65 lines
1.9 KiB
Bash
65 lines
1.9 KiB
Bash
#!/bin/bash
|
|
## This script make autologin. If user has phisical access
|
|
## to the device we can trust him, otherwiese we require password
|
|
## for remote access
|
|
|
|
|
|
# Parameters
|
|
USERNAME="user"
|
|
|
|
# Sanity check
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "Please run this script as root."
|
|
exit 1
|
|
fi
|
|
|
|
if ! id "$USERNAME" &>/dev/null; then
|
|
echo "User '$USERNAME' does not exist."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Setting up passwordless sudo for physical access for user: $USERNAME"
|
|
echo
|
|
|
|
# 1. Configure sudoers: allow passwordless sudo
|
|
echo "Configuring sudoers for $USERNAME..."
|
|
echo "Defaults:$USERNAME !authenticate" >> /etc/sudoers.d/00-$USERNAME-nopasswd
|
|
chmod 440 /etc/sudoers.d/00-$USERNAME-nopasswd
|
|
|
|
# 2. Modify PAM for sudo to allow password only on non-physical ttys
|
|
echo "Configuring PAM for sudo tty check..."
|
|
PAM_FILE="/etc/pam.d/sudo"
|
|
BACKUP_FILE="/etc/pam.d/sudo.bak"
|
|
|
|
if ! grep -q "pam_succeed_if.so tty" "$PAM_FILE"; then
|
|
echo "Creating backup of $PAM_FILE to $BACKUP_FILE"
|
|
cp "$PAM_FILE" "$BACKUP_FILE"
|
|
|
|
sed -i '1iauth [success=1 default=ignore] pam_succeed_if.so tty =~ /dev/tty[0-9]*' "$PAM_FILE"
|
|
echo "PAM modified to restrict passwordless sudo to physical TTYs."
|
|
else
|
|
echo "PAM sudo already appears configured."
|
|
fi
|
|
|
|
# 3. Enable autologin on tty1
|
|
echo "Configuring systemd autologin on tty1 for $USERNAME..."
|
|
mkdir -p /etc/systemd/system/getty@tty1.service.d
|
|
AUTOLOGIN_CONF="/etc/systemd/system/getty@tty1.service.d/override.conf"
|
|
|
|
cat > "$AUTOLOGIN_CONF" <<EOF
|
|
[Service]
|
|
ExecStart=
|
|
ExecStart=-/sbin/agetty --autologin $USERNAME --noclear %I \$TERM
|
|
EOF
|
|
|
|
# Reload systemd and apply change
|
|
echo "Reloading systemd and restarting tty1..."
|
|
systemctl daemon-reexec
|
|
systemctl daemon-reload
|
|
systemctl restart getty@tty1
|
|
|
|
echo
|
|
echo "All done."
|
|
echo "User '$USERNAME' will now auto-login on tty1 and can use sudo without a password if physically present."
|
|
echo "Remote users (SSH) will still need to enter a password for sudo."
|
|
|