diff --git a/.etckeeper b/.etckeeper index d01caf4..0fdebc4 100755 --- a/.etckeeper +++ b/.etckeeper @@ -2468,6 +2468,7 @@ maybe chmod 0644 'logrotate.d/httpd' maybe chmod 0644 'logrotate.d/iptraf-ng' maybe chmod 0644 'logrotate.d/kvm_stat' maybe chmod 0644 'logrotate.d/lfd' +maybe chmod 0644 'logrotate.d/mysecureshell' maybe chmod 0644 'logrotate.d/mysql' maybe chgrp 'named' 'logrotate.d/named' maybe chmod 0640 'logrotate.d/named' @@ -4671,6 +4672,7 @@ maybe chgrp 'sqlgrey' 'sqlgrey/sqlgrey.sql' maybe chmod 0640 'sqlgrey/sqlgrey.sql' maybe chmod 0755 'ssh' maybe chmod 0644 'ssh/moduli' +maybe chmod 0644 'ssh/sftp_config' maybe chmod 0644 'ssh/ssh_config' maybe chmod 0755 'ssh/ssh_config.d' maybe chmod 0644 'ssh/ssh_config.d/05-redhat.conf' diff --git a/group b/group index ece5fae..00443fa 100644 --- a/group +++ b/group @@ -101,3 +101,4 @@ cfb:x:1016: mailcow:x:1017: rundeck:x:1018: litecoin:x:1019: +bogdan:x:1020: diff --git a/group- b/group- index d96c4b8..ece5fae 100644 --- a/group- +++ b/group- @@ -100,3 +100,4 @@ _AodQqBu:x:1015: cfb:x:1016: mailcow:x:1017: rundeck:x:1018: +litecoin:x:1019: diff --git a/gshadow b/gshadow index 09cfb65..cc13286 100644 --- a/gshadow +++ b/gshadow @@ -101,3 +101,4 @@ cfb:!:: mailcow:!:: rundeck:!:: litecoin:!:: +bogdan:!:: diff --git a/gshadow- b/gshadow- index f670238..09cfb65 100644 --- a/gshadow- +++ b/gshadow- @@ -100,3 +100,4 @@ _AodQqBu:!:: cfb:!:: mailcow:!:: rundeck:!:: +litecoin:!:: diff --git a/logrotate.d/mysecureshell b/logrotate.d/mysecureshell new file mode 100644 index 0000000..d95744d --- /dev/null +++ b/logrotate.d/mysecureshell @@ -0,0 +1,9 @@ +/var/log/sftp-server.log { + weekly + size=500k + rotate 10 + compress + delaycompress + missingok + notifempty +} diff --git a/passwd b/passwd index 6be62ce..2194db2 100644 --- a/passwd +++ b/passwd @@ -72,3 +72,4 @@ cfb:x:1015:1016::/home/cfb:/bin/bash mailcow:x:1016:1017::/home/mailcow:/bin/bash rundeck:x:1017:1018::/var/lib/rundeck:/bin/bash litecoin:x:1018:1019::/opt/litecoin:/bin/bash +bogdan:x:1019:1020::/home/bogdan:/usr/bin/mysecureshell diff --git a/passwd- b/passwd- index 62f9126..6be62ce 100644 --- a/passwd- +++ b/passwd- @@ -71,3 +71,4 @@ _AodQqBu:x:1014:1015:_AodQqBu:/mnt/volume-fra1-01/backup2021:/sbin/nologin cfb:x:1015:1016::/home/cfb:/bin/bash mailcow:x:1016:1017::/home/mailcow:/bin/bash rundeck:x:1017:1018::/var/lib/rundeck:/bin/bash +litecoin:x:1018:1019::/opt/litecoin:/bin/bash diff --git a/shadow b/shadow index 12beed7..047d1c7 100644 --- a/shadow +++ b/shadow @@ -72,3 +72,4 @@ cfb:$6$qp3Fo53PpelMFPxu$kpw4lw/ODVjqSnohBn7MeduZuorwzWLD5QQGiZ5ARhGylK.56a7FswSh mailcow:$6$7vT203MTlIc8ROf0$VxXn56jKN5.UAPyXsgvv4r2XQDaL5yjo8Tk1We6rPS1eB7fRxbmIRMt8n4irsVtV4zhCwECzlZN8Q6kKezmwp0:18768:0:99999:7:30:: rundeck:!!:18772:0:99999:7:30:: litecoin:!!:18775:0:99999:7:30:: +bogdan:mCxaxi7Ck2FlI:18822:0:99999:7:30:: diff --git a/shadow- b/shadow- index e504307..12beed7 100644 --- a/shadow- +++ b/shadow- @@ -71,3 +71,4 @@ _AodQqBu:$1$SrfZx/5I$Xw.KOzTE2gE7eBTcbP7sB.:18658:0:99999:7:30:: cfb:$6$qp3Fo53PpelMFPxu$kpw4lw/ODVjqSnohBn7MeduZuorwzWLD5QQGiZ5ARhGylK.56a7FswSh/OaN/LcXYR3I92ZUshb9vgsOoksSr0:18731:0:99999:7:30:: mailcow:$6$7vT203MTlIc8ROf0$VxXn56jKN5.UAPyXsgvv4r2XQDaL5yjo8Tk1We6rPS1eB7fRxbmIRMt8n4irsVtV4zhCwECzlZN8Q6kKezmwp0:18768:0:99999:7:30:: rundeck:!!:18772:0:99999:7:30:: +litecoin:!!:18775:0:99999:7:30:: diff --git a/shells b/shells index f427b27..77b83dc 100644 --- a/shells +++ b/shells @@ -4,3 +4,4 @@ /usr/bin/bash /usr/bin/tmux /bin/tmux +/usr/bin/mysecureshell diff --git a/ssh/sftp_config b/ssh/sftp_config new file mode 100644 index 0000000..a4bd837 --- /dev/null +++ b/ssh/sftp_config @@ -0,0 +1,91 @@ +## MySecureShell Configuration File ## +#Default rules for everybody + + GlobalDownload 0 #total speed download for all clients + # o -> bytes k -> kilo bytes m -> mega bytes + GlobalUpload 0 #total speed download for all clients (0 for unlimited) + Download 0 #limit speed download for each connection + Upload 0 #unlimit speed upload for each connection + StayAtHome true #limit client to his home + VirtualChroot true #fake a chroot to the home account + LimitConnection 30 #max connection for the server sftp + LimitConnectionByUser 10 #max connection for the account + LimitConnectionByIP 10 #max connection by ip for the account +# Home /var/www/ #overrite home of the user but if you want you can use + # environment variable (ie: Home /home/$USER) + IdleTimeOut 600 #(in second) deconnect client is idle too long time + ResolveIP false #resolve ip to dns +# IgnoreHidden true #treat all hidden files as if they don't exist +# DirFakeUser true #Hide real file/directory owner (just change displayed permissions) +# DirFakeGroup true #Hide real file/directory group (just change displayed permissions) +# DirFakeMode 0400 #Hide real file/directory rights (just change displayed permissions) + #Add execution right for directory if read right is set +# HideFiles "^(lost\+found|public_html)$" #Hide file/directory which match + #this extented POSIX regex + HideNoAccess true #Hide file/directory which user has no access +# MaxOpenFilesForUser 20 #limit user to open x files on same time +# MaxWriteFilesForUser 10 #limit user to x upload on same time +# MaxReadFilesForUser 10 #limit user to x download on same time + DefaultRights 0664 0775 #Set default rights for new file and new directory +# MinimumRights 0400 0700 #Set minimum rights for files and dirs + +# PathDenyFilter "^\." #deny upload of directory/file which match this extented POSIX regex + + ShowLinksAsLinks false #show links as their destinations +# ConnectionMaxLife 1d #limits connection lifetime to 1 day + +# Charset "ISO-8859-15" #set charset of computer +# GMTTime +1 #set GMT Time (change if necessary) + + +#Rules only for group ftp +# +# Download 25 k/s +# LogFile /var/log/sftp-server_ftp.log #Change logfile +# ExpireDate "2007-02-28 18:31:01" +# + +# +# IsAdmin true #can admin the server +# VirtualChroot false #you must disable chroot to have a full support of admin +# StayAtHome true +# IdleTimeOut 0 +# + +# +# SftpProtocol 3 #force protocol SFTP +# DisableAccount true #disable account +# + +#Rules only for group ftpnolimit +# +# Download 0 #0 = unlimited +# IdleTimeOut 0 #no timeout +# DirFakeUser false #show real user on file/directory +# DirFakeGroup false #show real group on file/directory +# DirFakeMode 0 #show real rights on file/directory +# HideFiles "" #show all files +# MaxReadFilesForUser 0 #0 = unlimited but still have the restriction MaxOpenFilesForUser +# + +# +# ByPassGlobalDownload true #bypass GlobalDownload restriction +# ByPassGlobalUpload true #bypass GlobalUpload restriction +# Download 0 +# DisableAccount false #enable account +# IdleTimeOut 0 #disable timeout +# LimitConnectionByIP 0 #no limit +# + +# +# Shell /bin/tcsh #give a shell access to TRUSTED clients !!! +# + +# +# DirFakeUser false #show real user on file/directory +# DirFakeGroup false #show real group on file/directory +# DirFakeMode 0 #show real rights on file/directory +# HideNoAccess false +# IgnoreHidden false +# + diff --git a/subgid b/subgid index 9d889d0..6aa29a9 100644 --- a/subgid +++ b/subgid @@ -16,3 +16,4 @@ cfb:1017504:65536 mailcow:1083040:65536 rundeck:1148576:65536 litecoin:1214112:65536 +bogdan:1279648:65536 diff --git a/subgid- b/subgid- index e3c16d4..9d889d0 100644 --- a/subgid- +++ b/subgid- @@ -15,3 +15,4 @@ _AodQqBu:951968:65536 cfb:1017504:65536 mailcow:1083040:65536 rundeck:1148576:65536 +litecoin:1214112:65536 diff --git a/subuid b/subuid index 9d889d0..6aa29a9 100644 --- a/subuid +++ b/subuid @@ -16,3 +16,4 @@ cfb:1017504:65536 mailcow:1083040:65536 rundeck:1148576:65536 litecoin:1214112:65536 +bogdan:1279648:65536 diff --git a/subuid- b/subuid- index e3c16d4..9d889d0 100644 --- a/subuid- +++ b/subuid- @@ -15,3 +15,4 @@ _AodQqBu:951968:65536 cfb:1017504:65536 mailcow:1083040:65536 rundeck:1148576:65536 +litecoin:1214112:65536