blob: e2327c41b3443c5eb6436f776309419e5d080a8c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
#!/bin/sh
# -*- coding: utf-8 -*-
info()
{
echo "--- $*"
}
error()
{
echo "=== ERROR: $*" >&2
}
warning()
{
echo "=== WARNING: $*" >&2
}
die()
{
error "$*"
exit 1
}
sys_groupadd()
{
local args="--system"
info "groupadd $args $*"
groupadd $args "$@" || die "Failed groupadd"
}
sys_useradd()
{
local args="--system -s /usr/sbin/nologin -d /nonexistent -M -N"
info "useradd $args $*"
useradd $args "$@" || die "Failed useradd"
}
do_usermod()
{
info "usermod $*"
usermod "$@" || die "Failed usermod"
}
# Stop the daemons.
systemctl stop cms-fsd.socket >/dev/null 2>&1
systemctl stop cms-fsd.service >/dev/null 2>&1
systemctl stop cms-postd.socket >/dev/null 2>&1
systemctl stop cms-postd.service >/dev/null 2>&1
systemctl stop cms-backd.socket >/dev/null 2>&1
systemctl stop cms-backd.service >/dev/null 2>&1
# Delete all existing users, if any.
userdel cms-fsd >/dev/null 2>&1
userdel cms-postd >/dev/null 2>&1
userdel cms-backd >/dev/null 2>&1
# Delete all existing groups, if any.
groupdel cms-fsd >/dev/null 2>&1
groupdel cms-postd >/dev/null 2>&1
groupdel cms-backd >/dev/null 2>&1
groupdel cms-fs-ro >/dev/null 2>&1
groupdel cms-fs-x >/dev/null 2>&1
groupdel cms-sock-db >/dev/null 2>&1
groupdel cms-sock-post >/dev/null 2>&1
groupdel cms-sock-back >/dev/null 2>&1
# Create system groups.
sys_groupadd cms-fsd
sys_groupadd cms-postd
sys_groupadd cms-backd
sys_groupadd cms-fs-ro
sys_groupadd cms-fs-x
sys_groupadd cms-sock-db
sys_groupadd cms-sock-post
sys_groupadd cms-sock-back
# Create system users.
sys_useradd -G cms-sock-db,cms-fs-ro -g cms-fsd cms-fsd
sys_useradd -G cms-sock-post,cms-fs-x -g cms-postd cms-postd
sys_useradd -G cms-sock-back,cms-sock-db,cms-sock-post -g cms-backd cms-backd
# Add the communication socket to the web server process user.
if grep -q '^www-data:' /etc/passwd; then
do_usermod -a -G cms-sock-back www-data
fi
# The git-user shall be able to give group permissions in db.
if grep -q '^git:' /etc/passwd; then
do_usermod -a -G cms-fs-ro,cms-fs-x git
fi
# vim: ts=4 sw=4 expandtab
|
