From 59cbf758e1965f7127e337983a4f3e38f8233e4d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= Date: Thu, 5 Nov 2020 11:08:59 +0100 Subject: Remove packages merged to turris-os-packages --- medkit-initial-config/files/README.md | 50 ------- medkit-initial-config/files/medkit-initial-config | 156 ---------------------- 2 files changed, 206 deletions(-) delete mode 100644 medkit-initial-config/files/README.md delete mode 100644 medkit-initial-config/files/medkit-initial-config (limited to 'medkit-initial-config/files') diff --git a/medkit-initial-config/files/README.md b/medkit-initial-config/files/README.md deleted file mode 100644 index 528f20b..0000000 --- a/medkit-initial-config/files/README.md +++ /dev/null @@ -1,50 +0,0 @@ -Medkit initial system configuration ------------------------------------ -This package provides script that allows limited configuration of router after -medkit is used. The idea is to allow users to preconfigure router in a way they -can connect to it in secure manner over WiFi if needed. - -It is applied only with first boot on medkited router. It intentionally does not -work with just factory reset, medkit reflash is required. - -## Usage -User places alongside medkit configuration file to flash drive. The name of file -has to be in format `BOARD-medkit-config.json` where `BOARD` is name of board -consistent with medkit prefix. - -## Configuration file format -Configuration file has to contain valid JSON. - -### Example configuration -``` -{ - "foris_password": "m4ZZMC9cpyu3xpbw", - "system_password": "Wru4FU0TLw8avIVY", - "wireless": { - "ssid": "TurrisConfigWifi", - "key": "tScqsSAr0DXEqUe0" - } -} -``` - -### Foris Password -Option `foris_password` can be used to configure password for Foris web interface -and that way skip initial step in setup. - -This is suggested to be used as web interfaces allows anyone to set initial -password. That makes router administration accessible by anyone. By setting -password even before WiFi or/and Foris are started prevents access to just -everyone. - -### System Password -Option `system_password` can be used to configure password for `root` account on -router. This is password used by LuCI web interfaces as well as SSH. - -This is not essentially required on Turris, because in default root account is -blocked for interactive login. This is included rather for convenience for cases -when user wants to use SSH rather than Foris. - -### Wireless AP configuration -Option `wireless` has to be set to object with `ssid` and `key` fields. It -configures first radio it can access on system to AP mode with provided SSID and -key (password). diff --git a/medkit-initial-config/files/medkit-initial-config b/medkit-initial-config/files/medkit-initial-config deleted file mode 100644 index c1c6f2f..0000000 --- a/medkit-initial-config/files/medkit-initial-config +++ /dev/null @@ -1,156 +0,0 @@ -#!/bin/sh -set -eu - -# There are multiple reasons why we do not want to just automatically always run -# this script on any other occasion except when you do medkit. -# It is also more strait forward for users to have it as some sort of extension to -# medkit. That is placing appropriate file beside medkit. -# When router is medkited then there is no snapshots. Only other case when this -# happen is when you unpack router from the box (from factory). This means that we -# can safely assume that no snapshot is the symptom of medkit. -# Why we want to allow configuration just in case of medkit is because we want to -# force user to update router to latest version of drivers. It is potentially -# dangerous to enable WiFi in old versions of system as there could be known -# vulnerabilities. -if ! schnapps list -j | jsonfilter -e '$.snapshots[0]' >/dev/null; then - echo "For security concerns " >&2 - exit 1 -fi - - -. /etc/os-release -case "$OPENWRT_DEVICE_PRODUCT" in - "Turris Mox") - board="mox" - ;; - "Turris Omnia") - board="omnia" - ;; - "Turris 1.x") - board="turris1x" - ;; - *) - echo "Router we are running on is not known to medkit-initial-config!" >&2 - exit 1 - ;; -esac - - -tmpmnt="$(mktemp -d)" -tmpclean() { - umount -fl "$tmpmnt" 2>/dev/null || true - rmdir "$tmpmnt" 2>/dev/null || true -} -trap tmpclean HUP INT QUIT TERM EXIT - -# Locate drive with medkit and configuration file -for dev in /dev/mmcblk*p* /dev/sd*; do - [ -e "$dev" ] || continue - echo "Checking device: $dev" - mount "$dev" "$tmpmnt" || continue - - for medkit in \ - "$tmpmnt/$board"-medkit-*.tar.gz \ - "$tmpmnt/medkit-$board"*.tar.gz \ - ; do - [ -f "$medkit" ] || continue - [ -f "$medkit.md5" ] && \ - (cd "${medkit%/*}" && md5sum "$medkit.md5") || continue - [ -f "$medkit.sha256" ] && \ - (cd "${medkit%/*}" && sha256sum "$medkit.sha256") || continue - [ -f "$medkit.sig" ] && \ - usign -V -m "$medkit" -P /etc/opkg/keys || continue - - echo "Located drive used for medkit: $dev (medkit: ${medit##*/})" >&2 - - config_file="${medkit%/*}/$board-medkit-config.json" - if [ -f "$config_file" ]; then - echo "Located config file: ${config_file##*/}" >&2 - break - else - echo "No config file located alongside the medkit." >&2 - umount -fl - exit 0 - fi - done - [ -f "$config_file" ] && break - umount -fl "$tmpmnt" -done - -if [ ! -f "$config_file" ]; then - # The only way we could get here is that device with medkit is not connected - echo "Device with appropriate medkit not located." >&2 - exit 0 -fi - - -################################################################################## -# Load config and apply it on system -. /usr/share/libubox/jshn.sh -json_init -json_load_file "$config_file" - - -foris_password() { - local password - json_get_var password "foris_password" || { - echo "foris_password configuration not present." >&2 - return - } - - uci -q batch <<-EOF - foris.auth=config - foris.auth.password=$password - commit foris.auth - EOF - echo "Foris password set." >&2 -} - -system_password() { - local password - json_get_var password "system_password" || { - echo "system_password configuration not present." >&2 - return - } - - echo "root:$password" | chpasswd - passwd -u root - echo "System password set." >&2 -} - -wireless() { - json_select "wireless" >/dev/null || { - echo "wireless configuration not present." >&2 - return - } - local ssid key - for var in ssid key; do - json_get_var "$var" "$var" || { - echo "wireless.$var configuration is missing. Wireless configuration not performed." >&2 - return - } - done - - local wifi_dev - wifi_dev="$(uci show 'wireless.@wifi-device[0]' | \ - sed -n 's/^wireless\.\([^.]\+\)=.*$/\1/p')" || { - echo "Wireless configuration is not possible as there is no WiFi device." >&2 - return - } - - uci -q batch <<-EOF - wireless.wifinet_auto=wifi-iface - wireless.wifinet_auto.device=$wifi_dev - wireless.wifinet_auto.network=lan - wireless.wifinet_auto.mode=ap - wireless.wifinet_auto.ssid=$ssid - wireless.wifinet_auto.encryption=psk2+tkip+aes - wireless.wifinet_auto.key=$key - commit wireless.wifinet_auto - EOF -} - - -foris_password -system_password -wireless -- cgit v1.2.3