149 lines
3.9 KiB
Bash
149 lines
3.9 KiB
Bash
#!/bin/sh
|
||
|
||
set -e
|
||
|
||
USERNAME="ansible"
|
||
GROUPNAME="ssh-access"
|
||
SSH_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICBpQgsPoNARIuzw+YTuADA8lk7S3y9wqvPxtDAsdYbw ansible@deploy"
|
||
|
||
# Farben
|
||
GREEN='\033[0;32m'
|
||
RED='\033[0;31m'
|
||
YELLOW='\033[0;33m'
|
||
BLUE='\033[0;34m'
|
||
NC='\033[0m'
|
||
|
||
# OS-Erkennung
|
||
if [ -f /etc/os-release ]; then
|
||
. /etc/os-release
|
||
OS_ID=$ID
|
||
else
|
||
printf "${RED}✗ Kann Betriebssystem nicht erkennen.${NC}\n"
|
||
exit 1
|
||
fi
|
||
|
||
# Alpine Setup
|
||
setup_alpine() {
|
||
printf "${BLUE}→ Alpine Linux erkannt – führe Setup aus${NC}\n"
|
||
|
||
# Repositories setzen
|
||
cat << 'EOF' > /etc/apk/repositories
|
||
https://dl-cdn.alpinelinux.org/alpine/latest-stable/main
|
||
https://dl-cdn.alpinelinux.org/alpine/latest-stable/community
|
||
EOF
|
||
|
||
apk update
|
||
apk add --no-cache curl bash sudo python3 openssh-server shadow linux-pam openssh-server-pam
|
||
|
||
# Benutzer anlegen
|
||
create_user_alpine
|
||
}
|
||
|
||
# Debian/Ubuntu Setup
|
||
setup_debian() {
|
||
printf "${BLUE}→ Debian/Ubuntu erkannt – führe Setup aus${NC}\n"
|
||
apt-get update && apt-get upgrade -y
|
||
create_user_debian
|
||
}
|
||
|
||
# RHEL/CentOS Setup
|
||
setup_rhel() {
|
||
printf "${BLUE}→ RHEL/AlmaLinux erkannt – führe Setup aus${NC}\n"
|
||
yum update -y || dnf update -y
|
||
create_user_rhel
|
||
}
|
||
|
||
# Benutzer anlegen
|
||
create_user_rhel() {
|
||
if id "$USERNAME" >/dev/null 2>&1; then
|
||
printf "${YELLOW}↷ Benutzer $USERNAME existiert bereits – überspringe${NC}\n"
|
||
else
|
||
sudo useradd -m -s /bin/bash "$USERNAME"
|
||
fi
|
||
common_user_setup
|
||
}
|
||
|
||
create_user_debian() {
|
||
if id "$USERNAME" >/dev/null 2>&1; then
|
||
printf "${YELLOW}↷ Benutzer $USERNAME existiert bereits – überspringe${NC}\n"
|
||
else
|
||
sudo adduser --disabled-password --gecos "" "$USERNAME"
|
||
fi
|
||
common_user_setup
|
||
}
|
||
|
||
create_user_alpine() {
|
||
if id "$USERNAME" >/dev/null 2>&1; then
|
||
printf "${YELLOW}↷ Benutzer $USERNAME existiert bereits – überspringe${NC}\n"
|
||
else
|
||
sudo adduser -D -s /bin/sh "$USERNAME"
|
||
fi
|
||
common_user_setup
|
||
}
|
||
|
||
# Gemeinsames Setup
|
||
common_user_setup() {
|
||
# Gruppe ssh-access anlegen
|
||
if ! getent group "$GROUPNAME" >/dev/null; then
|
||
printf "${BLUE}→ Lege Gruppe $GROUPNAME an${NC}\n"
|
||
case "$OS_ID" in
|
||
alpine)
|
||
sudo addgroup "$GROUPNAME"
|
||
;;
|
||
*)
|
||
sudo groupadd "$GROUPNAME"
|
||
;;
|
||
esac
|
||
fi
|
||
|
||
# Benutzer der Gruppe hinzufügen
|
||
printf "${BLUE}→ Füge Benutzer $USERNAME zur Gruppe $GROUPNAME hinzu${NC}\n"
|
||
case "$OS_ID" in
|
||
alpine)
|
||
sudo addgroup "$USERNAME" "$GROUPNAME"
|
||
;;
|
||
*)
|
||
sudo usermod -aG "$GROUPNAME" "$USERNAME"
|
||
;;
|
||
esac
|
||
|
||
# Benutzer entsperren, falls gesperrt
|
||
printf "${YELLOW}→ Überprüfe ob Benutzer $USERNAME in /etc/shadow gesperrt ist${NC}\n"
|
||
if sudo grep -E "^$USERNAME:(!+|\*+):" /etc/shadow >/dev/null; then
|
||
printf "${YELLOW}→ Benutzer ist gesperrt, entsperre für SSH-Key-Login${NC}\n"
|
||
sudo sed -i -r "s/^($USERNAME:)(!+|\*+)(:.*)/\1\3/" /etc/shadow
|
||
else
|
||
printf "${GREEN}→ Benutzer ist nicht gesperrt${NC}\n"
|
||
fi
|
||
|
||
# SSH-Verzeichnis & Key
|
||
sudo mkdir -p /home/$USERNAME/.ssh
|
||
echo "$SSH_KEY" | sudo tee /home/$USERNAME/.ssh/authorized_keys > /dev/null
|
||
sudo chmod 700 /home/$USERNAME/.ssh
|
||
sudo chmod 600 /home/$USERNAME/.ssh/authorized_keys
|
||
sudo chown -R $USERNAME:$USERNAME /home/$USERNAME/.ssh
|
||
|
||
# Sudo ohne Passwort
|
||
echo "$USERNAME ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/$USERNAME > /dev/null
|
||
sudo chmod 440 /etc/sudoers.d/$USERNAME
|
||
|
||
printf "${GREEN}✓ Benutzer $USERNAME wurde vollständig eingerichtet.${NC}\n"
|
||
}
|
||
|
||
# Hauptlogik
|
||
case "$OS_ID" in
|
||
alpine)
|
||
setup_alpine
|
||
;;
|
||
debian|ubuntu)
|
||
setup_debian
|
||
;;
|
||
almalinux|centos|rhel|rocky|fedora)
|
||
setup_rhel
|
||
;;
|
||
*)
|
||
printf "${RED}✗ Nicht unterstütztes Betriebssystem: $OS_ID${NC}\n"
|
||
exit 1
|
||
;;
|
||
esac
|