1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
# Handle the incoming configuration files:
config() {
for infile in $1; do
NEW="$infile"
OLD="`dirname $NEW`/`basename $NEW .new`"
# If there's no config file by that name, mv it over:
if [ ! -r $OLD ]; then
mv $NEW $OLD
elif [ "`cat $OLD | md5sum`" = "`cat $NEW | md5sum`" ]; then
# toss the redundant copy
rm $NEW
fi
# Otherwise, we leave the .new copy for the admin to consider...
done
}
config etc/nxserver/node.conf.new
config etc/rc.d/rc.freenx.new
chroot . <<EOCR 2>/dev/null
export \$(grep ^NX_DIR usr/bin/nxloadconfig)
export \$(grep ^NX_HOME_DIR usr/bin/nxloadconfig)
export \$(grep ^NX_SESS_DIR usr/bin/nxloadconfig)
export \$(grep ^NX_ETC_DIR usr/bin/nxloadconfig)
export \$(grep ^NX_LOGFILE usr/bin/nxloadconfig)
export \$(grep ^SSH_AUTHORIZED_KEYS usr/bin/nxloadconfig)
if ! /sbin/pidof sshd >/dev/null ; then
echo ""
echo "WARNING: The SSH daemon is not running, but without SSH, NX will not work."
fi
if ! which nc 1>/dev/null 2>/dev/null ; then
echo ""
echo "WARNING: FreeNX needs the 'netcat' program to be installed."
fi
if ! which expect 1>/dev/null 2>/dev/null ; then
echo ""
echo "WARNING: FreeNX needs the 'expect' program to be installed."
fi
touch \${NX_ETC_DIR}/passwords \${NX_ETC_DIR}/passwords.orig \${NX_LOGFILE}
chmod 600 \${NX_ETC_DIR}/pass* \${NX_LOGFILE}
if [ ! -e \${NX_ETC_DIR}/users.id_dsa ]; then
ssh-keygen -f \${NX_ETC_DIR}/users.id_dsa -t dsa -N "" > /dev/null 2>&1
fi
if [ -e \${NX_HOME_DIR}/.ssh/client.id_dsa.key ] && \
[ -e \${NX_HOME_DIR}/.ssh/server.id_dsa.pub.key ]; then
mv -f \${NX_HOME_DIR}/.ssh/client.id_dsa.key \${NX_ETC_DIR}/client.id_dsa.key
mv -f \${NX_HOME_DIR}/.ssh/server.id_dsa.pub.key \
\${NX_ETC_DIR}/server.id_dsa.pub.key
fi
if ! getent passwd | egrep -q "^nx:"; then
useradd -m -d \${NX_HOME_DIR} -s /usr/bin/nxserver nx
passwd -u nx 1>/dev/null
mkdir -p \${NX_HOME_DIR}/.ssh
chmod 700 \${NX_HOME_DIR}/.ssh
fi
if [ ! -e \${NX_ETC_DIR}/client.id_dsa.key ] || \
[ ! -e \${NX_ETC_DIR}/server.id_dsa.pub.key ]; then
# We are going to create a new SSH key for the FreeNX server.
# The NX client must import this key into it's configuration to be able to
# connect to the FreeNX server.
# If you're security minded, use this key exclusively, and remove the
# NoMachine key from ${NX_HOME_DIR}/.ssh/authorized_keys.
rm -f \${NX_ETC_DIR}/client.id_dsa.key
rm -f \${NX_ETC_DIR}/server.id_dsa.pub.key
ssh-keygen -q -t dsa -N '' -f \${NX_ETC_DIR}/local.id_dsa
mv \${NX_ETC_DIR}/local.id_dsa \${NX_ETC_DIR}/client.id_dsa.key
mv \${NX_ETC_DIR}/local.id_dsa.pub \${NX_ETC_DIR}/server.id_dsa.pub.key
# Put our fresh key files in place.
cp -f \${NX_ETC_DIR}/client.id_dsa.key \${NX_HOME_DIR}/.ssh/client.id_dsa.key
cp -f \${NX_ETC_DIR}/server.id_dsa.pub.key \
\${NX_HOME_DIR}/.ssh/server.id_dsa.pub.key
chmod 600 \${NX_ETC_DIR}/client.id_dsa.key \
\${NX_ETC_DIR}/server.id_dsa.pub.key \
\${NX_HOME_DIR}/.ssh/client.id_dsa.key \
\${NX_HOME_DIR}/.ssh/server.id_dsa.pub.key
echo -n "no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command=\"/usr/bin/nxserver\" "\
> \${NX_HOME_DIR}/.ssh/authorized_keys
cat \${NX_HOME_DIR}/.ssh/server.id_dsa.pub.key \
>> \${NX_HOME_DIR}/.ssh/authorized_keys
chmod 640 \${NX_HOME_DIR}/.ssh/authorized_keys
echo -n "127.0.0.1 " > \${NX_HOME_DIR}/.ssh/known_hosts
cat etc/ssh/ssh_host_rsa_key.pub >> \${NX_HOME_DIR}/.ssh/known_hosts
chown -R nx:root var/lib/nxserver
chown -R nx:root \${NX_SESS_DIR}
# Add the Nomachine pubkey to ${NX_HOME_DIR}/.ssh/authorized_keys
# This way, any NX client can connect to our FreeNX server without
# having to import our own FreeNX private key.
# If you want an "out-of-the-box" experience, leave the NoMachine key in
# ${NX_HOME_DIR}/.ssh/authorized_keys. If you're paranoid, remove
# this pubkey and accept only clients who have our custom FreeNX key.
cat <<_EOT_ >> \${NX_HOME_DIR}/.ssh/authorized_keys
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/usr/bin/nxserver" ssh-dss AAAAB3NzaC1kc3MAAACBAJe/0DNBePG9dYLWq7cJ0SqyRf1iiZN/IbzrmBvgPTZnBa5FT/0Lcj39sRYt1paAlhchwUmwwIiSZaON5JnJOZ6jKkjWIuJ9MdTGfdvtY1aLwDMpxUVoGwEaKWOyin02IPWYSkDQb6cceuG9NfPulS9iuytdx0zIzqvGqfvudtufAAAAFQCwosRXR2QA8OSgFWSO6+kGrRJKiwAAAIEAjgvVNAYWSrnFD+cghyJbyx60AAjKtxZ0r/Pn9k94Qt2rvQoMnGgt/zU0v/y4hzg+g3JNEmO1PdHh/wDPVOxlZ6Hb5F4IQnENaAZ9uTZiFGqhBO1c8Wwjiq/MFZy3jZaidarLJvVs8EeT4mZcWxwm7nIVD4lRU2wQ2lj4aTPcepMAAACANlgcCuA4wrC+3Cic9CFkqiwO/Rn1vk8dvGuEQqFJ6f6LVfPfRTfaQU7TGVLk2CzY4dasrwxJ1f6FsT8DHTNGnxELPKRuLstGrFY/PR7KeafeFZDf+fJ3mbX5nxrld3wi5titTnX+8s4IKv29HJguPvOK/SI7cjzA+SqNfD7qEo8= root@nettuno
_EOT_
fi # end "no pre-existing NX ssh keys"
if [ -e var/lib/nxserver/running ]; then
mv var/lib/nxserver/running/* \${NX_SESS_DIR}/running
mv var/lib/nxserver/closed/* \${NX_SESS_DIR}/closed
mv var/lib/nxserver/failed/* \${NX_SESS_DIR}/failed
rm -rf var/lib/nxserver/running
rm -rf var/lib/nxserver/closed
rm -rf var/lib/nxserver/failed
chown -R nx:root \${NX_SESS_DIR}
fi
chown -R nx:root \${NX_ETC_DIR}
chown -R nx:root \${NX_HOME_DIR}
chown nx:root \${NX_LOGFILE}
EOCR
|
