Mortdecai
d7205a911c
ssh re-splits remote command args on spaces, so -- "$PUB" arrived as $1=ssh-ed25519 (the key body and comment became $2/$3). The loose validation passed and grep -qF matched any ed25519 key -> false '[skip] key present'; the key was never added. Pass PUB via env (safe inside remote single-quotes) and require 'ssh-ed25519 AAAA*'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
19 lines
1.1 KiB
Bash
Executable File
19 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Run on pve173: ssh pve173 "PUB='<pubkey line>' bash -s" < scripts/tank-side.sh
|
|
# PUB comes via env (not a command arg) so ssh's remote-side re-splitting can't truncate the
|
|
# space-separated key line. $1 kept as a fallback for a local run.
|
|
set -euo pipefail
|
|
PUB=${PUB:-${1:-}}
|
|
[[ $PUB == ssh-ed25519\ AAAA* ]] || { echo "not a full pubkey line: '$PUB'"; exit 1; }
|
|
DS=tank/backups/mac; TS=$(date +%s)
|
|
if zfs list "$DS" >/dev/null 2>&1; then echo "[skip] dataset $DS"; else zfs create "$DS"; echo "[set] created $DS"; fi
|
|
if grep -q "^\[$DS\]" /etc/sanoid/sanoid.conf; then echo "[skip] sanoid stanza"; else
|
|
mkdir -p /etc/sanoid/.backup; cp /etc/sanoid/sanoid.conf "/etc/sanoid/.backup/sanoid.conf-$TS"
|
|
printf '\n[%s]\n\tuse_template = tank_media\n' "$DS" >> /etc/sanoid/sanoid.conf; echo "[set] sanoid stanza"
|
|
fi
|
|
KEYLINE="restrict,command=\"/usr/bin/rrsync /$DS\" $PUB"
|
|
if grep -qF "$PUB" /root/.ssh/authorized_keys; then echo "[skip] key present"; else
|
|
cp /root/.ssh/authorized_keys "/root/.ssh/authorized_keys.bak-$TS"
|
|
echo "$KEYLINE" >> /root/.ssh/authorized_keys; echo "[set] rrsync-restricted key added"
|
|
fi
|