]> git.madduck.net Git - code/molly-guard.git/blob - checks.d/molly-guard

madduck's git repository

Every one of the projects in this repository is available at the canonical URL git://git.madduck.net/madduck/pub/<projectpath> — see each project's metadata for the exact URL.

All patches and comments are welcome. Please squash your changes to logical commits before using git-format-patch and git-send-email to patches@git.madduck.net. If you'd read over the Git project's submission guidelines and adhered to them, I'd be especially grateful.

SSH access, as well as push access can be individually arranged.

If you use my repositories frequently, consider adding the following snippet to ~/.gitconfig and using the third clone URL listed for each project:

[url "git://git.madduck.net/madduck/"]
  insteadOf = madduck:

Add support to always molly-guard a host, even if we're logged in at the console.
[code/molly-guard.git] / checks.d / molly-guard
1 #!/bin/sh
2 #
3 # molly-guard -- wrapper script to prevent erroneous shutdowns via SSH
4 #
5 # Copyright © martin f. krafft <madduck@madduck.net>
6 # Released under the terms of the Artistic Licence 2.0
7 #
8 set -eu
9
10 ME=molly-guard
11
12 ALWAYS_MOLLY=${ALWAYS_MOLLY:-"0"}
13 [ -f /etc/default/${ME} ] && . /etc/default/${ME}
14
15 CMD=$1; shift
16 PRETEND_SSH=0
17 for arg in "$@"; do
18   case "$arg" in
19     (*-help)
20       usage 2>&1
21       eval $EXEC --help 2>&1
22       exit 1
23       ;;
24     (*-pretend-ssh) PRETEND_SSH=1;;
25   esac
26 done
27
28 # require an interactive terminal connected to stdin
29 test -t 0                    || exit 0
30
31 # we've been asked to always protect this host
32 if [ ${ALWAYS_MOLLY} -eq 1 ]; then
33   echo "W: $ME: ${CMD} is always molly-guarded on this server."
34 else
35   # only run if we are being called over SSH, that is if the current terminal
36   # was created by sshd.
37   PTS=$(readlink /proc/$$/fd/0)
38   if ! pgrep -f "^sshd.+${PTS#/dev/}[[:space:]]*$" >/dev/null \
39     && [ -z "${SSH_CONNECTION:-}" ]; then
40       if [ $PRETEND_SSH -eq 1 ]; then
41         echo "I: this is not an SSH session, but --pretend-ssh was given..."
42       else
43         exit 0
44       fi
45   else
46     echo "W: $ME: SSH session detected!"
47   fi
48 fi
49
50
51 HOSTNAME="$(hostname --short)"
52
53 sigh()
54 {
55   echo "Good thing I asked; I won't $CMD $HOSTNAME ..."
56   exit 1
57 }
58
59 trap 'echo;sigh' 1 2 3 9 10 12 15
60
61 echo -n "Please type in hostname of the machine to $CMD: "
62 read HOSTNAME_USER || :
63
64 [ "$HOSTNAME_USER" = "$HOSTNAME" ] || sigh
65
66 trap - 1 2 3 9 10 12 15
67
68 exit 0