1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
|
From 9601745f3f75eea748ec93f90b1b1a3023b6514d Mon Sep 17 00:00:00 2001
From: Florian Schmaus <flo@geekplace.eu>
Date: Tue, 28 May 2024 11:08:31 +0200
Subject: [PATCH 1/5] gs-init-secret: add new script
The gs-init-secret script can be used to securely initialize a file
containing a gsocket secret.
---
tools/Makefile.am | 2 +-
tools/gs-init-secret | 33 +++++++++++++++++++++++++++++++++
2 files changed, 34 insertions(+), 1 deletion(-)
create mode 100755 tools/gs-init-secret
diff --git a/tools/Makefile.am b/tools/Makefile.am
index 805fedd..9af4df0 100755
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -38,7 +38,7 @@ gs_netcat_SOURCES = 4_gs-netcat.c utils.c socks.c console.c ids.c event_mgr.c pk
gs_netcat_LDADD = ../lib/libgsocket.a @LDADD_STATIC@
gs_netcat_CFLAGS = @CFLAGS_STATIC@
-dist_bin_SCRIPTS = blitz gs-sftp gs-mount gsocket
+dist_bin_SCRIPTS = blitz gs-sftp gs-mount gsocket gs-init-secret
gsocket_uchroot_dso_so_0_SOURCES = gsocket_uchroot_dso.c
gsocket_uchroot_dso_so_0_CFLAGS = -shared -fPIC
diff --git a/tools/gs-init-secret b/tools/gs-init-secret
new file mode 100755
index 0000000..f2782f1
--- /dev/null
+++ b/tools/gs-init-secret
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -eu
+
+if [[ $# -eq 2 ]]; then
+ >&2 echo "ERROR: Must provide exactly one argument"
+ exit 1
+fi
+
+SECRET_FILE="${1}"
+
+if [[ -f "${SECRET_FILE}" ]]; then
+ SECRET_FILE_PERMS="$(stat -c %a "${SECRET_FILE}")"
+ if [[ ${SECRET_FILE_PERMS} != [0-9][0-9]0 ]]; then
+ >&2 echo "ERROR: ${SECRET_FILE} has world-permissions set (${SECRET_FILE_PERMS})"
+ exit 1
+ fi
+
+ exit
+fi
+
+TARGET_DIR="$(dirname "${SECRET_FILE}")"
+if [[ ! -d "${TARGET_DIR}" ]]; then
+ mkdir -p "${TARGET_DIR}"
+fi
+
+MY_TMPDIR=$(mktemp -d --tmpdir="${TMPDIR:-/tmp}")
+trap 'rm -rf ${MY_TMPDIR}' EXIT
+
+SECRET_FILE_TMP="${MY_TMPDIR}/secret"
+
+gs-netcat -g > "${SECRET_FILE_TMP}"
+
+install --mode=400 "${SECRET_FILE_TMP}" "${SECRET_FILE}"
From 756a515a116b5e13f6b5ba95ebbee676d34bfbd8 Mon Sep 17 00:00:00 2001
From: Florian Schmaus <flo@geekplace.eu>
Date: Tue, 28 May 2024 11:10:53 +0200
Subject: [PATCH 2/5] gs-root-shell.service: use gs-init-secret
---
examples/systemd-root-shell/gs-root-shell.service | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/examples/systemd-root-shell/gs-root-shell.service b/examples/systemd-root-shell/gs-root-shell.service
index 5b0e9a1..278de73 100644
--- a/examples/systemd-root-shell/gs-root-shell.service
+++ b/examples/systemd-root-shell/gs-root-shell.service
@@ -7,7 +7,8 @@ Type=simple
Restart=always
RestartSec=10
WorkingDirectory=/root
-ExecStart=gs-netcat -k /etc/systemd/gs-root-shell-key.txt -il
+ExecStartPre=gs-init-secret /etc/gsocket/gs-root-shell-key
+ExecStart=gs-netcat -k /etc/gsocket/gs-root-shell-key -il
[Install]
WantedBy=multi-user.target
From 5e72debc560cc18e36d9066653fba864a366b4c3 Mon Sep 17 00:00:00 2001
From: Florian Schmaus <flo@geekplace.eu>
Date: Tue, 28 May 2024 11:11:43 +0200
Subject: [PATCH 3/5] gs-root-shell.service: drop Type=simple, as it is the
default
---
examples/systemd-root-shell/gs-root-shell.service | 1 -
1 file changed, 1 deletion(-)
diff --git a/examples/systemd-root-shell/gs-root-shell.service b/examples/systemd-root-shell/gs-root-shell.service
index 278de73..92a9814 100644
--- a/examples/systemd-root-shell/gs-root-shell.service
+++ b/examples/systemd-root-shell/gs-root-shell.service
@@ -3,7 +3,6 @@ Description=Global Socket Root Shell
After=network.target
[Service]
-Type=simple
Restart=always
RestartSec=10
WorkingDirectory=/root
From 9aa3a85656e8917720568a9b019cc774636b9d23 Mon Sep 17 00:00:00 2001
From: Florian Schmaus <flo@geekplace.eu>
Date: Tue, 28 May 2024 11:12:17 +0200
Subject: [PATCH 4/5] gs-root-shell.service: set RestartSteps=10 and cap
restart delays at 30min
---
examples/systemd-root-shell/gs-root-shell.service | 2 ++
1 file changed, 2 insertions(+)
diff --git a/examples/systemd-root-shell/gs-root-shell.service b/examples/systemd-root-shell/gs-root-shell.service
index 92a9814..5d52050 100644
--- a/examples/systemd-root-shell/gs-root-shell.service
+++ b/examples/systemd-root-shell/gs-root-shell.service
@@ -5,6 +5,8 @@ After=network.target
[Service]
Restart=always
RestartSec=10
+RestartSteps=10
+RestartMaxDelaySec=30m
WorkingDirectory=/root
ExecStartPre=gs-init-secret /etc/gsocket/gs-root-shell-key
ExecStart=gs-netcat -k /etc/gsocket/gs-root-shell-key -il
From 24eb0d5606bbe38a4b401394933f4dbe9b851a5c Mon Sep 17 00:00:00 2001
From: Florian Schmaus <flo@geekplace.eu>
Date: Tue, 28 May 2024 11:13:14 +0200
Subject: [PATCH 5/5] gs-root-shell.service: configure service to await
network-online.target
---
examples/systemd-root-shell/gs-root-shell.service | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/examples/systemd-root-shell/gs-root-shell.service b/examples/systemd-root-shell/gs-root-shell.service
index 5d52050..439890e 100644
--- a/examples/systemd-root-shell/gs-root-shell.service
+++ b/examples/systemd-root-shell/gs-root-shell.service
@@ -1,6 +1,7 @@
[Unit]
Description=Global Socket Root Shell
-After=network.target
+After=network-online.target
+Wants=network-online.target
[Service]
Restart=always
|
