mirror of
https://github.com/tildeclub/tilde.club.git
synced 2026-10-25 00:55:38 +00:00
bring on more tildes hopefully
This commit is contained in:
deepend committed
1 parent
c4d72ea94b
commit
109dda05c6
32 files changed
+2239
-1159
No files matched your search
@@ -1,99 +1,90 @@
|
||||
The [tilde.etcskel repository](https://github.com/tildeclub/tilde.etcskel) contains the contents of the `/etc/skel/` directory, but since git repositories can't reproduce permissions on the files, here are the current permissions for those contents:
|
||||
# Home skeleton and permissions
|
||||
|
||||
`useradd --create-home` copies `/etc/skel` into a new home. Get it right before
|
||||
creating accounts. Changes to the skeleton do not update existing homes.
|
||||
|
||||
The reference source is [tilde.etcskel](https://github.com/tildeclub/tilde.etcskel).
|
||||
Review its startup commands, domains, IRC settings, and first-login dependencies
|
||||
before deploying it. Stage changes outside `/etc/skel`; do not clone over a live
|
||||
skeleton or copy a repository's `.git` directory into every new account.
|
||||
|
||||
## Minimal new-host skeleton
|
||||
|
||||
Keep the distribution's shell files, then add the public page and an empty
|
||||
SSH key file. On a new skeleton only:
|
||||
|
||||
```bash
|
||||
install -d -o root -g root -m 0700 /etc/skel/.ssh
|
||||
install -o root -g root -m 0600 /dev/null /etc/skel/.ssh/authorized_keys
|
||||
install -d -o root -g root -m 0755 /etc/skel/public_html
|
||||
```
|
||||
root@tilde /e/skel (master)# ls -alR
|
||||
.:
|
||||
total 63
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ./
|
||||
drwxr-xr-x. 164 root root 12288 Jan 27 19:40 ../
|
||||
-rw-r--r--. 1 root root 29 Sep 15 2019 .bash_logout
|
||||
-rw-r--r-- 1 root root 144 Aug 12 00:00 .bash_profile
|
||||
-rw-r--r-- 1 root root 3272 Dec 13 2021 .bashrc
|
||||
drwxr-xr-x 3 root root 303 Jan 27 19:43 .byobu/
|
||||
lrwxrwxrwx 1 root root 25 Jul 17 2024 .dovecot.sieve -> sieve/rainloop.user.sieve
|
||||
-rw-r--r--. 1 root root 500 Sep 15 2019 .emacs
|
||||
drwxr-xr-x. 2 root root 35 Mar 27 2023 .irssi/
|
||||
-rw-r--r--. 1 root root 11 Sep 15 2019 .logout
|
||||
-rw-r--r-- 1 root root 124 Jul 18 2024 .mkshrc
|
||||
-rw-r--r-- 1 root root 0 Mar 27 2020 .new_user
|
||||
-rw-r--r-- 1 root root 816 Mar 27 2020 .profile
|
||||
drwxr-xr-x 2 root root 23 Nov 26 2021 public_gemini/
|
||||
drwxr-xr-x. 2 root root 23 Jan 27 19:43 public_gopher/
|
||||
drwxr-xr-x. 2 root root 24 Mar 27 2023 public_html/
|
||||
-rw-r--r-- 1 root root 790 Dec 23 2022 README.md
|
||||
-rw-r--r--. 1 root root 12 Sep 15 2019 .scrollzrc
|
||||
drwxr-xr-x 3 root root 44 Jul 17 2024 sieve/
|
||||
drwx------. 2 root root 29 Sep 15 2019 .ssh/
|
||||
-rw-r--r-- 1 root root 299 Jul 20 2024 .zprofile
|
||||
-rw-r--r-- 1 root root 658 Jul 20 2024 .zshrc
|
||||
|
||||
./.byobu:
|
||||
total 56
|
||||
drwxr-xr-x 3 root root 303 Jan 27 19:43 ./
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ../
|
||||
-rw-r--r-- 1 root root 19 Aug 23 2018 backend
|
||||
drwxr-xr-x 2 root root 6 Aug 23 2018 bin/
|
||||
-rw-r--r-- 1 root root 38 Aug 23 2018 color
|
||||
-rw-r--r-- 1 root root 96 Aug 23 2018 color.tmux
|
||||
-rw-r--r-- 1 root root 45 Aug 23 2018 datetime.tmux
|
||||
-rw-r--r-- 1 root root 52 Aug 23 2018 keybindings
|
||||
-rw-r--r-- 1 root root 73 Aug 23 2018 keybindings.tmux
|
||||
-rw-r--r-- 1 root root 0 Aug 23 2018 .metadata_available
|
||||
-rw-r--r-- 1 root root 49 Aug 23 2018 profile
|
||||
-rw-r--r-- 1 root root 47 Aug 23 2018 profile.tmux
|
||||
-rw-r--r-- 1 root root 95 Aug 24 2018 prompt
|
||||
-rw-r--r-- 1 root root 0 Aug 23 2018 .screenrc
|
||||
-rw-r--r-- 1 root root 2833 Aug 23 2018 status
|
||||
-rw-r--r-- 1 root root 2558 Oct 8 2019 statusrc
|
||||
-rw-r--r-- 1 root root 103 Jan 27 19:43 .tmux.conf
|
||||
-rw-r--r-- 1 root root 0 Aug 23 2018 windows
|
||||
-rw-r--r-- 1 root root 8 Aug 23 2018 windows.tmux
|
||||
The `install ... /dev/null` command empties its destination. Do not use it on
|
||||
an existing account's key file. Add a starter `index.html` at mode 0644, for
|
||||
example:
|
||||
|
||||
./.byobu/bin:
|
||||
total 0
|
||||
drwxr-xr-x 2 root root 6 Aug 23 2018 ./
|
||||
drwxr-xr-x 3 root root 303 Jan 27 19:43 ../
|
||||
```html
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>My tilde page</title>
|
||||
<h1>It works.</h1>
|
||||
<p>Edit ~/public_html/index.html to make this page your own.</p>
|
||||
</html>
|
||||
```
|
||||
|
||||
./.irssi:
|
||||
total 16
|
||||
drwxr-xr-x. 2 root root 35 Mar 27 2023 ./
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ../
|
||||
-rw-r--r-- 1 root root 4977 Mar 27 2023 config
|
||||
-rw-r--r-- 1 root root 15 Mar 27 2023 startup
|
||||
Add a short README covering SSH, editing the page, mail if offered, chat,
|
||||
acceptable use, quotas, and how to reach an operator. Use your own domain and
|
||||
contact details. Keep private defaults out of publicly served directories.
|
||||
|
||||
./public_gemini:
|
||||
total 8
|
||||
drwxr-xr-x 2 root root 23 Nov 26 2021 ./
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ../
|
||||
-rw-r--r-- 1 root root 96 Nov 26 2021 index.gmi
|
||||
## Modes
|
||||
|
||||
./public_gopher:
|
||||
total 8
|
||||
drwxr-xr-x. 2 root root 23 Jan 27 19:43 ./
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ../
|
||||
-rw-r--r-- 1 root root 149 Jan 27 19:43 gophermap
|
||||
| Path | Mode | Owner in the skeleton | Purpose |
|
||||
| --- | --- | --- | --- |
|
||||
| `/etc/skel` | 0755 | root:root | Template directory. |
|
||||
| `.ssh` | 0700 | root:root | Private SSH configuration directory. |
|
||||
| `.ssh/authorized_keys` | 0600 | root:root | Empty placeholder; never a shared key. |
|
||||
| `public_html` | 0755 | root:root | Public web directory. |
|
||||
| `public_html/index.html` | 0644 | root:root | Public starter page. |
|
||||
| `public_gopher`, `public_gemini` | 0755 | root:root | Only if those services are offered. |
|
||||
| Public text and menu files | 0644 | root:root | Readable publishing content. |
|
||||
| Private mail/sieve directories | 0700 where appropriate | root:root | Not web content. |
|
||||
| Private sieve files | 0600 | root:root | User-specific filtering state. |
|
||||
|
||||
./public_html:
|
||||
total 8
|
||||
drwxr-xr-x. 2 root root 24 Mar 27 2023 ./
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ../
|
||||
-rw-r--r-- 1 root root 2145 Mar 27 2023 index.html
|
||||
`useradd` assigns the copied files to the new account. Check that ownership
|
||||
rather than recursively changing an established home. Git records executable
|
||||
bits but not arbitrary file modes or ownership, so a checkout alone is not a
|
||||
permissions deployment procedure.
|
||||
|
||||
./sieve:
|
||||
total 4
|
||||
drwxr-xr-x 3 root root 44 Jul 17 2024 ./
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ../
|
||||
-rw------- 1 root root 0 Jul 17 2024 rainloop.user.sieve
|
||||
drwx------ 2 root root 6 Jul 17 2024 tmp/
|
||||
The collected production skeleton also has Byobu, Irssi, `.gnupg`, Sieve files,
|
||||
a `.dovecot.sieve` symlink, and a `.new_user` marker. Its `.ssh` and `.gnupg`
|
||||
directories are 0700, the empty key file and personal Sieve file are 0600,
|
||||
public directories are 0755, and public starter files are 0644. A symlink must
|
||||
be checked at its destination as well; do not use recursive chmod across it.
|
||||
|
||||
./sieve/tmp:
|
||||
total 0
|
||||
drwx------ 2 root root 6 Jul 17 2024 ./
|
||||
drwxr-xr-x 3 root root 44 Jul 17 2024 ../
|
||||
## First-login hook
|
||||
|
||||
./.ssh:
|
||||
total 4
|
||||
drwx------. 2 root root 29 Sep 15 2019 ./
|
||||
drwxr-xr-x. 10 root root 4096 Jul 17 2024 ../
|
||||
-rw-------. 1 root root 0 Sep 15 2019 authorized_keys
|
||||
On the collected host, `.bash_profile` sources `.bashrc`, and interactive Bash
|
||||
runs `firstlogin` when `.new_user` exists. Noninteractive Bash returns before
|
||||
that hook. The collected Zsh startup files do not contain the same hook.
|
||||
|
||||
The Ruby wizard removes the marker at the end. Test interruption, failure, and
|
||||
re-entry. Keep it out of noninteractive SCP/SFTP or command sessions, and do
|
||||
not rely on the marker to enforce MFA or block an account.
|
||||
|
||||
## Test a fresh copy
|
||||
|
||||
Create a disposable account with the real account-creation method. Check:
|
||||
|
||||
```bash
|
||||
namei -l /home/member/.ssh/authorized_keys
|
||||
namei -l /home/member/public_html/index.html
|
||||
stat -c '%a %U:%G %n' /home/member /home/member/.ssh \
|
||||
/home/member/.ssh/authorized_keys /home/member/public_html
|
||||
```
|
||||
|
||||
Use the home traversal mode explained in [the setup guide](how-to-set-up-a-tilde.md).
|
||||
Check SSH and web access as the actual member and service users, including
|
||||
SELinux labels when enforcing. Never repair a 403 by making the entire home
|
||||
readable to everyone.
|
||||
Reference in new issue
Block a user