port the user account section, and stop clobbering files in the home
Two real defects fixed on the way across.
The sudoers write was in the wrong order. The original echoed the rule straight
into /etc/sudoers.d, validated it afterwards, and chmod'd it later still. A
malformed file there breaks sudo COMPLETELY — and you cannot sudo to repair it,
so on a remote machine that is a rescue console — and so does one with loose
permissions, because sudo refuses to read its own configuration. Both of those
windows were live in the original ordering. grant_passwordless_sudo now writes a
temp file, runs visudo -c against it, and only then places it with install(1),
which applies the content and the 0440 mode in one step. Nothing reaches
/etc/sudoers.d that has not already been validated.
The .tmux.conf copy overwrote whatever was in the home on every run. lib/files.sh
adds the two shapes that stop this whole class of thing:
install_config installs when absent, does nothing when identical, and keeps
what the user wrote when it differs — printing the cp to take
ours, so the choice stays theirs
append_once wraps a block in named markers so a second run recognises its
own work; also lets a human see which lines came from this
script and remove them as a unit
append_once is what the five unguarded `cat >>` into .zshrc need when those
sections are ported — a second pass currently duplicates the starship init, the
nvim PATH, bun, deno and the aliases.
Passwordless sudo is asked separately from creating the account, because it is a
security posture rather than part of making a user, and the cost is stated: a key
that can log into this account is root without a further step. Officer's actual
requirement is stated too — os-user-shell.ts runs `sudo -n`, and a prompt it
cannot answer surfaces as a permissions error rather than a question — and
refusing records that consequence in the summary instead of a bare "skipped".
Verified: all three install_config outcomes, append_once writing exactly once
across two runs, visudo rejecting junk before anything is installed, and the
section reporting correctly against this host's existing account.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -26,6 +26,8 @@ source "$SCRIPT_DIR/lib/tools.sh"
|
||||
source "$SCRIPT_DIR/lib/system.sh"
|
||||
# shellcheck source=lib/disk.sh
|
||||
source "$SCRIPT_DIR/lib/disk.sh"
|
||||
# shellcheck source=lib/files.sh
|
||||
source "$SCRIPT_DIR/lib/files.sh"
|
||||
|
||||
# Trap errors with context. Installed here rather than in lib/base.sh, because
|
||||
# that file is definitions only and a trap is a side effect on whoever sources it.
|
||||
@@ -741,13 +743,98 @@ elif ! skip; then
|
||||
step_ok
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# 14. User account
|
||||
# =============================================================================
|
||||
|
||||
step "User account"
|
||||
if ! skip; then
|
||||
echo ""
|
||||
info "User account — the account you will actually log in and work as"
|
||||
|
||||
if id "$USERNAME" &>/dev/null; then
|
||||
echo " ${USERNAME} already exists"
|
||||
USER_EXISTED=true
|
||||
else
|
||||
echo " ${USERNAME} does not exist yet and will be created"
|
||||
echo " adduser will ask for a password and a few details"
|
||||
USER_EXISTED=false
|
||||
fi
|
||||
|
||||
IN_SUDO=false
|
||||
id -nG "$USERNAME" 2>/dev/null | tr ' ' '\n' | grep -qx sudo && IN_SUDO=true
|
||||
echo " sudo group: $($IN_SUDO && echo 'already a member' || echo 'will be added')"
|
||||
echo " passwordless: $(has_passwordless_sudo "$USERNAME" && echo 'already granted' || echo 'not granted')"
|
||||
|
||||
if $USER_EXISTED && $IN_SUDO; then
|
||||
SUMMARY+=("User: ${USERNAME} (already set up)")
|
||||
elif confirm "Proceed?"; then
|
||||
if ! $USER_EXISTED; then
|
||||
adduser --gecos "" "$USERNAME"
|
||||
SUMMARY+=("User: ${USERNAME} created")
|
||||
fi
|
||||
$IN_SUDO || usermod -aG sudo "$USERNAME"
|
||||
ok "${USERNAME} is in the sudo group"
|
||||
$USER_EXISTED && SUMMARY+=("User: ${USERNAME} added to sudo")
|
||||
else
|
||||
warn "skipped by request"
|
||||
SUMMARY+=("User: SKIPPED by request")
|
||||
fi
|
||||
|
||||
# ── passwordless sudo ──
|
||||
#
|
||||
# Asked separately because it is a security posture rather than part of
|
||||
# creating an account, and because Officer has an actual requirement here:
|
||||
# os-user-shell.ts runs `sudo -n` to provision a member's home, and a prompt it
|
||||
# cannot answer is a failure it reports as a permissions error.
|
||||
if has_passwordless_sudo "$USERNAME"; then
|
||||
echo ""
|
||||
echo " passwordless sudo is already granted to ${USERNAME}"
|
||||
SUMMARY+=("Sudo: passwordless (already)")
|
||||
else
|
||||
echo ""
|
||||
info "Passwordless sudo for ${USERNAME}?"
|
||||
echo " Means sudo never asks for a password again. Convenient, and the"
|
||||
echo " cost is real: anything that gets hold of this account, or of a key"
|
||||
echo " that can log into it, is root without another step."
|
||||
if is_role vps; then
|
||||
echo " Worth weighing on a ${MACHINE_ROLE}, which faces the open internet."
|
||||
fi
|
||||
echo ""
|
||||
echo " Officer needs it: it runs 'sudo -n' to provision a member's Linux"
|
||||
echo " account, and a password prompt it cannot answer surfaces as a"
|
||||
echo " permissions error rather than a question."
|
||||
if confirm "Grant it?"; then
|
||||
grant_passwordless_sudo "$USERNAME"
|
||||
ok "passwordless sudo granted — remove /etc/sudoers.d/99-${USERNAME}-nopasswd to undo"
|
||||
SUMMARY+=("Sudo: passwordless")
|
||||
else
|
||||
warn "skipped by request"
|
||||
SUMMARY+=("Sudo: password required (Officer's account provisioning will not work)")
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── tmux config ──
|
||||
#
|
||||
# install_config rather than cp: the original overwrote whatever was there on
|
||||
# every single run.
|
||||
if [[ -f "$SCRIPT_DIR/.tmux.conf" ]] && id "$USERNAME" &>/dev/null; then
|
||||
install_config "$SCRIPT_DIR/.tmux.conf" "${USER_HOME}/.tmux.conf" "$USERNAME"
|
||||
case $? in
|
||||
0) ok "tmux config installed" ;;
|
||||
1) : ;;
|
||||
2) : ;;
|
||||
esac
|
||||
fi
|
||||
step_ok
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# NOT PORTED YET
|
||||
# =============================================================================
|
||||
#
|
||||
# Sections still to move across from scripts/setup-old/setup-ubuntu.sh, in order:
|
||||
#
|
||||
# user creation ·
|
||||
# ssh keys · ssh hardening · dns · static ip · fail2ban · unattended-upgrades ·
|
||||
# git config · docker · zsh + prompt · tailscale · neovim · js runtimes ·
|
||||
# dev tools · ufw · zshrc
|
||||
|
||||
Reference in New Issue
Block a user