modsshd_config.pl

#!/bin/perl
# $Id:$
#
#
#
#
##########################################################################
###############  S P A W A R   S H A R E D   S E R V I C E S  ############
##########################################################################
#
#          File:  modsshd_config.pl
#        Author:
#          Date:  Friday, October 24, 2014
#
#                 Generated by bshdr
#                 Developed by Gene Brandt
#                 504 452-3250
#
##########################################################################
#
#	Description:
#	Modified the AllowUsers in the /etc/ssh/sshd_config file.
#       *** This script is called by another whenever a change is
#       *** needed to the sshd_config file. When a change occurs
#       *** the ssh service is refreshed to activate the changes.
#       *** You may run this script manually as root.
#
#       Modified to compensate for "match" lines. These must occur at the
#       end of the configuration file. Any new "Allow" line must be placed
#       before a "match" line.
#
##########################################################################
###############  S P A W A R   S H A R E D   S E R V I C E S  ############
##########################################################################
#                            Environmentals                              #
##########################################################################
#
#

$DEBUG   = 0;
$DateExt = `date "+%Y%m%d%T"`;
chomp($DateExt);
chomp( $Userinfo = `/usr/bin/id` );
$SSHDFile      = "/etc/ssh/sshd_config";
$SSHDBuildFile = "/etc/ssh/sshd_config_build";
$ROOT          = 0;
$SYS           = 3;
$MAXENTRY = 6;    #      Maximum number of entries on an
                  #      AllowUsers line.

#
#
##########################################################################
###############  S P A W A R   S H A R E D   S E R V I C E S  ############
##########################################################################
#                               Processing                               #
##########################################################################
#
#

use File::Copy;

#
#      Only root can run this.
#

$Userinfo            =~ tr /=/ /;      # Break into space delimited for splitting.
$Userinfo            =~ tr /(/ /;      # Change the "=" and "("'s into spaces.
@InFo                = split( /\s+/, $Userinfo );
$CurrentUserId       = $InFo[1];       # Get the current users ID.
$RemoteHost = `hostname`;              # The host's name on which we're running.
chomp($RemoteHost);

if ($DEBUG) {
    printf "     DEBUG: Current UID: %d\n\n", $CurrentUserId;
}

if ( $CurrentUserId != 0 ) {
    printf "\n\n     Error: $0 can only be run by root!\n\n";
    exit 1;
}

#
#     Chaeck the command line for correct number of parameters.
#

if ($DEBUG) {
    printf "     DEBUG: Number of command line arguments %d\n\n", $#ARGV;
}

if ( $#ARGV != 1 ) {
    printf "\n\n     Usage: $0 [add/rm] [userid]\n\n";
    exit 1;
}

if ($DEBUG) {
    printf "     DEBUG: Commandline args: %s %s\n\n", $ARGV[0], $ARGV[1];
}

$Action  = $ARGV[0];
$Action = lc($Action);     #    Make sure it's all lower case.

#
#       Verify a valid action is specified.
#

if ( $Action ne 'rm' && $Action ne 'add')
   {
   printf "     Error: %s is an ivalid action.\n", $Action;
   exit;
   }

$NewUser = $ARGV[1];
chomp($NewUser);     #     Because this is the last parameter and contains a newline.

#
#     Make a copy of the /etc/ssh/sshd_config.
#     Add a time stamp to the file's name.
#

$SSHDFileCopy .= $SSHDFile;
$SSHDFileCopy .= "_";
$SSHDFileCopy .= $DateExt;

if ($DEBUG) {
    printf "\n\n     DEBUG: Copying $SSHDFile to $SSHDFileCopy\n\n";
}
copy( $SSHDFile, $SSHDFileCopy );
#
#     Change the new copy owner and oernmissions.
#

chown( $ROOT, $SYS, $SSHDFileCopy );
chmod( 0644, $SSHDFileCopy );

#
#     Add the user's id to an AllowUser line with less than $MAXENTRY entries.
#     Add by building a temporary ssh_config file.
#
open( SSHD, ">$SSHDBuildFile" )     #      Open a new sshd_config file.
  || die "\n\n     Can't open $SSHDBuildFile $!\n\n";
open( OLDSSHD, $SSHDFileCopy )      #      Open the copy and read it.
  || die "\n\n     Can't open $SSHDFileCopy $!\n\n";
if ( $Action eq "add" ) {

    while (<OLDSSHD>) {     #     Read through the old file.
        chomp();
        if (/^AllowUsers/) {#     Found an AllowUser's line.
            @entry = split(/\s+/);   # Get the words on the line.
            if ($DEBUG) {
                printf "\n\n     DEBUG: AllowUsers entries: %d\n\n", $#entry;
            }
            if ( $#entry <
                $MAXENTRY )    # There was enough space on an existing line.
            {                  # to add the entry.
                printf SSHD "@entry";     # Write the current entries.
                printf SSHD " $NewUser\n";# Add the new entry.
                printf "     @entry";     # Display the changed line.
                printf " $NewUser\n";
                $MAXENTRY = 1;            # Reset the flag, because the user was added.
                next;
            }
        printf SSHD "$_\n";
        }
        else {      #    It wasn't an AllowUsers line. Check for a match line.
            if (/^[M,m][A,a][T,t][C,c][H,h]/)    # We found the startof a match block.
            {
                if ($DEBUG) {
                    printf "     Debug: We found a match line.\n";
                }
                if ( $MAXENTRY !=
                    1 )    # We didn't find an AllowUsers line to append.
                {
                    printf SSHD "AllowUsers $NewUser\n"; # Add a new AllowUsers line.
                    printf "AllowUsers $NewUser\n";
                }

            }
            printf SSHD "$_\n";     # It was neither, so just copy the line.
            next;
        }    # else end
    }
}

$WordCount = 0;              # Initialize the line's word count.
if ( $Action eq "rm" ) {     # Remove the user's name.
    while (<OLDSSHD>) {
        chomp();
        if (/$NewUser/) {    # We found a line with the username to remove.
            @entry = split(/\s+/);     #     Split the line into separate words.
            if ( $#entry < 2 )    # Delete a line with only 1 userid entry.
            {                     # sshd doesn't line empty AllowUsers lines.
                next;
            }
            if ($DEBUG) {
                printf "\n\n     DEBUG: AllowUsers entries: %d\n\n", $#entry;
            }
            foreach $word (@entry) {     #     Go through each word on the line.
                chomp($word);
                if ($DEBUG) { printf "     DEBUG:     $word    $NewUser\n"; }
                if ( $word ne $NewUser ) {     # Copy the word if it is not the username to remove.
                    printf SSHD "$word ";
                    if ($DEBUG) { printf "     DEBUG:     $word\n"; }
                }
            }
            printf SSHD "\n";     #     Add a newline to finish the line.
            next;
        }
        printf SSHD "$_\n";     #     NO user name match, so just copy the line.
    }
}
close(OLDSSHD);     #     Close the file pointers.
close(SSHD);        #     Close the file pointers.

#
#
##########################################################################
###############  S P A W A R   S H A R E D   S E R V I C E S  ############
##########################################################################
#                               House Keeping                            #
##########################################################################
#
#

#
#     Make sure the file ownership and permissions are correct.
#

chown( $ROOT, $SYS, $SSHDBuildFile );
chmod( 0644, $SSHDBuildFile );
move( $SSHDBuildFile, $SSHDFile );     # Move the new file into place.

#
#       Refresh the sshd service.
#

printf "     Refreshing svc:/network/ssh\n     ";
system("/usr/sbin/svcadm restart ssh");
#
#     Check the status of the sevice. Wait for a few seconds for the process
#     to complete.
#

sleep(5);
printf "     ";
system("/usr/bin/svcs |grep ssh");
printf "     $RemoteHost /etc/ssh/sshd_config modified.\n\n";

#
#      Cleanup the old sshd_condfig files.
#

$SshdDir = "/etc/ssh";
chdir($SshdDir);
opendir $SshdFH, $SshdDir || die "Couldn't open dir '$SshdDir: $!\n";
@Sshdfile = readdir $SshdFH;    # Read the directory listing into an array.
closedir $SshdFH;
$CleanupCount = 0;
$KeepCount    = 2;
foreach $OldSshd ( sort @Sshdfile ) {
    if ( $OldSshd =~ /sshd_config_2/ ) {   # Looking for file names we created.
        $CleanupCount++;                   # Count them.
        if ($DEBUG) {
            printf "%2d\n", $CleanupCount;
        }
    }
}
foreach $OldSshd ( sort @Sshdfile ) {      # Looking for file names we created.
    if ( $OldSshd =~ /sshd_config_2/ && $CleanupCount > $KeepCount ) {
        if ($DEBUG) {
            printf "%2d    %s\n", $CleanupCount--, $OldSshd;
        }
        unlink($OldSshd);     #  Keep on the last $KeepCount number of files.
    }
}