_chroot.sh';
	277	$command .= ' '.escapeshellcmd($this->data['new']['dir']);
	278	$command .= ' \''.$this->jailkit_config['jailkit_chroot_app_sections'].'\'';
	279	exec($command.' 2>/dev/null');
	280
	281	$this->app->log("Added jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
	282
	283	$this->_add_jailkit_programs();
	284
	285	//add bash.bashrc script
	286	//we need to collect the domain name to be used as the HOSTNAME in the bashrc script
	287	$web = $this->app->db->queryOneRecord("SELECT domain FROM web_domain WHERE domain_id = ".intval($this->data['new']["parent_domain_id"]));
	288
	289	$this->app->load('tpl');
	290
	291	$tpl = new tpl();
	292	$tpl->newTemplate("bash.bashrc.master");
	293
	294	$tpl->setVar('jailkit_chroot', true);
	295	$tpl->setVar('domain', $web['domain']);
	296	$tpl->setVar('home_dir', $this->_get_home_dir(""));
	297
	298	$bashrc = escapeshellcmd($this->data['new']['dir']).'/etc/bash.bashrc';
	299	if(@is_file($bashrc) \|\| @is_link($bashrc)) unlink($bashrc);
	300
	301	file_put_contents($bashrc, $tpl->grab());
	302	unset($tpl);
	303
	304	$this->app->log("Added bashrc script : ".$bashrc, LOGLEVEL_DEBUG);
	305
	306	$tpl = new tpl();
	307	$tpl->newTemplate("motd.master");
	308
	309	$tpl->setVar('domain', $web['domain']);
	310
	311	$motd = escapeshellcmd($this->data['new']['dir']).'/var/run/motd';
	312	if(@is_file($motd) \|\| @is_link($motd)) unlink($motd);
	313
	314	$app->system->file_put_contents($motd, $tpl->grab());
	315
	316	}
396f0e	317	}
7fe908	318
396f0e	319	function _add_jailkit_programs()
T	320	{
	321	//copy over further programs and its libraries
	322	$command = '/usr/local/ispconfig/server/scripts/create_jailkit_programs.sh';
	323	$command .= ' '.escapeshellcmd($this->data['new']['dir']);
	324	$command .= ' \''.$this->jailkit_config['jailkit_chroot_app_programs'].'\'';
526b99	325	exec($command.' 2>/dev/null');
7fe908	326
MC	327	$this->app->log("Added programs to jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
396f0e	328	}
7fe908	329
396f0e	330	function _get_home_dir($username)
T	331	{
7fe908	332	return str_replace("[username]", escapeshellcmd($username), $this->jailkit_config['jailkit_chroot_home']);
396f0e	333	}
7fe908	334
396f0e	335	function _add_jailkit_user()
T	336	{
7fe908	337	global $app;
MC	338
	339	//add the user to the chroot
	340	$jailkit_chroot_userhome = $this->_get_home_dir($this->data['new']['username']);
	341	$jailkit_chroot_puserhome = $this->_get_home_dir($this->data['new']['puser']);
	342
	343	if(!is_dir($this->data['new']['dir'].'/etc')) mkdir($this->data['new']['dir'].'/etc', 0755);
	344	if(!is_file($this->data['new']['dir'].'/etc/passwd')) touch($this->data['new']['dir'].'/etc/passwd', 0755);
	345
	346	// IMPORTANT!
	347	// ALWAYS create the user. Even if the user was created before
	348	// if we check if the user exists, then a update (no shell -> jailkit) will not work
	349	// and the user has FULL ACCESS to the root of the server!
	350	$command = '/usr/local/ispconfig/server/scripts/create_jailkit_user.sh';
	351	$command .= ' '.escapeshellcmd($this->data['new']['username']);
	352	$command .= ' '.escapeshellcmd($this->data['new']['dir']);
	353	$command .= ' '.$jailkit_chroot_userhome;
	354	$command .= ' '.escapeshellcmd($this->data['new']['shell']);
	355	$command .= ' '.$this->data['new']['puser'];
	356	$command .= ' '.$jailkit_chroot_puserhome;
	357	exec($command.' 2>/dev/null');
	358
	359	//* Change the homedir of the shell user and parent user
	360	//* We have to do this manually as the usermod command fails
	361	//* when the user is logged in or a command is running under that user
	362	/*
8cf78b	363	$passwd_file_array = file('/etc/passwd');
T	364	$passwd_out = '';
	365	if(is_array($passwd_file_array)) {
	366	foreach($passwd_file_array as $line) {
	367	$line = trim($line);
	368	$parts = explode(':',$line);
	369	if($parts[0] == $this->data['new']['username']) {
	370	$parts[5] = escapeshellcmd($this->data['new']['dir'].'/.'.$jailkit_chroot_userhome);
	371	$parts[6] = escapeshellcmd('/usr/sbin/jk_chrootsh');
	372	$new_line = implode(':',$parts);
	373	copy('/etc/passwd','/etc/passwd~');
	374	chmod('/etc/passwd~',0600);
	375	$app->uses('system');
	376	$app->system->replaceLine('/etc/passwd',$line,$new_line,1,0);
	377	}
	378	}
ff6a68	379	}*/
7fe908	380
MC	381	$app->system->usermod($this->data['new']['username'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, '/usr/sbin/jk_chrootsh');
	382	$app->system->usermod($this->data['new']['puser'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, '/usr/sbin/jk_chrootsh');
	383
	384	$this->app->log("Added jailkit user to chroot with command: ".$command, LOGLEVEL_DEBUG);
	385
	386	if(!is_dir($this->data['new']['dir'].$jailkit_chroot_userhome)) mkdir(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), 0755, true);
	387	$app->system->chown(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), $this->data['new']['username']);
	388	$app->system->chgrp(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), $this->data['new']['pgroup']);
	389
	390	$this->app->log("Added created jailkit user home in : ".$this->data['new']['dir'].$jailkit_chroot_userhome, LOGLEVEL_DEBUG);
	391
	392	if(!is_dir($this->data['new']['dir'].$jailkit_chroot_puserhome)) mkdir(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), 0755, true);
	393	$app->system->chown(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), $this->data['new']['puser']);
	394	$app->system->chgrp(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), $this->data['new']['pgroup']);
	395
	396	$this->app->log("Added jailkit parent user home in : ".$this->data['new']['dir'].$jailkit_chroot_puserhome, LOGLEVEL_DEBUG);
	397
8cf78b	398
396f0e	399	}
7fe908	400
8db8f3	401	//* Update the website root directory permissions depending on the security level
T	402	function _update_website_security_level() {
7fe908	403	global $app, $conf;
MC	404
8db8f3	405	// load the server configuration options
T	406	$app->uses("getconf");
	407	$web_config = $app->getconf->get_server_config($conf["server_id"], 'web');
7fe908	408
8db8f3	409	// Get the parent website of this shell user
T	410	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['new']['parent_domain_id']);
7fe908	411
8db8f3	412	//* If the security level is set to high
ff6a68	413	if($web_config['security_level'] == 20 && is_array($web)) {
7fe908	414	$app->system->web_folder_protection($web["document_root"], false);
MC	415	$app->system->chmod($web["document_root"], 0755);
	416	$app->system->chown($web["document_root"], 'root');
	417	$app->system->chgrp($web["document_root"], 'root');
	418	$app->system->web_folder_protection($web["document_root"], true);
8db8f3	419	}
7fe908	420
8db8f3	421	}
7fe908	422
07bdbd	423	//* Wrapper for exec function for easier debugging
T	424	private function _exec($command) {
	425	global $app;
7fe908	426	$app->log('exec: '.$command, LOGLEVEL_DEBUG);
07bdbd	427	exec($command);
T	428	}
396f0e	429
00a055	430	private function _setup_ssh_rsa() {
8ab3cd	431	global $app;
7fe908	432	$this->app->log("ssh-rsa setup shelluser_jailkit", LOGLEVEL_DEBUG);
00a055	433	// Get the client ID, username, and the key
27c623	434	$domain_data = $this->app->db->queryOneRecord('SELECT sys_groupid FROM web_domain WHERE web_domain.domain_id = '.intval($this->data['new']['parent_domain_id']));
L	435	$sys_group_data = $this->app->db->queryOneRecord('SELECT * FROM sys_group WHERE sys_group.groupid = '.intval($domain_data['sys_groupid']));
00a055	436	$id = intval($sys_group_data['client_id']);
L	437	$username= $sys_group_data['name'];
27c623	438	$client_data = $this->app->db->queryOneRecord('SELECT * FROM client WHERE client.client_id = '.$id);
00a055	439	$userkey = $client_data['ssh_rsa'];
L	440	unset($domain_data);
	441	unset($client_data);
7fe908	442
00a055	443	// ssh-rsa authentication variables
8ab3cd	444	$sshrsa = $this->data['new']['ssh_rsa'];
00a055	445	$usrdir = escapeshellcmd($this->data['new']['dir']).'/'.$this->_get_home_dir($this->data['new']['username']);
8ab3cd	446	$sshdir = $usrdir.'/.ssh';
T	447	$sshkeys= $usrdir.'/.ssh/authorized_keys';
7fe908	448
8ab3cd	449	$app->uses('file');
T	450	$sshrsa = $app->file->unix_nl($sshrsa);
7fe908	451	$sshrsa = $app->file->remove_blank_lines($sshrsa, 0);
MC	452
00a055	453	// If this user has no key yet, generate a pair
8ab3cd	454	if ($userkey == '' && $id > 0){
00a055	455	//Generate ssh-rsa-keys
L	456	exec('ssh-keygen -t rsa -C '.$username.'-rsa-key-'.time().' -f /tmp/id_rsa -N ""');
7fe908	457
8ab3cd	458	// use the public key that has been generated
4bd960	459	$userkey = $app->system->file_get_contents('/tmp/id_rsa.pub');
7fe908	460
00a055	461	// save keypair in client table
4bd960	462	$this->app->db->query("UPDATE client SET created_at = ".time().", id_rsa = '".$app->db->quote($app->system->file_get_contents('/tmp/id_rsa'))."', ssh_rsa = '".$app->db->quote($userkey)."' WHERE client_id = ".$id);
8ab3cd	463
4bd960	464	$app->system->unlink('/tmp/id_rsa');
T	465	$app->system->unlink('/tmp/id_rsa.pub');
7fe908	466	$this->app->log("ssh-rsa keypair generated for ".$username, LOGLEVEL_DEBUG);
00a055	467	};
7fe908	468
8ab3cd	469	if (!file_exists($sshkeys)){
00a055	470	// add root's key
8ab3cd	471	$app->file->mkdirs($sshdir, '0755');
4bd960	472	if(is_file('/root/.ssh/authorized_keys')) $app->system->file_put_contents($sshkeys, $app->system->file_get_contents('/root/.ssh/authorized_keys'));
7fe908	473
8ab3cd	474	// Remove duplicate keys
26c0fc	475	$existing_keys = @file($sshkeys);
8ab3cd	476	$new_keys = explode("\n", $userkey);
26c0fc	477	$final_keys_arr = @array_merge($existing_keys, $new_keys);
8ab3cd	478	$new_final_keys_arr = array();
T	479	if(is_array($final_keys_arr) && !empty($final_keys_arr)){
	480	foreach($final_keys_arr as $key => $val){
	481	$new_final_keys_arr[$key] = trim($val);
	482	}
	483	}
	484	$final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
7fe908	485
00a055	486	// add the user's key
8ab3cd	487	file_put_contents($sshkeys, $final_keys);
T	488	$app->file->remove_blank_lines($sshkeys);
7fe908	489	$this->app->log("ssh-rsa authorisation keyfile created in ".$sshkeys, LOGLEVEL_DEBUG);
00a055	490	}
8cf78b	491	//* Get the keys
T	492	$existing_keys = file($sshkeys);
	493	$new_keys = explode("\n", $sshrsa);
7fe908	494	$old_keys = explode("\n", $this->data['old']['ssh_rsa']);
MC	495
8cf78b	496	//* Remove all old keys
T	497	if(is_array($old_keys)) {
	498	foreach($old_keys as $key => $val) {
7fe908	499	$k = array_search(trim($val), $existing_keys);
8cf78b	500	unset($existing_keys[$k]);
T	501	}
00a055	502	}
7fe908	503
8cf78b	504	//* merge the remaining keys and the ones fom the ispconfig database.
T	505	if(is_array($new_keys)) {
	506	$final_keys_arr = array_merge($existing_keys, $new_keys);
	507	} else {
	508	$final_keys_arr = $existing_keys;
	509	}
7fe908	510
8cf78b	511	$new_final_keys_arr = array();
T	512	if(is_array($final_keys_arr) && !empty($final_keys_arr)){
	513	foreach($final_keys_arr as $key => $val){
	514	$new_final_keys_arr[$key] = trim($val);
	515	}
	516	}
	517	$final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
7fe908	518
MC	519	// add the custom key
4bd960	520	$app->system->file_put_contents($sshkeys, $final_keys);
8cf78b	521	$app->file->remove_blank_lines($sshkeys);
7fe908	522	$this->app->log("ssh-rsa key updated in ".$sshkeys, LOGLEVEL_DEBUG);
MC	523
00a055	524	// set proper file permissions
8cf78b	525	exec("chown -R ".escapeshellcmd($this->data['new']['puser']).":".escapeshellcmd($this->data['new']['pgroup'])." ".$sshdir);
T	526	exec("chmod 700 ".$sshdir);
00a055	527	exec("chmod 600 '$sshkeys'");
7fe908	528
00a055	529	}
a7e4ec	530
TB	531	private function _delete_homedir($homedir,$userid,$parent_domain_id) {
	532	global $app, $conf;
	533
	534	// check if we have to delete the dir
	535	$check = $app->db->queryOneRecord('SELECT shell_user_id FROM `shell_user` WHERE `dir` = \'' . $app->db->quote($homedir) . '\'');
	536
	537	if(!$check && is_dir($homedir)) {
	538	$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".intval($parent_domain_id));
	539	$app->system->web_folder_protection($web['document_root'], false);
	540
	541	// delete dir
	542	if(substr($homedir, -1) !== '/') $homedir .= '/';
	543	$files = array('.bash_logout', '.bash_history', '.bashrc', '.profile');
65a0b9	544	$dirs = array('.ssh', '.cache');
a7e4ec	545	foreach($files as $delfile) {
TB	546	if(is_file($homedir . $delfile) && fileowner($homedir . $delfile) == $userid) unlink($homedir . $delfile);
	547	}
	548	foreach($dirs as $deldir) {
	549	if(is_dir($homedir . $deldir) && fileowner($homedir . $deldir) == $userid) exec('rm -rf ' . escapeshellarg($homedir . $deldir));
	550	}
	551	$empty = true;
	552	$dirres = opendir($homedir);
	553	if($dirres) {
	554	while(($entry = readdir($dirres)) !== false) {
	555	if($entry != '.' && $entry != '..') {
	556	$empty = false;
	557	break;
	558	}
	559	}
	560	closedir($dirres);
	561	}
	562	if($empty == true) {
	563	rmdir($homedir);
	564	}
	565	unset($files);
	566	unset($dirs);
	567
	568	$app->system->web_folder_protection($web['document_root'], true);
	569	}
	570
	571	}
7fe908	572
396f0e	573	} // end class
T	574
8e725d	575	?>