diff options
| -rwxr-xr-x | scripts/install-system | 40 | ||||
| -rwxr-xr-x | scripts/quick-install | 4 | ||||
| -rwxr-xr-x | scripts/rl-system.init | 2 | ||||
| -rwxr-xr-x | scripts/standalone_root_pw_reset | 27 | ||||
| -rwxr-xr-x | scripts/vyatta-grub-setup | 18 | ||||
| -rwxr-xr-x | scripts/vyatta_net_name | 2 | ||||
| -rw-r--r-- | templates/service/ssh/node.def | 33 | ||||
| -rw-r--r-- | templates/service/ssh/protocol-version/node.def | 1 |
8 files changed, 56 insertions, 71 deletions
diff --git a/scripts/install-system b/scripts/install-system index 3ed14af2..1f507fe9 100755 --- a/scripts/install-system +++ b/scripts/install-system @@ -47,7 +47,7 @@ rootfsdir=/mnt/rootfs # install log file name INSTALL_LOG="install.log" # root partition minimum size in MB -ROOT_MIN="450" +ROOT_MIN=500 # the base install drive e.g. sda if [ -n "$INSTALL_DRIVE" ]; then INSTALL_DRIVE="" @@ -70,9 +70,6 @@ PARTITION='' # Process ID of this script for the lame marketing spinner SPID=$$ -# Path to standalone root password reset script -PWRESET=/opt/vyatta/sbin/standalone_root_pw_reset - # Grub options GRUB_OPTIONS="quiet" @@ -80,20 +77,6 @@ GRUB_OPTIONS="quiet" VTY_CONSOLE="console=ttyS0,9600 console=tty0" SERIAL_CONSOLE="console=tty0 console=ttyS0,9600" -# If VGA_LOGO is set, enable use of the VGA monitor for displaying the -# logo during boot. The "vga=" boot command specifies a VGA mode that -# is encoded as shown below. We pick a value that is likely to work -# on most systems: -# -# Color depth | 640x480 | 800x600 | 1024x768 | 1280x1024 -# -----------------+---------+---------+----------+---------- -# 256 (8bit) | 769 771 773 775 -# 32000 (15bit) | 784 787 790 793 -# 65000 (16bit) | 785 788 791 794 -# 16.7 Mill.(24bit)| 786 789 792 795 -# -VGA_LOGO="vga=788" - # trap signals so we can kill runaway progress indicators trap 'progress_indicator stop; exit 1' 1 trap 'progress_indicator stop; exit 1' 2 @@ -766,7 +749,7 @@ install_root_filesystem () { echo "Unable to read filesystem UUID. Exiting." exit 1 else - echo -e "UUID=$uuid\t/\text3\tdefaults\t0 1" >> $rootfsdir/etc/fstab + echo -e "UUID=$uuid\t/\text3\tnoatime\t0 1" >> $rootfsdir/etc/fstab fi #setup the hostname file @@ -883,17 +866,6 @@ change_password() { set_encrypted_password $user $epwd $rootfsdir$ofrconfdir/config.boot } -system_setup () { - echo -n "Would you like to set the passwords for system users (Yes/No) [Yes]: " - local response=$(get_response "Yes" "Yes No Y N") - - if [ "$response" == "yes" ] || [ "$response" == "y" ]; then - change_password root - change_password vyatta - fi -} - - # setup grub on the boot sector of a user queried drive install_grub () { # we now use INSTALL_DRIVE to reference the grub boot drive. @@ -1028,7 +1000,7 @@ setup_method_auto() { lsize=$(get_drive_size "$INSTALL_DRIVE") total=$ROOT_MIN if [ "$total" -gt "$lsize" ]; then - echo "Unfortunately, the OFR requires a total of at least $total"MB" to properly install." + echo "Unfortunately, Vyatta requires a total of at least $total"MB" to properly install." echo "$INSTALL_DRIVE is below the minimum required capacity and therefore, cannot be used to" echo -e "complete the installation.\n" echo "If other drives are present" @@ -1309,7 +1281,11 @@ copy_config "$CONFIG_PARTITION" # Modify config to match system # Assume user wants to keep password from old config if [ ! -d /mnt/config ]; then - system_setup + # Disable root login + set_encrypted_password root "*" $rootfsdir$ofrconfdir/config.boot + + echo "Enter password for administrator account" + change_password vyatta fi # check for xen part images in /var/xen diff --git a/scripts/quick-install b/scripts/quick-install index 347cafd2..82475cb1 100755 --- a/scripts/quick-install +++ b/scripts/quick-install @@ -571,7 +571,7 @@ install_grub () { # set serial console options echo -e "serial --unit=0 --speed=9600\nterminal --timeout=5 console serial\n\n" >> $grub_file # set primary boot option - echo -e "title Vyatta OFR\n\troot $root" >> $grub_file + echo -e "title Vyatta\n\troot $root" >> $grub_file echo -en "\tkernel /boot/vmlinuz root=/dev/$ROOT_PARTITION $ISCF console=ttyS0,9600 console=tty0\n" >> $grub_file echo -e "\tinitrd /boot/initrd.img" >> $grub_file @@ -675,7 +675,7 @@ setup_method_auto() { lsize=$(get_drive_size "$INSTALL_DRIVE") total=$(($ROOT_MIN + $CONFIG_MIN)) if [ "$total" -gt "$lsize" ]; then - echo "Unfortunately, the OFR requires a total of at least $total"MB" to properly install." + echo "Unfortunately, Vyatta requires a total of at least $total"MB" to properly install." echo "$INSTALL_DRIVE is below the minimum required capacity and therefore, cannot be used to" echo -e "complete the installation.\n" echo "If other drives are present" diff --git a/scripts/rl-system.init b/scripts/rl-system.init index 5391d409..af21bbfe 100755 --- a/scripts/rl-system.init +++ b/scripts/rl-system.init @@ -114,8 +114,6 @@ clear_or_override_config_files () cat /dev/null > /etc/$conf || true fi done - # ssh v1. remove the empty key file - rm -f /etc/ssh/ssh_host_key } udev_rescan () diff --git a/scripts/standalone_root_pw_reset b/scripts/standalone_root_pw_reset index d089b50d..b75d19df 100755 --- a/scripts/standalone_root_pw_reset +++ b/scripts/standalone_root_pw_reset @@ -14,7 +14,7 @@ # All Rights Reserved. # # Author: Bob Gilligan <gilligan@vyatta.com> -# Description: Standalone script to set the root passwd to new value +# Description: Standalone script to set the admin passwd to new value # value. Note: This script can ONLY be run as a standalone # init program by grub. # @@ -23,9 +23,11 @@ # The Vyatta config file: CF=/opt/vyatta/etc/config/config.boot +# Admin user name +ADMIN=vyatta set_encrypted_password() { sed -i \ - -e "/ user $1 {/,/}/s/encrypted-password.*\$/encrypted-password \"$2\"/" $3 + -e "/ user $1 {/,/}/s/encrypted-password .*\$/encrypted-password \"$2\"/" $3 } change_password() { @@ -65,18 +67,18 @@ fi # OK, now we know we are running in standalone mode. Talk to the # user. # -read -p "Do you wish to change the root password? " response +echo "Do you wish to reset the admin password?" +read response response=${response:0:1} - if [ "$response" != "y" -a "$response" != "Y" ]; then - echo "OK, the root password will not be changed." + echo "OK, the admin password will not be reset." echo -n "Rebooting in 5 seconds..." sleep 5 echo /sbin/reboot -f fi -echo "Starting process to change the root password..." +echo "Starting process to reset the admin password..." echo "Re-mounting root filesystem read/write..." mount -o remount,rw / @@ -88,14 +90,19 @@ then mount /opt/vyatta/etc/config/ fi +if ! grep -q " user $ADMIN " $CF +then + echo "Administrator account $ADMIN missing..." + exit 1 +fi + echo "Saving backup copy of config.boot..." cp $CF ${CF}.before_pwrecovery -echo -change_password root +echo "Setting the administrator ($ADMIN) password..." +change_password $ADMIN -echo "Root password changed" -echo $(date "+%b%e %T") $(hostname) "Root password changed" \ +echo $(date "+%b%e %T") $(hostname) "Admin password changed" \ | tee -a /var/log/auth.log >>/var/log/messages sync diff --git a/scripts/vyatta-grub-setup b/scripts/vyatta-grub-setup index c37bf7a8..26a322f2 100755 --- a/scripts/vyatta-grub-setup +++ b/scripts/vyatta-grub-setup @@ -69,7 +69,7 @@ serial_console="console=tty0 console=ttyS0,9600" # 65000 (16bit) | 785 788 791 794 # 16.7 Mill.(24bit)| 786 789 792 795 # -vga_logo="vga=785" +#vga_logo="vga=785" # get list of kernels, except Xen kernel_versions=$(ls $ROOTFSDIR/boot/vmlinuz-* 2> /dev/null | grep -v xen | awk -F/ '{ print $5 }' | sed 's/vmlinuz//g' | sort -r) @@ -178,7 +178,7 @@ fi if [ -f "$ROOTFSDIR/boot/vmlinuz" ] && ! eval $UNION ; then # Set first system boot option. Make KVM the default console in this one. - echo -e "menuentry \"Vyatta OFR (KVM console)\" {" + echo -e "menuentry \"Vyatta (KVM console)\" {" echo -e "\tlinux /boot/vmlinuz $GRUB_OPTIONS $vga_logo $vty_console" echo -e "\tinitrd /boot/initrd.img" echo -e "}" @@ -186,7 +186,7 @@ fi # Set the second system boot option. Make the serial port be the default # console in this one. echo - echo -e "menuentry \"Vyatta OFR (Serial console)\" {" + echo -e "menuentry \"Vyatta (Serial console)\" {" echo -e "\tlinux /boot/vmlinuz $GRUB_OPTIONS $serial_console" echo -e "\tinitrd /boot/initrd.img" echo -e "}" @@ -196,12 +196,12 @@ fi if [ -n "$union_kernel_versions" ]; then for kversion in $union_kernel_versions; do echo - echo -e "menuentry \"Vyatta OFR linux$kversion (KVM console)\" {" + echo -e "menuentry \"Vyatta linux$kversion (KVM console)\" {" echo -e "\tlinux /boot/$livedir/vmlinuz$kversion $GRUB_OPTIONS $vga_logo $vty_console" echo -e "\tinitrd /boot/$livedir/initrd.img$kversion" echo -e "}" echo - echo -e "menuentry \"Vyatta OFR linux$kversion (Serial console)\" {" + echo -e "menuentry \"Vyatta linux$kversion (Serial console)\" {" echo -e "\tlinux /boot/$livedir/vmlinuz$kversion $GRUB_OPTIONS $serial_console" echo -e "\tinitrd /boot/$livedir/initrd.img$kversion" echo -e "}" @@ -212,12 +212,12 @@ fi if [ -n "$kernel_versions" ]; then for kversion in $kernel_versions; do echo - echo -e "menuentry \"Vyatta OFR linux$kversion (KVM console)\" {" + echo -e "menuentry \"Vyatta linux$kversion (KVM console)\" {" echo -e "\tlinux /boot/vmlinuz$kversion $GRUB_OPTIONS $vga_logo $vty_console" echo -e "\tinitrd /boot/initrd.img$kversion" echo -e "}" echo - echo -e "menuentry \"Vyatta OFR linux$kversion (Serial console)\" {" + echo -e "menuentry \"Vyatta linux$kversion (Serial console)\" {" echo -e "\tlinux /boot/vmlinuz$kversion $GRUB_OPTIONS $serial_console" echo -e "\tinitrd /boot/initrd.img$kversion" echo -e "}" @@ -228,13 +228,13 @@ fi # options for both serial and KVM console. echo - echo -e "menuentry \"Root password reset to factory (KVM console)\" {" + echo -e "menuentry \"Lost password change (KVM console)\" {" echo -e "\tlinux /boot/vmlinuz $GRUB_OPTIONS $vga_logo $vty_console init=$pass_reset" echo -e "\tinitrd /boot/initrd.img" echo -e "}" echo - echo -e "menuentry \"Root password reset to factory (Serial console)\" {" + echo -e "menuentry \"Lost password change (Serial console)\" {" echo -e "\tlinux /boot/vmlinuz $GRUB_OPTIONS $serial_console init=$pass_reset" echo -e "\tinitrd /boot/initrd.img" echo -e "}" diff --git a/scripts/vyatta_net_name b/scripts/vyatta_net_name index ff8b9bf5..54f91f04 100755 --- a/scripts/vyatta_net_name +++ b/scripts/vyatta_net_name @@ -78,12 +78,14 @@ declare -a cfg_net_hwid=( $( sed -ne ' /^interfaces {/,/^}/ { /^ *ethernet eth[0-9]* {/,/^ $/ { /^ *ethernet/ { + s/\r// s/.* eth\([0-9]\+\) {$/ eth\1=/ # hold interface name h } /^.*hw-id:\?/ { # translate field name + s/\r// s/.*hw-id:\? *// # tolower hex mac address y/ABCDEF/abcdef/ diff --git a/templates/service/ssh/node.def b/templates/service/ssh/node.def index fbb29687..585357dd 100644 --- a/templates/service/ssh/node.def +++ b/templates/service/ssh/node.def @@ -1,17 +1,18 @@ help: Enable/disable Secure SHell (SSH) protocol -delete:expression: "sudo /usr/sbin/invoke-rc.d ssh stop && \ - sudo sh -c \"echo 'SSHD_OPTS=' > /etc/default/ssh\" " -end:expression: "if [ -z \"$VAR(port/@)\" ]; then exit 0; fi; \ - sudo sh -c \ - \"[ -f /etc/ssh/ssh_host_key ] \ - || sudo ssh-keygen -t rsa1 -N '' -f /etc/ssh/ssh_host_key\"; \ - case \"$VAR(protocol-version/@)\" in \ - v2) VER=2;; \ - v1) VER=1;; \ - all) VER=\"1,2\";; \ - *) VER=2;; \ - esac; \ - STR=\"SSHD_OPTS=\\\"-p $VAR(port/@) -o HostKey=/etc/ssh/ssh_host_key \ --o Protocol=${VER}\\\"\"; \ - sudo sh -c \"echo '$STR' > /etc/default/ssh\"; \ - sudo /usr/sbin/invoke-rc.d ssh restart" +delete:sudo /usr/sbin/invoke-rc.d ssh stop + sudo sh -c "echo 'SSHD_OPTS=' > /etc/default/ssh" +end: if [ -z "$VAR(port/@)" ]; then exit 0; fi; + if [ ! -f /etc/ssh/ssh_host_key ]; then + sudo ssh-keygen -q -t rsa1 -N '' -f /etc/ssh/ssh_host_key + fi + case $VAR(protocol-version/@) in + v2) VER=2;; + v1) VER=1;; + all) VER="1,2";; + *) VER=2;; + esac; + STR="SSHD_OPTS=\"-p $VAR(port/@) -o Hostkey=/etc/ssh/ssh_host_key -o Protocol=${VER}\"" + if ! grep -q -s "^$STR" /etc/default/ssh; then + sudo sh -c "echo '$STR' > /etc/default/ssh" + sudo /usr/sbin/invoke-rc.d ssh restart + fi diff --git a/templates/service/ssh/protocol-version/node.def b/templates/service/ssh/protocol-version/node.def index 051ea062..d025015b 100644 --- a/templates/service/ssh/protocol-version/node.def +++ b/templates/service/ssh/protocol-version/node.def @@ -1,3 +1,4 @@ type: txt +allowed: echo "v1 v2 all" default: "v2" help: Set SSH version (default: v2) |