#!/bin/bash

set -e

shopt -s nocasematch #For case insensitive string matching, for the first parameter

SELF=`which $0`

HOME_DIR=${HOME_DIR:-"/home"}

case "$1" in

create) # sshcommand create <user> <command>

if [[ $# -ne 3 ]]; then

echo "Usage : sshcommand create user command"

exit -1

fi

USER="$2"; COMMAND="$3"

getent passwd $USER > /dev/null || USERHOME="$HOME_DIR/$USER"

if [ -z $USERHOME ]; then

USERHOME=$(bash <<< "echo ~$USER")

else

useradd -m -d $USERHOME $USER || true

fi

mkdir -p "$USERHOME/.ssh"

touch $USERHOME/.ssh/authorized_keys

echo "$COMMAND" > "$USERHOME/.sshcommand"

chown $USER "$USERHOME"

chown -R $USER "$USERHOME/.ssh"

;;

acl-add) # sshcommand acl-add <user> <identifier>

if [[ $# -ne 3 ]]; then

echo "Usage : sshcommand acl-add user identifier"

exit -1

fi

USER="$2"; NAME="$3"

getent passwd $USER > /dev/null || false

USERHOME=$(bash <<< "echo ~$USER")

KEY_FILE=$(mktemp)

KEY=$(tee "$KEY_FILE")

delete_key_file() {

rm -f "$KEY_FILE"

}

trap delete_key_file INT EXIT

FINGERPRINT=$(ssh-keygen -lf "$KEY_FILE" | awk '{print $2}')

if [[ "$FINGERPRINT" == "" ]]; then

echo "Invalid ssh public key"

exit -1

fi

KEY_PREFIX="command=\"FINGERPRINT=$FINGERPRINT NAME=$NAME \`cat $USERHOME/.sshcommand\` \$SSH_ORIGINAL_COMMAND\",no-agent-forwarding,no-user-rc,no-X11-forwarding,no-port-forwarding"

echo "$KEY_PREFIX $KEY" >> "$USERHOME/.ssh/authorized_keys"

echo $FINGERPRINT

;;

acl-remove) # sshcommand acl-remove <user> <identifier>

if [[ $# -ne 3 ]]; then

echo "Usage : sshcommand acl-remove user identifier"

exit -1

fi

USER="$2"; NAME="$3"

getent passwd $USER > /dev/null || false

USERHOME=$(bash <<< "echo ~$USER")

sed --in-place "/ NAME=$NAME /d" "$USERHOME/.ssh/authorized_keys"

;;

help|*) # sshcommand help

echo "Usage : sshcommand create user command"

echo " sshcommand acl-add user identifier"

echo " sshcommand acl-remove user identifier"

echo " sshcommand help # shows this usage message"

;;

esac