#!/bin/sh
# $Id: sshd_user.sh $

VERSION='$Revision 1.1 $'

version() {
	cat <<EOF
`basename $0` $VERSION
EOF
	exit 0
}

usage() {
	cat <<EOF
Usage: `basename $0` [options]

options:

 -u|--user     username                      (default: current user: ${USER})
 -p|--password password                      (do not use this option to be
                                              prompted for a password)
 -P|--port     port                          (default: 22)
 -s|--sshd     "sshd options"                (quotes are required, no default)
 -f|--config   sshd_config_file              (default: /etc/sshd_config)
 -c|--cygwin   "CYGWIN environment variable" (make sure to use quotes,
                                              default: "$CYGWIN")
 -S|--privsep                                (ignore
                                              "UsePrivilegeSeparation Yes"
                                              in /etc/sshd_config)
 -?|--help                                   (this help screen)
 -v|--version                                (display version)
EOF
	exit 1
}

PASSWD=
PORT=
PRIVSEP=1
SSHD=
SSHD_CONFIG=/etc/sshd_config

while [ $# -gt 0 ]
do
	case $1 in
	-u|--user)
		shift
		USER="$1"
		shift
		;;

	-p|--password)
		shift
		PASSWD="--passwd $1"
		shift
		;;
	-P|--port)
		shift
		PORT="-p $1"
		shift
		;;
	-s|--sshd)
		shift
		SSHD="$1"
		shift
		;;
	-f|--config)
		shift
		SSHD_CONFIG="$1"
		shift
		;;
	-c|--cygwin)
		shift
		CYGWIN="$1"
		shift
		;;
	-S|--privsep)
		shift
		PRIVSEP=0
		;;
	-v|--version)
		version;
		exit 0
		;;
	-?|--help|-h)
		usage;
		exit 0
		;;
	*)
		echo $0: Unknown option: "$1"
		usage;
		exit 0
		;;
	esac
done

if [ "$SSHD_CONFIG" != "/etc/sshd_config" ]
then
	SSHD="${SSHD} -f $SSHD_CONFIG"
fi

if [ ! -d "$HOME" ]
then
	echo `basename $0`: Directory not found: "$HOME"
	exit 2
fi

if [ ! -d "${HOME}/.ssh" ]
then
	echo `basename $0`: Directory not found "${HOME}/.ssh"
	echo Please run ssh-user-config to create your .ssh directory.
	exit 3
fi

if [ ! -f "/var/log/sshd_${USER}.log" ]
then
	touch "/var/log/sshd_${USER}.log"
fi

grep -q -i "^[[:space:]*]RSAAuthentication[[:space:]+]No" <$SSHD_CONFIG
if [ $? = 0 ]
then
	cat <<EOF
`basename $0`: $SSHD_CONFIG contains: RSAAuthentication No

A "USER" sshd daemon requires that RSAAuthentication be set to Yes
EOF
	if [ "$SSHD_CONFIG" = "/etc/sshd_config" ]
	then
		cat <<EOF

Either set RSAAuthentication to Yes in /etc/sshd_config, or
create a new config file, say $HOME/.ssh/sshd_config, with 
RSAAuthenticationn set to Yes and run `basename $0` specifying
this file with the -f option. For example:

`basename $0` -f "$HOME/.ssh/sshd_config"
EOF
	fi

	exit 4
fi

egrep -i -q "^[[:space:]]*UsePrivilegeSeparation[[:space:]]+No" <$SSHD_CONFIG
if [ $PRIVSEP = 1 -a $? = 1 ]
then
	cat <<EOF
`basename $0`: Error: $SSHD_CONFIG does not contain: UsePrivilegeSeparation No

Using PrivilegeSeparation precludes running a "SYSTEM" sshd daemon and a 
"USER" daemon at the same time.

EOF
	if [ "$SSHD_CONFIG" = "/etc/sshd_config" ]
	then
		cat <<EOF
Either set UsePrivilegeSeparation to No in /etc/sshd_config, or
create a new config file, say $HOME/.ssh/sshd_config, with 
  UsePrivilegeSeparation No
and run `basename $0` specifying
this file with the -f option. For example:

`basename $0` -f "$HOME/.ssh/sshd_config"
EOF
	fi

	cat <<EOF

If you *really* want to run a USER sshd daemon with 
UsePrivilegeSeparation set to Yes, use: `basename $0` -S
EOF

	exit 5
fi

ntrights +r SeServiceLogonRight -u "${USER}"
_RV=$?

if [ $_RV = 127 ];
then
	cat <<EOF

NTRights not found in the path.
You can download the tool from
\<http://www.petri.co.il/download_free_reskit_tools.htm\>
(per http://cygwin.com/ml/cygwin/2003-03/msg01318.html)

EOF
fi

if [ $_RV -gt 0 ];
then
	cat <<EOF

NTRights was not able to add the 'Log on as a Service' right to "${USER}".

To add the 'Log on as a Service' right to "${USER}", do the following:
Click Run
Select 'Control Panel'
Select 'Administrative Tools'
Select 'Local Security Policy'
Select 'Local Policies'
Select 'User Rights Assignment'
Double Click 'Log on as a Service'
Click Add
Enter ${USER}
Click 'Ok'
Click 'Ok'

EOF
fi

chown "${USER}".None "${HOME}" "${HOME}/.ssh" "/var/log/sshd_${USER}.log" 
chmod 600 /etc/ssh_host_*
chmod 644 /etc/ssh_host_*.pub
chmod 755 "${HOME}" "${HOME}/.ssh"
chmod -R 600 "${HOME}/.ssh"
chmod 644 \
	"${HOME}/.ssh/id_dsa.pub" \
	"${HOME}/.ssh/id_rsa.pub" \
	"${HOME}/.ssh/identity.pub" \
	"/var/log/sshd_${USER}.log"

setfacl -m u:"${USER}":rwx /var/empty
setfacl -m u:"${USER}":r-- /etc/ssh*
# Per http://cygwin.com/ml/cygwin/2002-11/msg00293.html
touch "${HOME}/.ssh/authorized_keys" "${HOME}/.ssh/authorized_keys2"
setfacl -m g:SYSTEM:r-- "${HOME}/.ssh/authorized_keys" "${HOME}/.ssh/authorized_keys2"

cygrunsrv --stop "sshd_${USER}"
cygrunsrv --remove "sshd_${USER}"
cygrunsrv --install "sshd_${USER}" \
  --path /usr/sbin/sshd.exe \
  --disp "sshd_${USER}" \
  --desc "Cygwin's OpenSSH daemon; sshd options='${PORT} ${SSHD}'; CYGWIN='${CYGWIN}'" \
  --user "${USER}" \
  ${PASSWD} \
  --env "CYGWIN=${CYGWIN}" \
  --stdout "/var/log/sshd_${USER}.log" \
  --stderr "/var/log/sshd_${USER}.log" \
  --args "-e -D ${PORT} ${SSHD}"
cygrunsrv --start "sshd_${USER}"