Files
profile/profile.d/ssh.sh
fatalerrors d72fa1a712 hardening
2026-04-01 17:21:54 +02:00

155 lines
5.1 KiB
Bash

#!/usr/bin/env bash
# ------------------------------------------------------------------------------
# Copyright (c) 2013-2026 Geoffray Levasseur <fatalerrors@geoffray-levasseur.org>
# Protected by the BSD3 license. Please read bellow for details.
#
# * Redistribution and use in source and binary forms,
# * with or without modification, are permitted provided
# * that the following conditions are met:
# *
# * Redistributions of source code must retain the above
# * copyright notice, this list of conditions and the
# * following disclaimer.
# *
# * Redistributions in binary form must reproduce the above
# * copyright notice, this list of conditions and the following
# * disclaimer in the documentation and/or other materials
# * provided with the distribution.
# *
# * Neither the name of the copyright holder nor the names
# * of any other contributors may be used to endorse or
# * promote products derived from this software without
# * specific prior written permission.
# *
# * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
# * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
# * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
# * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# * OF SUCH DAMAGE.
# ------------------------------------------------------------------------------
# ------------------------------------------------------------------------------
# Remove host from know_host (name and IP) for the active user
# Usage: rmhost <hostname|ip> [hostname2|ip2 [...]]
rmhost()
{
local PARSED
PARSED=$(getopt -o h --long help -n 'rmhost' -- "$@")
if [[ $? -ne 0 ]]; then return 1; fi
eval set -- "$PARSED"
while true; do
case "$1" in
-h|--help)
printf "rmhost: Remove host/IP from ~/.ssh/known_hosts.\n\n"
printf "Usage: rmhost <hostname|ip> [hostname2|ip2 ...]\n\n"
printf "Options:\n"
printf " -h, --help Display this help screen\n"
return 0
;;
--)
shift
break
;;
*)
disp E "Invalid options, use \"rmhost --help\" to display usage."
return 1
;;
esac
done
[[ $# -eq 0 ]] && {
disp E "Missing argument. Use 'rmhost --help' for usage."
return 1
}
command -v ssh-keygen >/dev/null 2>&1 || {
disp E "ssh-keygen is not installed."
return 127
}
for target in "$@"; do
local hst="$target"
local ip=""
local v4=1
local v6=1
isipv4 "$hst" >/dev/null 2>&1; v4=$?
isipv6 "$hst" >/dev/null 2>&1; v6=$?
if [[ $v4 -eq 0 || $v6 -eq 0 ]]; then
ip="$hst"
hst=""
fi
if [[ -z ${ip:-} && -n ${hst:-} ]]; then
if command -v host >/dev/null 2>&1; then
ip=$(host "$hst" 2>/dev/null | awk '/has address/ {print $NF; exit}')
[[ -z ${ip:-} ]] && \
disp W "Could not resolve IP for '$hst'; removing hostname only."
else
disp W "'host' is not installed; removing hostname only for '$hst'."
fi
fi
if [[ -n ${hst:-} ]]; then
disp I "Removing host $hst from ssh known_hosts..."
ssh-keygen -R "$hst" >/dev/null
fi
if [[ -n ${ip:-} ]]; then
disp I "Removing IP $ip from ssh known_hosts..."
ssh-keygen -R "$ip" >/dev/null
fi
done
}
export -f rmhost
# ------------------------------------------------------------------------------
# ------------------------------------------------------------------------------
# Login root via SSH on the given machine
# Usage: ssr <server [ssh options]>
ssr()
{
case "${1:-}" in
-h|--help)
printf "ssr: SSH into a server as root.\n\n"
printf "Usage: ssr <server> [ssh_options...]\n\n"
printf "Notes:\n"
printf " The first argument is the target server.\n"
printf " All remaining arguments are passed directly to ssh.\n\n"
printf "Examples:\n"
printf " ssr srv01\n"
printf " ssr srv01 -p 2222\n"
printf " ssr srv01 -i ~/.ssh/id_ed25519 -J bastion\n"
return 0
;;
esac
command -v ssh >/dev/null 2>&1 || {
disp E "ssh is not installed."
return 127
}
[[ $# -eq 0 || -z ${1:-} ]] && {
disp E "Please specify the server you want to log in."
return 1
}
local srv=$1
shift
ssh -Y root@"$srv" "$@"
}
export -f ssr
# ------------------------------------------------------------------------------
# EOF