opnsense-core/+POST_INSTALL
Franco Fichtner 08a86fdae9 pkg: add a user for www-only access #8521
Added a group as well, but we can always drop it if it doesn't
make sense.
2025-04-23 09:09:35 +02:00

56 lines
1.6 KiB
Text

PW=/usr/sbin/pw
USER=wwwonly
UID=789
GROUP=${USER}
GID=${UID}
if ! ${PW} groupshow ${GROUP} >/dev/null 2>&1; then
echo "Creating group '${GROUP}' with gid '${GID}'"
${PW} groupadd ${GROUP} -g ${GID}
else
echo "Using existing group '${GROUP}'"
fi
if ! ${PW} usershow ${USER} >/dev/null 2>&1; then
echo "Creating user '${USER}' with uid '${UID}'"
${PW} useradd ${USER} -u ${UID} -g ${GID} -c "World Wide Web Only" -d /nonexistent -s /usr/sbin/nologin
else
echo "Using existing user '${USER}'"
fi
echo "Updating /etc/shells"
cp /etc/shells /etc/shells.bak
(grep -v /usr/local/sbin/opnsense-shell /etc/shells.bak; \
echo /usr/local/sbin/opnsense-shell) > /etc/shells
rm -f /etc/shells.bak
cp /etc/shells /etc/shells.bak
(grep -v /usr/local/sbin/opnsense-installer /etc/shells.bak; \
echo /usr/local/sbin/opnsense-installer) > /etc/shells
rm -f /etc/shells.bak
echo "Registering root shell"
pw usermod -n root -s /usr/local/sbin/opnsense-shell
echo "Hooking into /etc/rc"
cp /etc/rc /etc/rc.bak
cat > /etc/rc <<EOF
#!/bin/sh
# OPNsense rc(8) hook was automatically installed:
if [ -f /usr/local/etc/rc ]; then exec /usr/local/etc/rc; fi
EOF
cat /etc/rc.bak >> /etc/rc
rm -f /etc/rc.bak
echo "Hooking into /etc/rc.shutdown"
cp /etc/rc.shutdown /etc/rc.shutdown.bak
cat > /etc/rc.shutdown <<EOF
#!/bin/sh
# OPNsense rc(8) hook was automatically installed:
if [ -f /usr/local/etc/rc.shutdown ]; then exec /usr/local/etc/rc.shutdown; fi
EOF
cat /etc/rc.shutdown.bak >> /etc/rc.shutdown
rm -f /etc/rc.shutdown.bak
/usr/local/etc/rc.d/configd start
/usr/local/etc/rc.syshook update