diff --git a/fstack/files/new_user.php b/fstack/files/new_user.php new file mode 100644 index 0000000..52e9bcb --- /dev/null +++ b/fstack/files/new_user.php @@ -0,0 +1,422 @@ + array("label" => "Account UID"))); +} + +if ( isset($_POST['setup_admin_account']) ) { + + $admin_setup = TRUE; + + validate_setup_cookie(); + set_page_access("setup"); + + $completed_action="${SERVER_PATH}log_in"; + $page_title="New administrator account"; + + render_header("$ORGANISATION_NAME account manager - setup administrator account", FALSE); + +} +else { + set_page_access("admin"); + + $completed_action="${THIS_MODULE_PATH}/"; + $page_title="New account"; + $admin_setup = FALSE; + + render_header("$ORGANISATION_NAME account manager"); + render_submenu(); +} + +$invalid_password = FALSE; +$mismatched_passwords = FALSE; +$invalid_username = FALSE; +$weak_password = FALSE; +$invalid_email = FALSE; +$disabled_email_tickbox = TRUE; +$invalid_cn = FALSE; +$invalid_account_identifier = FALSE; +$account_attribute = $LDAP['account_attribute']; + +$new_account_r = array(); + +foreach ($attribute_map as $attribute => $attr_r) { + + if (isset($_FILES[$attribute]['size']) and $_FILES[$attribute]['size'] > 0) { + + $this_attribute = array(); + $this_attribute['count'] = 1; + $this_attribute[0] = file_get_contents($_FILES[$attribute]['tmp_name']); + $$attribute = $this_attribute; + $new_account_r[$attribute] = $this_attribute; + unset($new_account_r[$attribute]['count']); + + } + + if (isset($_POST[$attribute])) { + + $this_attribute = array(); + + if (is_array($_POST[$attribute]) and count($_POST[$attribute]) > 0) { + foreach($_POST[$attribute] as $key => $value) { + if ($value != "") { $this_attribute[$key] = filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS); } + } + if (count($this_attribute) > 0) { + $this_attribute['count'] = count($this_attribute); + $$attribute = $this_attribute; + } + } + elseif ($_POST[$attribute] != "") { + $this_attribute['count'] = 1; + $this_attribute[0] = filter_var($_POST[$attribute], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $$attribute = $this_attribute; + } + + } + + if (!isset($$attribute) and isset($attr_r['default'])) { + $$attribute['count'] = 1; + $$attribute[0] = $attr_r['default']; + } + + if (isset($$attribute)) { + $new_account_r[$attribute] = $$attribute; + unset($new_account_r[$attribute]['count']); + } + +} + +## + +if (isset($_GET['account_request'])) { + + $givenname[0]=filter_var($_GET['first_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $new_account_r['givenname'] = $givenname[0]; + unset($new_account_r['givenname']['count']); + + $sn[0]=filter_var($_GET['last_name'], FILTER_SANITIZE_FULL_SPECIAL_CHARS); + $new_account_r['sn'] = $sn[0]; + unset($new_account_r['sn']['count']); + + $mail[0]=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); + if ($mail[0] == "") { + if (isset($EMAIL_DOMAIN)) { + $mail[0] = $uid . "@" . $EMAIL_DOMAIN; + $disabled_email_tickbox = FALSE; + } + } + else { + $disabled_email_tickbox = FALSE; + } + $new_account_r['mail'] = $mail; + unset($new_account_r['mail']['count']); + +} + + +if (isset($_GET['account_request']) or isset($_POST['create_account'])) { + + if (!isset($uid[0])) { + $uid[0] = generate_username($givenname[0],$sn[0]); + $new_account_r['uid'] = $uid; + unset($new_account_r['uid']['count']); + } + + if (!isset($cn[0])) { + if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) { + $cn[0] = $givenname[0] . $sn[0]; + } + else { + $cn[0] = $givenname[0] . " " . $sn[0]; + } + $new_account_r['cn'] = $cn; + unset($new_account_r['cn']['count']); + } + +} + + +if (isset($_POST['create_account'])) { + + $password = $_POST['password']; + $new_account_r['password'][0] = $password; + $account_identifier = $new_account_r[$account_attribute][0]; + $this_cn=$cn[0]; + $this_mail=$mail[0]; + $this_givenname=$givenname[0]; + $this_sn=$sn[0]; + $this_password=$password[0]; + + if (!isset($this_cn) or $this_cn == "") { $invalid_cn = TRUE; } + if ((!isset($account_identifier) or $account_identifier == "") and $invalid_cn != TRUE) { $invalid_account_identifier = TRUE; } + if ((!is_numeric($_POST['pass_score']) or $_POST['pass_score'] < 3) and $ACCEPT_WEAK_PASSWORDS != TRUE) { $weak_password = TRUE; } + if (isset($this_mail) and !is_valid_email($this_mail)) { $invalid_email = TRUE; } + if (preg_match("/\"|'/",$password)) { $invalid_password = TRUE; } + if ($password != $_POST['password_match']) { $mismatched_passwords = TRUE; } + if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE and !preg_match("/$USERNAME_REGEX/",$account_identifier)) { $invalid_account_identifier = TRUE; } + if (isset($_POST['send_email']) and isset($mail) and $EMAIL_SENDING_ENABLED == TRUE) { $send_user_email = TRUE; } + + if ( isset($this_givenname) + and isset($this_sn) + and isset($this_password) + and !$mismatched_passwords + and !$weak_password + and !$invalid_password + and !$invalid_account_identifier + and !$invalid_cn + and !$invalid_email) { + + $ldap_connection = open_ldap_connection(); + $new_account = ldap_new_account($ldap_connection, $new_account_r); + + if ($new_account) { + $testout = shell_exec ("sudo -u ansible ansible nextcloud -a \"sudo -u www-data php -d memory_limit=-1 -f /var/www/html/occ user:list | grep $this_cn\" -u ansible -m shell"); + $string1 = explode(':', $testout); + $string2 = explode(' ', $string1[0]); + $newmail = explode('@', $this_mail); + + $command1 = shell_exec("sudo -u ansible ansible nextcloud -a \"sudo -u www-data php -d memory_limit=-1 -f /var/www/html/occ mail:account:create $string2[8] $newmail[0] $newmail[0]@$newmail[1] mail.$newmail[1] 993 ssl $newmail[0]@$newmail[1] $password mail.$newmail[1] 465 ssl $newmail[0]@$newmail[1] $password password\" -u ansible -m shell"); + $creation_message = "The account was created."; + + if (isset($send_user_email) and $send_user_email == TRUE) { + + include_once "mail_functions.inc.php"; + + $mail_body = parse_mail_text($new_account_mail_body, $password, $account_identifier, $this_givenname, $this_sn); + $mail_subject = parse_mail_text($new_account_mail_subject, $password, $account_identifier, $this_givenname, $this_sn); + + $sent_email = send_email($this_mail,"$this_givenname $this_sn",$mail_subject,$mail_body); + $creation_message = "The account was created"; + if ($sent_email) { + $creation_message .= " and an email sent to $this_mail."; + } + else { + $creation_message .= " but unfortunately the email wasn't sent.
More information will be available in the logs."; + } + } + + if ($admin_setup == TRUE) { + $member_add = ldap_add_member_to_group($ldap_connection, $LDAP['admins_group'], $account_identifier); + if (!$member_add) { ?> +
+

Unfortunately adding it to the admin group failed.

+
+ +
+

+
+
+

+ +

+
+ +
+

Failed to create the account:

+
+     
+     
+
+ The Common Name is required\n"; } +if ($invalid_account_identifier) { $errors.="
  • The account identifier (" . $attribute_map[$account_attribute]['label'] . ") is invalid.
  • \n"; } +if ($weak_password) { $errors.="
  • The password is too weak
  • \n"; } +if ($invalid_password) { $errors.="
  • The password contained invalid characters
  • \n"; } +if ($invalid_email) { $errors.="
  • The email address is invalid
  • \n"; } +if ($mismatched_passwords) { $errors.="
  • The passwords are mismatched
  • \n"; } +if ($invalid_username) { $errors.="
  • The username is invalid
  • \n"; } + +if ($errors != "") { ?> +
    +

    + There were issues creating the account: +

    +

    +
    + + + + + + + + + + + +
    +
    + +
    +
    +
    + +
    + + + + + + $attr_r) { + $label = $attr_r['label']; + if (isset($attr_r['onkeyup'])) { $onkeyup = $attr_r['onkeyup']; } else { $onkeyup = ""; } + if ($attribute == $LDAP['account_attribute']) { $label = "$label*"; } + if (isset($$attribute)) { $these_values=$$attribute; } else { $these_values = array(); } + if (isset($attr_r['inputtype'])) { $inputtype = $attr_r['inputtype']; } else { $inputtype = ""; } + render_attribute_fields($attribute,$label,$these_values,"",$onkeyup,$inputtype,$tabindex); + $tabindex++; + } + ?> + +
    + +
    + +
    +
    + +
    +
    + +
    + +
    + +
    +
    + + +
    + +
    + > Email these credentials to the user? +
    +
    + + +
    + +
    + +
    + +
    +
    +
    + +
    *The account identifier
    + +
    +
    + +
    +
    + diff --git a/fstack/lib/checks.sh b/fstack/lib/checks.sh index a85badf..72efc31 100644 Binary files a/fstack/lib/checks.sh and b/fstack/lib/checks.sh differ diff --git a/fstack/lib/nextcloud.sh b/fstack/lib/nextcloud.sh index b871fec..20ac0e1 100644 --- a/fstack/lib/nextcloud.sh +++ b/fstack/lib/nextcloud.sh @@ -48,6 +48,9 @@ services: hostname: nextcloud.$DOMAIN domainname: $DOMAIN restart: always + build: + context: . + dockerfile: Dockerfile networks: fstack: ipv4_address: 172.99.0.15 @@ -77,9 +80,57 @@ networks: external: true EOF +cat > fstack/nextcloud/supervisord.conf < fstack/nextcloud/Dockerfile <> /etc/sudoers \ +&& useradd -m ansible -s /bin/bash \ +&& sudo -u ansible mkdir /home/ansible/.ssh \ +&& mkdir -p /var/run/sshd + +RUN apt-get install -y supervisor \ + && rm -rf /var/lib/apt/lists/* \ + && mkdir /var/log/supervisord /var/run/supervisord + +COPY supervisord.conf / + +ENV NEXTCLOUD_UPDATE=1 + +CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"] +EOF + cat > fstack/nextcloud/data/root/nextcloud.sh < fstack/nextcloud/data/etc/apache2/sites-enabled/000-default.conf <<'EOF' LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so @@ -170,14 +219,14 @@ start_nextcloud() { if [ $DEBUG ]; then # Start fstack/nextcloud with output to console for debug - docker-compose -f fstack/nextcloud/docker-compose.yml -p nextcloud up + docker-compose -f fstack/nextcloud/docker-compose.yml -p nextcloud up --build [ $? -eq 0 ] && echo -ne "done.\n" || fail "There was a problem starting service fstack/nextcloud" else - docker-compose -f fstack/nextcloud/docker-compose.yml -p nextcloud up -d &> /dev/null + docker-compose -f fstack/nextcloud/docker-compose.yml -p nextcloud up --build -d &> /dev/null - # Keep trying nextcloud port 8000 to make sure it's up + # Keep trying nextcloud port 80 to make sure it's up # before we proceed - RETRY="23" + RETRY="35" while [ $RETRY -gt 0 ]; do nc -z 172.99.0.15 80 &> /dev/null if [ $? -eq 0 ]; then @@ -201,7 +250,7 @@ start_nextcloud() { [ $? -ne 0 ] && fail "Couldn't chown nextcloud.sh in fstack/nextcloud container" # Run nextcloud.sh - Setup LDAP, configuration for nextcloud - docker exec -it -u 33 nextcloud /var/www/html/nextcloud.sh &> /dev/null + docker exec -it -u 33 nextcloud /var/www/html/nextcloud.sh [ $? -ne 0 ] && fail "Couldn't run nextcloud.sh inside fstack/nextcloud container" # Enable SSL module in fstack/nextcloud diff --git a/fstack/lib/panel.sh b/fstack/lib/panel.sh index 27d4ffe..a28e7fe 100644 --- a/fstack/lib/panel.sh +++ b/fstack/lib/panel.sh @@ -18,6 +18,31 @@ config_panel() { DOMAIN_FIRST=${DOMAIN_ARRAY[0]} DOMAIN_LAST=${DOMAIN_ARRAY[1]} +cat > fstack/panel/ansible_hosts < fstack/panel/Dockerfile <> /etc/sudoers \ +&& useradd -m ansible -s /bin/bash \ +&& sudo -u ansible mkdir /home/ansible/.ssh && mkdir /etc/ansible +RUN sudo -u ansible ssh-keygen -q -t rsa -N '' -f /home/ansible/.ssh/id_rsa + +COPY ansible_hosts /etc/ansible/hosts +COPY new_user.php /opt/ldap_user_manager/account_manager/ +EOF + cat > fstack/panel/docker-compose.yml < /dev/null + docker-compose -f fstack/panel/docker-compose.yml -p panel up --build -d &> /dev/null # Keep trying panel port 443 to make sure it's up # before we proceed - RETRY="23" + RETRY="30" while [ $RETRY -gt 0 ]; do nc -z 172.99.0.12 443 &> /dev/null if [ $? -eq 0 ]; then @@ -102,6 +130,10 @@ start_panel() { fi done fi + + # Insert ansible key into nextcloud + KEY=`docker exec -it panel bash -c "cat /home/ansible/.ssh/id_rsa.pub"` + docker exec -it nextcloud bash -c "echo $KEY > /home/ansible/.ssh/authorized_keys" kill -9 $SPINPID &> /dev/null echo -ne "done." diff --git a/install-federated.sh b/install-federated.sh index 67236d6..9e75ac7 100755 --- a/install-federated.sh +++ b/install-federated.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/bash -x # # Federated installation script