1 #!/usr/bin/perl
2 
3 package Shell;
4 
5 use strict;
6 use warnings;
7 use OpenBSD::Pledge;
8 use OpenBSD::Unveil;
9 use MIME::Base64;
10 use Data::Dumper;
11 use Digest::SHA qw(sha256_hex);
12 use lib './';
13 require "SQLite.pm";
14 require "Hash.pm";
15 
16 my %conf = %main::conf;
17 my $chans = $conf{chans};
18 my $teamchans = $conf{teamchans};
19 my @teamchans = split /[,\s]+/m, $teamchans;
20 my $staff = $conf{staff};
21 my $captchaURL = "https://example.com/captcha.php?vhost=";
22 my $hostname = $conf{hostname};
23 my $terms = $conf{terms};
24 my $expires = $conf{expires};
25 my $mailfrom = $conf{mailfrom};
26 my $mailname = $conf{mailname};
27 my $approval = $conf{approval};
28 my $passpath = "/etc/passwd";
29 my $httpdconfpath = "/etc/httpd.conf";
30 my $acmeconfpath = "/etc/acme-client.conf";
31 my $pfconfpath = "/etc/pf.conf";
32 my $relaydconfpath = "/etc/relayd.conf";
33 my $startPort;
34 my $endPort;
35 main::cbind("pub", "-", "shell", \&mshell);
36 main::cbind("msg", "-", "shell", \&mshell);
37 
38 # Returns yesterday's date in mmmDDYYYY format
39 sub yesterday {
40 	my @months = qw(Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec);
41 	my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
42 	my $localtime = sprintf("%s%02d%04d", $months[$mon], $mday-1, $year+1900);
43 	return $localtime;
44 }
45 sub init {
46 	#dependencies for figlet
47 	unveil("/usr/local/bin/figlet", "rx") or die "Unable to unveil $!";
48 	unveil("/usr/lib/libc.so.95.1", "r") or die "Unable to unveil $!";
49 	unveil("/usr/libexec/ld.so", "r") or die "Unable to unveil $!";
50 	#dependencies for shell account
51 	unveil($passpath, "r") or die "Unable to unveil $!";
52 	unveil($httpdconfpath, "rwxc") or die "Unable to unveil $!";
53 	unveil($acmeconfpath, "rwxc") or die "Unable to unveil $!";
54 	unveil($pfconfpath, "rwxc") or die "Unable to unveil $!";       
55 	unveil($relaydconfpath, "rwxc") or die "Unable to unveil $!";       
56 	unveil("/usr/sbin/chown", "rx") or die "Unable to unveil $!";
57 	unveil("/bin/chmod", "rx") or die "Unable to unveil $!";
58 	unveil("/usr/sbin/groupadd", "rx") or die "Unable to unveil $!";
59 	unveil("/usr/sbin/useradd", "rx") or die "Unable to unveil $!";
60 	unveil("/usr/sbin/usermod", "rx") or die "Unable to unveil $!";
61 	unveil("/usr/sbin/groupdel", "rx") or die "Unable to unveil $!";
62 	unveil("/usr/sbin/userdel", "rx") or die "Unable to unveil $!";
63 	unveil("/bin/mkdir", "rx") or die "Unable to unveil $!";
64 	unveil("/bin/ln", "rx") or die "Unable to unveil $!";
65 	unveil("/usr/sbin/acme-client", "rx") or die "Unable to unveil $!";
66 	unveil("/bin/rm", "rx") or die "Unable to unveil $!";
67 	unveil("/bin/mv", "rx") or die "Unable to unveil $!";
68 	unveil("/home/", "rwxc") or die "Unable to unveil $!";
69 }
70 
71 # !shell <username> <email>
72 # !shell captcha <captcha>
73 sub mshell {
74 	my ($bot, $nick, $host, $hand, @args) = @_;
75 	my ($chan, $text);
76 	if (@args == 2) {
77 		($chan, $text) = ($args[0], $args[1]);
78 	} else { $text = $args[0]; }
79 	my $hostmask = "$nick!$host";
80 	if (defined($chan) && $chans =~ /$chan/) {
81 		main::putserv($bot, "PRIVMSG $chan :$nick: Please check private message");
82 	}
83 	if ($text =~ /^$/) {
84 		main::putserv($bot, "PRIVMSG $nick :Type !help for new instructions");
85 		foreach my $chan (@teamchans) {
86 			main::putservlocalnet($bot, "PRIVMSG $chan :$staff: Help *$nick* on network ".$bot->{name}." with shell registration");
87 		}
88 		return;
89 	} elsif (main::isstaff($bot, $nick) && $text =~ /^delete\s+([[:ascii:]]+)/) {
90 		my $username = $1;
91 		if (SQLite::deleterows("shell", "username", $username)) {
92 			# TODO delete shell
93 			deleteshell($username);
94 			foreach my $chan (@teamchans) {
95 				main::putserv($bot, "PRIVMSG $chan :$username deleted");
96 			}
97 		}
98 		return;
99 	} elsif (main::isstaff($bot, $nick) && $text =~ /^approve\s+([[:ascii:]]+)/) {
100 		my $username = $1;
101 		system "doas usermod -e 0 -s /bin/ksh $username";
102 		foreach my $chan (@teamchans) {
103 			main::putserv($bot, "PRIVMSG $chan :$username approved");
104 		}
105 		return;
106 	}
107 	### TODO: Check duplicate emails ###
108 	my @rows = SQLite::selectrows("irc", "nick", $nick);
109 	foreach my $row (@rows) {
110 		my $password = SQLite::get("shell", "ircid", $row->{id}, "password");
111 		if (defined($password)) {
112 			main::putserv($bot, "PRIVMSG $nick :Sorry, only one account per person. Please contact staff if you need help.");
113 			return;
114 		}
115 	}
116 	if ($text =~ /^lastseen\s+([[:alnum:]]+)/) {
117 	}
118 	if ($text =~ /^captcha\s+([[:alnum:]]+)/) {
119 		my $text = $1;
120 		my $ircid = SQLite::id("irc", "nick", $nick, $expires);
121 		if (!defined($ircid)) { die "undefined ircid"; }
122 		my $captcha = SQLite::get("shell", "ircid", $ircid, "captcha");
123 		if ($text ne $captcha) {
124 			main::putserv($bot, "PRIVMSG $nick :Wrong captcha. To get a new captcha, type !shell <username> <email>");
125 			return;
126 		}
127 		my $pass = Hash::newpass();
128 		chomp(my $encrypted = `encrypt $pass`);
129 		my $username = SQLite::get("shell", "ircid", $ircid, "username");
130 		my $email = SQLite::get("shell", "ircid", $ircid, "email");
131 		my $version = SQLite::get("shell", "ircid", $ircid, "version");
132 		my $bindhost = "$username.$hostname";
133 		SQLite::set("shell", "ircid", $ircid, "password", $encrypted);
134 		if (DNS::nextdns($username)) {
135 			sleep(2);
136 			createshell($username, $pass, $bindhost);
137 			mailshell($username, $email, $pass, "shell", $version);
138 			main::putserv($bot, "PRIVMSG $nick :Check your email!");
139 			if ($approval eq "true") {
140 				my $yesterday = yesterday();
141 				system "doas usermod -e $yesterday -s /sbin/nologin $username";
142 				main::putserv($bot, "PRIVMSG $nick :Your account has been created but must be manually approved by your admins ($staff) before it can be used.");
143 				foreach my $chan (@teamchans) {
144 					main::putservlocalnet($bot, "PRIVMSG $chan :$staff: $nick\'s account $username must be manually unblocked before it can be used.");
145 				}
146 			}
147 			foreach my $chan (@teamchans) {
148 				main::putservlocalnet($bot, "PRIVMSG $chan :$staff: $nick\'s shell registration of $username on $bot->{name} was successful, *but* you *must* help him connect. Most users are unable to connect. Show him https://wiki.ircnow.org/?n=Shell.Shell");
149 			}
150 
151 
152 			#www($newnick, $reply, $password, "bouncer");
153 		} else {
154 			foreach my $chan (@teamchans) {
155 				main::putserv($bot, "PRIVMSG $chan :Assigning bindhost $bindhost failed");
156 			}
157 		}
158 		return;
159 	} elsif ($text =~ /^([[:alnum:]]+)\s+([[:ascii:]]+)/) {
160 		my ($username, $email) = ($1, $2);
161 		my @users = col($passpath, 1, ":");
162 		my @matches = grep(/^$username$/i, @users);
163 		if (scalar(@matches) > 0) {
164 			main::putserv($bot, "PRIVMSG $nick :Sorry, username taken. Please choose another username, or contact staff for help.");
165 			return;
166 		}
167 		#		my $captcha = join'', map +(0..9,'a'..'z','A'..'Z')[rand(10+26*2)], 1..4;
168 		my $captcha = int(rand(999));
169 		my $ircid = int(rand(2147483647));
170 		SQLite::set("irc", "id", $ircid, "localtime", time());
171 		SQLite::set("irc", "id", $ircid, "date", main::date());
172 		SQLite::set("irc", "id", $ircid, "hostmask", $hostmask);
173 		SQLite::set("irc", "id", $ircid, "nick", $nick);
174 		SQLite::set("shell", "ircid", $ircid, "username", $username);
175 		SQLite::set("shell", "ircid", $ircid, "email", $email);
176 		SQLite::set("shell", "ircid", $ircid, "captcha", $captcha);
177 		main::whois($bot->{sock}, $nick);
178 		main::ctcp($bot->{sock}, $nick);
179 		main::putserv($bot, "PRIVMSG $nick :".`figlet $captcha`);
180 		#		main::putserv($bot, "PRIVMSG $nick :$captchaURL".encode_base64($captcha));
181 		main::putserv($bot, "PRIVMSG $nick :Type !shell captcha <text>");
182 		foreach my $chan (@teamchans) {
183 			main::putservlocalnet($bot, "PRIVMSG $chan :$nick\'s captcha on $bot->{name} is $captcha");
184 		}
185 	} else {
186 		main::putserv($bot, "PRIVMSG $nick :Invalid username or email. Type !shell <username> <email> to try again.");
187 		foreach my $chan (@teamchans) {
188 			main::putserv($bot, "PRIVMSG $chan :$staff: Help *$nick* on network ".$bot->{name}." with shell registration");
189 		}
190 	}
191 }
192 sub mailshell {
193 	my( $username, $email, $password, $service, $version )=@_;
194 	my $passhash = sha256_hex("$username");
195 	my $versionhash = encode_base64($version);
196 	my $approvemsg;
197 	if ($approval eq "true") {
198 		$approvemsg = <<"EOF";
199 
200 *IMPORTANT*: Your account has been created but it has not yet been
201 approved. To get your account approved, please contact your admins
202 $staff on IRC and by email.
203 
204 EOF
205 	}
206 
207 	my $body = <<"EOF";
208 You created a shell account!
209 
210 Username: $username
211 Password: $password
212 Server: $hostname
213 SSH Port: 22
214 Your Ports: $startPort to $endPort
215 
216 To customize your vhost, connect to ask in $chans
217 $approvemsg
218 *IMPORTANT*: Verify your email address:
219 
220 Please reply to this email to indicate you have received the email. You must
221 reply in order to keep your account.
222 
223 IRCNow
224 EOF
225 	main::mail($mailfrom, $email, $mailname, "Verify IRCNow Account", $body);
226 }
227 
228 
229 #sub mregex {
230 #	my ($bot, $nick, $host, $hand, $text) = @_;
231 #	if ($staff !~ /$nick/) { return; }
232 #	if ($text =~ /^ips?\s+([-_()|0-9A-Za-z:\.?*\s]{3,})$/) {
233 #		my $ips = $1; # space-separated list of IPs
234 #		main::putserv($bot, "PRIVMSG $nick :".regexlist($ips));
235 #	} elsif ($text =~ /^users?\s+([-_()|0-9A-Za-z:\.?*\s]{3,})$/) {
236 #		my $users = $1; # space-separated list of usernames
237 #		main::putserv($bot, "PRIVMSG $nick :".regexlist($users));
238 #	} elsif ($text =~ /^[-_()|0-9A-Za-z:,\.?*\s]{3,}$/) {
239 #		my @lines = regex($text);
240 #		foreach my $l (@lines) { print "$l\n"; }
241 #	}
242 #}
243 #sub mforeach {
244 #	my ($bot, $nick, $host, $hand, $text) = @_;
245 #	if ($staff !~ /$nick/) { return; }
246 #	if ($text =~ /^network\s+del\s+([[:graph:]]+)\s+(#[[:graph:]]+)$/) {
247 #		my ($user, $chan) = ($1, $2);
248 #		foreach my $n (@main::networks) {
249 #			main::putserv($bot, "PRIVMSG *controlpanel :delchan $user $n->{name} $chan");
250 #		}
251 #	}
252 #}
253 
254 #sub loadlog {
255 #	open(my $fh, '<', "$authlog") or die "Could not read file 'authlog' $!";
256 #	chomp(@logs = <$fh>);
257 #	close $fh;
258 #}
259 
260 # return all lines matching a pattern
261 #sub regex {
262 #	my ($pattern) = @_;
263 #	if (!@logs) { loadlog(); }
264 #	return grep(/$pattern/, @logs);
265 #}
266 
267 # given a list of IPs, return matching users
268 # or given a list of users, return matching IPs
269 #sub regexlist {
270 #	my ($items) = @_;
271 #	my @items = split /[,\s]+/m, $items;
272 #	my $pattern = "(".join('|', @items).")";
273 #	if (!@logs) { loadlog(); }
274 #	my @matches = grep(/$pattern/, @logs);
275 #	my @results;
276 #	foreach my $match (@matches) {
277 #		if ($match =~ /^\[\d{4}-\d\d-\d\d \d\d:\d\d:\d\d\] \[([^]\/]+)(\/[^]]+)?\] connected to ZNC from (.*)/) {
278 #			my ($user, $ip) = ($1, $3);
279 #			if ($items =~ /[.:]/) { # items are IP addresses
280 #				push(@results, $user);
281 #			} else { # items are users
282 #				push(@results, $ip);
283 #			}
284 #		}
285 #	}
286 #	my @sorted = sort @results;
287 #	@results = do { my %seen; grep { !$seen{$_}++ } @sorted }; # uniq
288 #	return join(' ', @results);
289 #}
290 
291 sub createshell {
292 	my ($username, $password, $bindhost) = @_;
293 	system "doas groupadd $username";
294 	system "doas adduser -batch $username $username $username `encrypt $password`";
295 	system "doas chmod 700 /home/$username /home/$username/.ssh";
296 	system "doas chmod 600 /home/$username/{.Xdefaults,.cshrc,.cvsrc,.login,.mailrc,.profile}";
297 	system "doas mkdir /var/www/htdocs/$username";
298 	system "doas ln -s /var/www/htdocs/$username /home/$username/htdocs";
299 	system "doas chown -R $username:www /var/www/htdocs/$username /home/$username/htdocs";
300 	system "doas chmod -R o-rx /var/www/htdocs/$username /home/$username/htdocs";
301 	system "doas chmod -R g+rwx /var/www/htdocs/$username /home/$username/htdocs";
302 	system "doas chown root:wheel $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
303 	system "doas chmod g+rw $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
304 	my $lusername = lc $username;
305 	my $block = <<"EOF";
306 server "$lusername.$hostname" {
307 	listen on * port 80
308 	location "/.well-known/acme-challenge/*" {
309 		root "/acme"
310 		request strip 2
311 	}
312 	location "*.php" {
313 		fastcgi socket "/run/php-fpm.sock"
314 	}
315 	root "/htdocs/$username"
316 }
317 EOF
318 	main::appendfile($httpdconfpath, $block);
319 	$block = <<"EOF";
320 domain "$lusername.$hostname" {
321 	domain key "/etc/ssl/private/$lusername.$hostname.key"
322 	domain full chain certificate "/etc/ssl/$lusername.$hostname.crt"
323 	sign with letsencrypt
324 }
325 EOF
326 	main::appendfile($acmeconfpath, $block);
327 	configurepf($username);
328 	system "doas rcctl reload httpd";
329         system "doas acme-client -F $lusername.$hostname";
330 	system "doas ln -s /etc/ssl/$lusername.$hostname.crt /etc/ssl/$lusername.$hostname.fullchain.pem";
331 	system "doas pfctl -f /etc/pf.conf";
332 	configurerelayd($username);
333 	$block = <<"EOF";
334 ~       *       *       *       *       acme-client $lusername.$hostname && rcctl reload relayd
335 EOF
336 	system "echo $block | doas crontab -";
337 #edquota $username
338 	return 1;
339 }
340 
341 sub deleteshell {
342 	my ($username, $bindhost) = @_;
343 	my $lusername = lc $username;
344 	system "doas chown root:wheel $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
345 	system "doas chmod g+rw $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
346 	system "doas groupdel $username";
347 	system "doas userdel $username";
348 	system "doas rm -f /etc/ssl/$lusername.$hostname.crt /etc/ssl/$lusername.$hostname.fullchain.pem /etc/ssl/private/$lusername.$hostname.key";
349 	my $httpdconf = main::readstr($httpdconfpath);
350 	my $block = <<"EOF";
351 server "$lusername.$hostname" {
352 	listen on * port 80
353 	location "/.well-known/acme-challenge/*" {
354 		root "/acme"
355 		request strip 2
356 	}
357 	location "*.php" {
358 		fastcgi socket "/run/php-fpm.sock"
359 	}
360 	root "/htdocs/$username"
361 }
362 EOF
363 	$block =~ s/{/\\{/gm;
364 	$block =~ s/}/\\}/gm;
365 	$block =~ s/\./\\./gm;
366 	$block =~ s/\*/\\*/gm;
367 	$httpdconf =~ s{$block}{}gm;
368 	print $httpdconf;
369 	main::writefile($httpdconfpath, $httpdconf);
370 	
371 	my $acmeconf = main::readstr($acmeconfpath);
372 	$block = <<"EOF";
373 domain "$lusername.$hostname" {
374 	domain key "/etc/ssl/private/$lusername.$hostname.key"
375 	domain full chain certificate "/etc/ssl/$lusername.$hostname.fullchain.pem"
376 	sign with letsencrypt
377 }
378 EOF
379 	$block =~ s/{/\\{/gm;
380 	$block =~ s/}/\\}/gm;
381 	$block =~ s/\./\\./gm;
382 	$block =~ s/\*/\\*/gm;
383 	$acmeconf =~ s{$block}{}gm;
384 	main::writefile($acmeconfpath, $acmeconf);
385 	return 1;
386 }
387 
388 #TODO Fix for $i
389 # Return column $i from $filename as an array with file separator $FS
390 sub col {
391 	my ($filename, $i, $FS) = @_;
392 	my @rows = main::readarray($filename);
393 	my @results;
394 	foreach my $row (@rows) {
395 		if ($row =~ /^(.*?)$FS/) {
396 			push(@results, $1);
397 		}
398 	}
399 	return @results;
400 }
401 
402 sub configurepf {
403     my $username = shift;
404     my @read = split('\n', main::readstr($pfconfpath) );
405     
406     my $previousline = "";
407     my @pfcontent;
408     foreach my $line(@read)
409     {
410         my $currline = $line;    
411         if( $currline ne "# end user ports") {
412             $previousline = $currline;        
413         } else {
414             #pass in proto {tcp udp} to port {31361:31370} user {JL}
415             if( $previousline =~ /(\d*):(\d*)/ ) {            
416                 my $startport = ( $1 + 10 );
417                 my $endport = ( $2 + 10 );
418                 my $insert = "pass in proto {tcp udp} to port {$startport:$endport} user {$username}";
419                 push(@pfcontent, $insert);
420 		$startPort = $startport;
421 		$endPort = $endport;
422             }
423         }
424         push(@pfcontent, $currline)
425     }
426     main::writefile("$pfconfpath", join("\n",@pfcontent))
427 }
428 
429 sub configurerelayd {  
430         my ($username) = @_;                 
431 	my $block = "tls { keypair $username.$hostname }";
432 	my $relaydconf = main::readstr($relaydconfpath);
433 	my $newconf;
434 	if ($relaydconf =~ /^.*tls\s+{\s+keypair\s+[.0-9a-zA-Z]+\s*}/m) {
435 		$newconf = "$`$&\n\t$block$'";
436 	}
437 	main::writefile($relaydconfpath, $newconf);
438 }
439 
440 #unveil("./newacct", "rx") or die "Unable to unveil $!";
441 1; # MUST BE LAST STATEMENT IN FILE