add sshd config files

these contain a hard-coded username at the moment

4 files changed, 15 insertions, 0 deletions

diff --git a/Makefile b/Makefile
index 12b9329..e9b3bf9 100644
--- a/Makefile
+++ b/Makefile
@@ -42,6 +42,8 @@ bindir = /usr/local/bin
 
 default: install start follow
 install:
+        install -t /etc/ssh/ -- src/user-d.AnonymousForceCommand src/user-d.AuthorizedKeysCommand
+        install -m644 -t /etc/ssh/sshd_config.d -- src/fossil-user.conf
         install -m644 -t $(unitdir) -- $(unit_files)
         install -t $(bindir) -- $(executables)
         systemctl daemon-reload
diff --git a/src/fossil-user.conf b/src/fossil-user.conf
new file mode 100644
index 0000000..f4296fd
--- /dev/null
+++ b/src/fossil-user.conf
@@ -0,0 +1,4 @@
+Match User d
+ExposeAuthInfo=yes
+AuthorizedKeysCommandUser=root
+AuthorizedKeysCommand=/etc/ssh/user-d.AuthorizedKeysCommand "%t %k" "%f"
diff --git a/src/user-d.AnonymousForceCommand b/src/user-d.AnonymousForceCommand
new file mode 100755
index 0000000..a8a09f3
--- /dev/null
+++ b/src/user-d.AnonymousForceCommand
@@ -0,0 +1,2 @@
+#!/bin/bash
+socat stdio /run/fossil-user.S
diff --git a/src/user-d.AuthorizedKeysCommand b/src/user-d.AuthorizedKeysCommand
new file mode 100755
index 0000000..6bf0ec9
--- /dev/null
+++ b/src/user-d.AuthorizedKeysCommand
@@ -0,0 +1,7 @@
+#!/bin/sh
+cmd=/etc/ssh/user-d.AnonymousForceCommand
+[ -x "$cmd" ] || exit
+
+key=$1
+shift
+printf 'restrict,pty,command="%s" %s\n' "$cmd $*" "$key"