ISPConfig3 devel
view | history | commit | commitdiff
Till Brehm
2014-08-14 9edea9976bd605071e0694a90d704266c0b7e0f9
commit | author | age
396f0e 1 <?php
T 2
3 /*
4 Copyright (c) 2007, Till Brehm, projektfarm Gmbh
5 All rights reserved.
6
7 Redistribution and use in source and binary forms, with or without modification,
8 are permitted provided that the following conditions are met:
9
10     * Redistributions of source code must retain the above copyright notice,
11       this list of conditions and the following disclaimer.
12     * Redistributions in binary form must reproduce the above copyright notice,
13       this list of conditions and the following disclaimer in the documentation
14       and/or other materials provided with the distribution.
15     * Neither the name of ISPConfig nor the names of its contributors
16       may be used to endorse or promote products derived from this software without
17       specific prior written permission.
18
19 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
20 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
21 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
23 INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
26 OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
27 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
28 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30
31 class shelluser_jailkit_plugin {
7fe908 32
396f0e 33     //* $plugin_name and $class_name have to be the same then the name of this class
T 34     var $plugin_name = 'shelluser_jailkit_plugin';
35     var $class_name = 'shelluser_jailkit_plugin';
b79d24 36     var $min_uid = 499;
7fe908 37
396f0e 38     //* This function is called during ispconfig installation to determine
T 39     //  if a symlink shall be created for this plugin.
40     function onInstall() {
41         global $conf;
7fe908 42
396f0e 43         if($conf['services']['web'] == true) {
T 44             return true;
45         } else {
46             return false;
47         }
7fe908 48
396f0e 49     }
7fe908 50
MC 51
396f0e 52     /*
T 53          This function is called when the plugin is loaded
54     */
7fe908 55
396f0e 56     function onLoad() {
T 57         global $app;
7fe908 58
396f0e 59         /*
T 60         Register for the events
61         */
9edea9 62         
7fe908 63         $app->plugins->registerEvent('shell_user_insert', $this->plugin_name, 'insert');
MC 64         $app->plugins->registerEvent('shell_user_update', $this->plugin_name, 'update');
65         $app->plugins->registerEvent('shell_user_delete', $this->plugin_name, 'delete');
9edea9 66         
7fe908 67
396f0e 68     }
7fe908 69
396f0e 70     //* This function is called, when a shell user is inserted in the database
7fe908 71     function insert($event_name, $data) {
396f0e 72         global $app, $conf;
7fe908 73
9edea9 74         $app->uses('system,getconf');
TB 75         
76         $security_config = $app->getconf->get_security_config('permissions');
77         if($security_config['allow_shell_user'] != 'yes') {
78             $app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
79             return false;
80         }
81         
82         
ff6a68 83         $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
7fe908 84
64ea56 85         if(!$app->system->is_allowed_user($data['new']['username'], false, false)
MC 86             || !$app->system->is_allowed_user($data['new']['puser'], true, true)
87             || !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
88             $app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
89             return false;
90         }
91
b79d24 92         if($app->system->is_user($data['new']['puser'])) {
FT 93             // Get the UID of the parent user
94             $uid = intval($app->system->getuid($data['new']['puser']));
95             if($uid > $this->min_uid) {
96             
97                 if($app->system->is_user($data['new']['username'])) {
7fe908 98
b79d24 99                     /**
FT 100                     * Setup Jailkit Chroot System If Enabled
101                     */
102
103                     if ($data['new']['chroot'] == "jailkit")
104                     {
7fe908 105
MC 106
b79d24 107                         // load the server configuration options
FT 108                         $app->uses("getconf");
109                         $this->data = $data;
110                         $this->app = $app;
111                         $this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908 112
b79d24 113                         $this->_update_website_security_level();
7fe908 114
b79d24 115                         $app->system->web_folder_protection($web['document_root'], false);
7fe908 116
b79d24 117                         $this->_setup_jailkit_chroot();
7fe908 118
b79d24 119                         $this->_add_jailkit_user();
7fe908 120
b79d24 121                         //* call the ssh-rsa update function
FT 122                         $this->_setup_ssh_rsa();
7fe908 123
b79d24 124                         //$command .= 'usermod -s /usr/sbin/jk_chrootsh -U '.escapeshellcmd($data['new']['username']);
FT 125                         //exec($command);
126                         $app->system->usermod($data['new']['username'], 0, 0, '', '/usr/sbin/jk_chrootsh', '', '');
7fe908 127
b79d24 128                         //* Unlock user
FT 129                         $command = 'usermod -U '.escapeshellcmd($data['new']['username']).' 2>/dev/null';
130                         exec($command);
7fe908 131
b79d24 132                         $this->_update_website_security_level();
FT 133                         $app->system->web_folder_protection($web['document_root'], true);
134                     }
7fe908 135
b79d24 136                     $app->log("Jailkit Plugin -> insert username:".$data['new']['username'], LOGLEVEL_DEBUG);
7fe908 137
b79d24 138                 } else {
FT 139                     $app->log("Jailkit Plugin -> insert username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
140                 }
141             } else {
142                 $app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
396f0e 143             }
T 144         } else {
b79d24 145             $app->log("Skipping insertion of user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
396f0e 146         }
7fe908 147
396f0e 148     }
7fe908 149
396f0e 150     //* This function is called, when a shell user is updated in the database
7fe908 151     function update($event_name, $data) {
396f0e 152         global $app, $conf;
7fe908 153
9edea9 154         $app->uses('system,getconf');
TB 155         
156         $security_config = $app->getconf->get_security_config('permissions');
157         if($security_config['allow_shell_user'] != 'yes') {
158             $app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
159             return false;
160         }
161         
ff6a68 162         $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
7fe908 163
64ea56 164         if(!$app->system->is_allowed_user($data['new']['username'], false, false)
MC 165             || !$app->system->is_allowed_user($data['new']['puser'], true, true)
166             || !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
167             $app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
168             return false;
169         }
170
b79d24 171         if($app->system->is_user($data['new']['puser'])) {
FT 172             // Get the UID of the parent user
173             $uid = intval($app->system->getuid($data['new']['puser']));
174             if($uid > $this->min_uid) {
175             
176             
177                 if($app->system->is_user($data['new']['username'])) {
7fe908 178
b79d24 179                     /**
FT 180                     * Setup Jailkit Chroot System If Enabled
181                     */
182                     if ($data['new']['chroot'] == "jailkit")
183                     {
7fe908 184
b79d24 185                         // load the server configuration options
FT 186                         $app->uses("getconf");
187                         $this->data = $data;
188                         $this->app = $app;
189                         $this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908 190
b79d24 191                         $this->_update_website_security_level();
7fe908 192
b79d24 193                         $app->system->web_folder_protection($web['document_root'], false);
7fe908 194
b79d24 195                         $this->_setup_jailkit_chroot();
FT 196                         $this->_add_jailkit_user();
7fe908 197
b79d24 198                         //* call the ssh-rsa update function
FT 199                         $this->_setup_ssh_rsa();
7fe908 200
b79d24 201                         $this->_update_website_security_level();
7fe908 202
b79d24 203                         $app->system->web_folder_protection($web['document_root'], true);
FT 204                     }
7fe908 205
b79d24 206                     $app->log("Jailkit Plugin -> update username:".$data['new']['username'], LOGLEVEL_DEBUG);
7fe908 207
b79d24 208                 } else {
FT 209                     $app->log("Jailkit Plugin -> update username:".$data['new']['username']." skipped, the user does not exist.", LOGLEVEL_WARN);
210                 }
211             } else {
212                 $app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.", LOGLEVEL_ERROR);
396f0e 213             }
T 214         } else {
b79d24 215             $app->log("Skipping update for user:".$data['new']['username'].", parent user ".$data['new']['puser']." does not exist.", LOGLEVEL_WARN);
396f0e 216         }
7fe908 217
396f0e 218     }
7fe908 219
396f0e 220     //* This function is called, when a shell user is deleted in the database
T 221     /**
222      * TODO: Remove chroot user home and from the chroot passwd file
7fe908 223      */
MC 224     function delete($event_name, $data) {
396f0e 225         global $app, $conf;
7fe908 226
9edea9 227         $app->uses('system,getconf');
TB 228         
229         $security_config = $app->getconf->get_security_config('permissions');
230         if($security_config['allow_shell_user'] != 'yes') {
231             $app->log('Shell user plugin disabled by security settings.',LOGLEVEL_WARN);
232             return false;
233         }
7fe908 234
ff6a68 235         $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['old']['parent_domain_id']);
7fe908 236
396f0e 237         if ($data['old']['chroot'] == "jailkit")
T 238         {
239             $app->uses("getconf");
240             $this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
7fe908 241
396f0e 242             $jailkit_chroot_userhome = $this->_get_home_dir($data['old']['username']);
7fe908 243
396f0e 244             //commented out proved to be dangerous on config errors
T 245             //exec('rm -rf '.$data['old']['dir'].$jailkit_chroot_userhome);
7fe908 246
MC 247             $app->system->web_folder_protection($web['document_root'], false);
248
396f0e 249             if(@is_dir($data['old']['dir'].$jailkit_chroot_userhome)) {
c65384 250                 $command = 'killall -u '.escapeshellcmd($data['old']['username']).' ; userdel -f';
526b99 251                 $command .= ' '.escapeshellcmd($data['old']['username']).' &> /dev/null';
396f0e 252                 exec($command);
7fe908 253                 $app->log("Jailkit Plugin -> delete chroot home:".$data['old']['dir'].$jailkit_chroot_userhome, LOGLEVEL_DEBUG);
396f0e 254             }
7fe908 255
MC 256             $app->system->web_folder_protection($web['document_root'], true);
257
396f0e 258         }
7fe908 259
MC 260         $app->log("Jailkit Plugin -> delete username:".$data['old']['username'], LOGLEVEL_DEBUG);
261
262
396f0e 263     }
7fe908 264
396f0e 265     function _setup_jailkit_chroot()
T 266     {
7fe908 267         global $app;
MC 268
269         //check if the chroot environment is created yet if not create it with a list of program sections from the config
270         if (!is_dir($this->data['new']['dir'].'/etc/jailkit'))
271         {
272             $command = '/usr/local/ispconfig/server/scripts/create_jailkit_chroot.sh';
273             $command .= ' '.escapeshellcmd($this->data['new']['dir']);
274             $command .= ' \''.$this->jailkit_config['jailkit_chroot_app_sections'].'\'';
275             exec($command.' 2>/dev/null');
276
277             $this->app->log("Added jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
278
279             $this->_add_jailkit_programs();
280
281             //add bash.bashrc script
282             //we need to collect the domain name to be used as the HOSTNAME in the bashrc script
283             $web = $this->app->db->queryOneRecord("SELECT domain FROM web_domain WHERE domain_id = ".intval($this->data['new']["parent_domain_id"]));
284
285             $this->app->load('tpl');
286
287             $tpl = new tpl();
288             $tpl->newTemplate("bash.bashrc.master");
289
290             $tpl->setVar('jailkit_chroot', true);
291             $tpl->setVar('domain', $web['domain']);
292             $tpl->setVar('home_dir', $this->_get_home_dir(""));
293
294             $bashrc = escapeshellcmd($this->data['new']['dir']).'/etc/bash.bashrc';
295             if(@is_file($bashrc) || @is_link($bashrc)) unlink($bashrc);
296
297             file_put_contents($bashrc, $tpl->grab());
298             unset($tpl);
299
300             $this->app->log("Added bashrc script : ".$bashrc, LOGLEVEL_DEBUG);
301
302             $tpl = new tpl();
303             $tpl->newTemplate("motd.master");
304
305             $tpl->setVar('domain', $web['domain']);
306
307             $motd = escapeshellcmd($this->data['new']['dir']).'/var/run/motd';
308             if(@is_file($motd) || @is_link($motd)) unlink($motd);
309
310             $app->system->file_put_contents($motd, $tpl->grab());
311
312         }
396f0e 313     }
7fe908 314
396f0e 315     function _add_jailkit_programs()
T 316     {
317         //copy over further programs and its libraries
318         $command = '/usr/local/ispconfig/server/scripts/create_jailkit_programs.sh';
319         $command .= ' '.escapeshellcmd($this->data['new']['dir']);
320         $command .= ' \''.$this->jailkit_config['jailkit_chroot_app_programs'].'\'';
526b99 321         exec($command.' 2>/dev/null');
7fe908 322
MC 323         $this->app->log("Added programs to jailkit chroot with command: ".$command, LOGLEVEL_DEBUG);
396f0e 324     }
7fe908 325
396f0e 326     function _get_home_dir($username)
T 327     {
7fe908 328         return str_replace("[username]", escapeshellcmd($username), $this->jailkit_config['jailkit_chroot_home']);
396f0e 329     }
7fe908 330
396f0e 331     function _add_jailkit_user()
T 332     {
7fe908 333         global $app;
MC 334
335         //add the user to the chroot
336         $jailkit_chroot_userhome = $this->_get_home_dir($this->data['new']['username']);
337         $jailkit_chroot_puserhome = $this->_get_home_dir($this->data['new']['puser']);
338
339         if(!is_dir($this->data['new']['dir'].'/etc')) mkdir($this->data['new']['dir'].'/etc', 0755);
340         if(!is_file($this->data['new']['dir'].'/etc/passwd')) touch($this->data['new']['dir'].'/etc/passwd', 0755);
341
342         // IMPORTANT!
343         // ALWAYS create the user. Even if the user was created before
344         // if we check if the user exists, then a update (no shell -> jailkit) will not work
345         // and the user has FULL ACCESS to the root of the server!
346         $command = '/usr/local/ispconfig/server/scripts/create_jailkit_user.sh';
347         $command .= ' '.escapeshellcmd($this->data['new']['username']);
348         $command .= ' '.escapeshellcmd($this->data['new']['dir']);
349         $command .= ' '.$jailkit_chroot_userhome;
350         $command .= ' '.escapeshellcmd($this->data['new']['shell']);
351         $command .= ' '.$this->data['new']['puser'];
352         $command .= ' '.$jailkit_chroot_puserhome;
353         exec($command.' 2>/dev/null');
354
355         //* Change the homedir of the shell user and parent user
356         //* We have to do this manually as the usermod command fails
357         //* when the user is logged in or a command is running under that user
358         /*
8cf78b 359             $passwd_file_array = file('/etc/passwd');
T 360             $passwd_out = '';
361             if(is_array($passwd_file_array)) {
362                 foreach($passwd_file_array as $line) {
363                     $line = trim($line);
364                     $parts = explode(':',$line);
365                     if($parts[0] == $this->data['new']['username']) {
366                         $parts[5] = escapeshellcmd($this->data['new']['dir'].'/.'.$jailkit_chroot_userhome);
367                         $parts[6] = escapeshellcmd('/usr/sbin/jk_chrootsh');
368                         $new_line = implode(':',$parts);
369                         copy('/etc/passwd','/etc/passwd~');
370                         chmod('/etc/passwd~',0600);
371                         $app->uses('system');
372                         $app->system->replaceLine('/etc/passwd',$line,$new_line,1,0);
373                     }
374                 }
ff6a68 375             }*/
7fe908 376
MC 377         $app->system->usermod($this->data['new']['username'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, '/usr/sbin/jk_chrootsh');
378         $app->system->usermod($this->data['new']['puser'], 0, 0, $this->data['new']['dir'].'/.'.$jailkit_chroot_userhome, '/usr/sbin/jk_chrootsh');
379
380         $this->app->log("Added jailkit user to chroot with command: ".$command, LOGLEVEL_DEBUG);
381
382         if(!is_dir($this->data['new']['dir'].$jailkit_chroot_userhome)) mkdir(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), 0755, true);
383         $app->system->chown(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), $this->data['new']['username']);
384         $app->system->chgrp(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_userhome), $this->data['new']['pgroup']);
385
386         $this->app->log("Added created jailkit user home in : ".$this->data['new']['dir'].$jailkit_chroot_userhome, LOGLEVEL_DEBUG);
387
388         if(!is_dir($this->data['new']['dir'].$jailkit_chroot_puserhome)) mkdir(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), 0755, true);
389         $app->system->chown(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), $this->data['new']['puser']);
390         $app->system->chgrp(escapeshellcmd($this->data['new']['dir'].$jailkit_chroot_puserhome), $this->data['new']['pgroup']);
391
392         $this->app->log("Added jailkit parent user home in : ".$this->data['new']['dir'].$jailkit_chroot_puserhome, LOGLEVEL_DEBUG);
393
8cf78b 394
396f0e 395     }
7fe908 396
8db8f3 397     //* Update the website root directory permissions depending on the security level
T 398     function _update_website_security_level() {
7fe908 399         global $app, $conf;
MC 400
8db8f3 401         // load the server configuration options
T 402         $app->uses("getconf");
403         $web_config = $app->getconf->get_server_config($conf["server_id"], 'web');
7fe908 404
8db8f3 405         // Get the parent website of this shell user
T 406         $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['new']['parent_domain_id']);
7fe908 407
8db8f3 408         //* If the security level is set to high
ff6a68 409         if($web_config['security_level'] == 20 && is_array($web)) {
7fe908 410             $app->system->web_folder_protection($web["document_root"], false);
MC 411             $app->system->chmod($web["document_root"], 0755);
412             $app->system->chown($web["document_root"], 'root');
413             $app->system->chgrp($web["document_root"], 'root');
414             $app->system->web_folder_protection($web["document_root"], true);
8db8f3 415         }
7fe908 416
8db8f3 417     }
7fe908 418
07bdbd 419     //* Wrapper for exec function for easier debugging
T 420     private function _exec($command) {
421         global $app;
7fe908 422         $app->log('exec: '.$command, LOGLEVEL_DEBUG);
07bdbd 423         exec($command);
T 424     }
396f0e 425
00a055 426     private function _setup_ssh_rsa() {
8ab3cd 427         global $app;
7fe908 428         $this->app->log("ssh-rsa setup shelluser_jailkit", LOGLEVEL_DEBUG);
00a055 429         // Get the client ID, username, and the key
27c623 430         $domain_data = $this->app->db->queryOneRecord('SELECT sys_groupid FROM web_domain WHERE web_domain.domain_id = '.intval($this->data['new']['parent_domain_id']));
L 431         $sys_group_data = $this->app->db->queryOneRecord('SELECT * FROM sys_group WHERE sys_group.groupid = '.intval($domain_data['sys_groupid']));
00a055 432         $id = intval($sys_group_data['client_id']);
L 433         $username= $sys_group_data['name'];
27c623 434         $client_data = $this->app->db->queryOneRecord('SELECT * FROM client WHERE client.client_id = '.$id);
00a055 435         $userkey = $client_data['ssh_rsa'];
L 436         unset($domain_data);
437         unset($client_data);
7fe908 438
00a055 439         // ssh-rsa authentication variables
8ab3cd 440         $sshrsa = $this->data['new']['ssh_rsa'];
00a055 441         $usrdir = escapeshellcmd($this->data['new']['dir']).'/'.$this->_get_home_dir($this->data['new']['username']);
8ab3cd 442         $sshdir = $usrdir.'/.ssh';
T 443         $sshkeys= $usrdir.'/.ssh/authorized_keys';
7fe908 444
8ab3cd 445         $app->uses('file');
T 446         $sshrsa = $app->file->unix_nl($sshrsa);
7fe908 447         $sshrsa = $app->file->remove_blank_lines($sshrsa, 0);
MC 448
00a055 449         // If this user has no key yet, generate a pair
8ab3cd 450         if ($userkey == '' && $id > 0){
00a055 451             //Generate ssh-rsa-keys
L 452             exec('ssh-keygen -t rsa -C '.$username.'-rsa-key-'.time().' -f /tmp/id_rsa -N ""');
7fe908 453
8ab3cd 454             // use the public key that has been generated
4bd960 455             $userkey = $app->system->file_get_contents('/tmp/id_rsa.pub');
7fe908 456
00a055 457             // save keypair in client table
4bd960 458             $this->app->db->query("UPDATE client SET created_at = ".time().", id_rsa = '".$app->db->quote($app->system->file_get_contents('/tmp/id_rsa'))."', ssh_rsa = '".$app->db->quote($userkey)."' WHERE client_id = ".$id);
8ab3cd 459
4bd960 460             $app->system->unlink('/tmp/id_rsa');
T 461             $app->system->unlink('/tmp/id_rsa.pub');
7fe908 462             $this->app->log("ssh-rsa keypair generated for ".$username, LOGLEVEL_DEBUG);
00a055 463         };
7fe908 464
8ab3cd 465         if (!file_exists($sshkeys)){
00a055 466             // add root's key
8ab3cd 467             $app->file->mkdirs($sshdir, '0755');
4bd960 468             if(is_file('/root/.ssh/authorized_keys')) $app->system->file_put_contents($sshkeys, $app->system->file_get_contents('/root/.ssh/authorized_keys'));
7fe908 469
8ab3cd 470             // Remove duplicate keys
26c0fc 471             $existing_keys = @file($sshkeys);
8ab3cd 472             $new_keys = explode("\n", $userkey);
26c0fc 473             $final_keys_arr = @array_merge($existing_keys, $new_keys);
8ab3cd 474             $new_final_keys_arr = array();
T 475             if(is_array($final_keys_arr) && !empty($final_keys_arr)){
476                 foreach($final_keys_arr as $key => $val){
477                     $new_final_keys_arr[$key] = trim($val);
478                 }
479             }
480             $final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
7fe908 481
00a055 482             // add the user's key
8ab3cd 483             file_put_contents($sshkeys, $final_keys);
T 484             $app->file->remove_blank_lines($sshkeys);
7fe908 485             $this->app->log("ssh-rsa authorisation keyfile created in ".$sshkeys, LOGLEVEL_DEBUG);
00a055 486         }
8cf78b 487         //* Get the keys
T 488         $existing_keys = file($sshkeys);
489         $new_keys = explode("\n", $sshrsa);
7fe908 490         $old_keys = explode("\n", $this->data['old']['ssh_rsa']);
MC 491
8cf78b 492         //* Remove all old keys
T 493         if(is_array($old_keys)) {
494             foreach($old_keys as $key => $val) {
7fe908 495                 $k = array_search(trim($val), $existing_keys);
8cf78b 496                 unset($existing_keys[$k]);
T 497             }
00a055 498         }
7fe908 499
8cf78b 500         //* merge the remaining keys and the ones fom the ispconfig database.
T 501         if(is_array($new_keys)) {
502             $final_keys_arr = array_merge($existing_keys, $new_keys);
503         } else {
504             $final_keys_arr = $existing_keys;
505         }
7fe908 506
8cf78b 507         $new_final_keys_arr = array();
T 508         if(is_array($final_keys_arr) && !empty($final_keys_arr)){
509             foreach($final_keys_arr as $key => $val){
510                 $new_final_keys_arr[$key] = trim($val);
511             }
512         }
513         $final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
7fe908 514
MC 515         // add the custom key
4bd960 516         $app->system->file_put_contents($sshkeys, $final_keys);
8cf78b 517         $app->file->remove_blank_lines($sshkeys);
7fe908 518         $this->app->log("ssh-rsa key updated in ".$sshkeys, LOGLEVEL_DEBUG);
MC 519
00a055 520         // set proper file permissions
8cf78b 521         exec("chown -R ".escapeshellcmd($this->data['new']['puser']).":".escapeshellcmd($this->data['new']['pgroup'])." ".$sshdir);
T 522         exec("chmod 700 ".$sshdir);
00a055 523         exec("chmod 600 '$sshkeys'");
7fe908 524
00a055 525     }
7fe908 526
396f0e 527 } // end class
T 528
8e725d 529 ?>