add stuff
This commit is contained in:
angryzero committed
commit
26cd15d899
65 files changed
+4820
No files matched your search
Executable
+97
@@ -0,0 +1,97 @@
|
||||
#!/bin/sh
|
||||
# deploy_sshd.sh — run as root on the TV (e.g. via the root loop).
|
||||
#
|
||||
# Expects in /3rd_rw/appdata:
|
||||
# dropbear dropbearkey authorized_keys start_sshd.sh root_loop.sh
|
||||
# hamservice-wrapper.sh
|
||||
# Upload these with root/scripts/host/upload_to_appdata.js (or File.download).
|
||||
#
|
||||
# Installs:
|
||||
# /3rd_rw/sshd/{dropbear,dropbearkey,host_key,etc_passwd,start_sshd.sh,home/.ssh/authorized_keys}
|
||||
# /3rd_rw/hamservice/HamService (wrapper; replaces the symlink)
|
||||
# bind /etc/passwd -> /3rd_rw/sshd/etc_passwd
|
||||
# devpts /dev/shm/pts -> bind /dev/pts (PTY workaround)
|
||||
# Dropbear on 0.0.0.0:22, key-only root login
|
||||
#
|
||||
# Reversible with rollback.sh or the ROOT-GUIDE.
|
||||
set -e
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
|
||||
APP=/3rd_rw/appdata
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== deploy_sshd: start ==="
|
||||
for f in dropbear dropbearkey authorized_keys start_sshd.sh root_loop.sh hamservice-wrapper.sh; do
|
||||
[ -f "$APP/$f" ] || { echo "missing: $APP/$f"; exit 1; }
|
||||
done
|
||||
|
||||
mkdir -p "$D/home/.ssh" /3rd_rw/hamservice
|
||||
|
||||
# --- binaries + host key -------------------------------------------------
|
||||
cp -f "$APP/dropbear" "$D/dropbear"
|
||||
if [ -f "$APP/dropbear-sftp" ]; then
|
||||
cp -f "$APP/dropbear-sftp" "$D/dropbear"
|
||||
echo "using SFTP-capable dropbear"
|
||||
fi
|
||||
chmod 755 "$D/dropbear"
|
||||
cp -f "$APP/dropbearkey" "$D/dropbearkey"; chmod 755 "$D/dropbearkey"
|
||||
if [ -f "$APP/sftp-server" ]; then
|
||||
cp -f "$APP/sftp-server" "$D/sftp-server"
|
||||
chmod 755 "$D/sftp-server"
|
||||
echo "sftp-server installed"
|
||||
fi
|
||||
if [ ! -f "$D/host_key" ]; then
|
||||
"$D/dropbearkey" -t ed25519 -f "$D/host_key"
|
||||
fi
|
||||
|
||||
# --- root home via bind-mounted passwd -----------------------------------
|
||||
cp -f /etc/passwd "$D/etc_passwd"
|
||||
sed -i 's|^root:x:0:0:root:.*|root:x:0:0:root:/3rd_rw/sshd/home:/bin/sh|' "$D/etc_passwd"
|
||||
if ! grep -q '^root:x:0:0:root:/3rd_rw/sshd/home:' /etc/passwd 2>/dev/null; then
|
||||
mount --bind "$D/etc_passwd" /etc/passwd 2>>"$D/mount.log" \
|
||||
|| mount -o bind "$D/etc_passwd" /etc/passwd 2>>"$D/mount.log"
|
||||
fi
|
||||
|
||||
# --- PTY: devpts on tmpfs, bind over /dev/pts -----------------------------
|
||||
mkdir -p /dev/shm/pts
|
||||
if ! grep -q ' /dev/shm/pts ' /proc/mounts; then
|
||||
mount -t devpts -o mode=620,ptmxmode=666,gid=5 devpts /dev/shm/pts 2>>"$D/mount.log" \
|
||||
|| mount -t devpts devpts /dev/shm/pts 2>>"$D/mount.log"
|
||||
fi
|
||||
if ! grep -q ' /dev/pts ' /proc/mounts; then
|
||||
mount --bind /dev/shm/pts /dev/pts 2>>"$D/mount.log"
|
||||
fi
|
||||
|
||||
# --- authorized key / permissions ----------------------------------------
|
||||
cp -f "$APP/authorized_keys" "$D/home/.ssh/authorized_keys"
|
||||
chmod 700 "$D/home" "$D/home/.ssh"
|
||||
chmod 600 "$D/home/.ssh/authorized_keys"
|
||||
chown -R 0:0 "$D"
|
||||
|
||||
# --- start script + root loop + boot wrapper -----------------------------
|
||||
cp -f "$APP/start_sshd.sh" "$D/start_sshd.sh"; chmod 755 "$D/start_sshd.sh"
|
||||
chmod 644 "$APP/root_loop.sh"
|
||||
rm -f /3rd_rw/hamservice/HamService
|
||||
cp -f "$APP/hamservice-wrapper.sh" /3rd_rw/hamservice/HamService
|
||||
chmod 755 /3rd_rw/hamservice/HamService
|
||||
|
||||
# --- start now (idempotent) ----------------------------------------------
|
||||
/bin/sh "$D/start_sshd.sh"
|
||||
sleep 2
|
||||
|
||||
echo "--- passwd root entry ---"
|
||||
grep '^root:' /etc/passwd
|
||||
echo "--- mounts ---"
|
||||
grep -E ' /etc/passwd | /dev/pts | /dev/shm/pts ' /proc/mounts
|
||||
echo "--- processes ---"
|
||||
ps | grep -E 'dropbear|root_loop' | grep -v grep || true
|
||||
echo "--- tcp 22 ---"
|
||||
cat /proc/net/tcp | grep -i ':0016' || true
|
||||
echo "--- dropbear log ---"
|
||||
/bin/busybox tail -n 8 "$D/dropbear.log" 2>&1 || true
|
||||
echo "--- host key ---"
|
||||
"$D/dropbearkey" -y -f "$D/host_key" 2>&1 | /bin/busybox tail -n 3 || true
|
||||
echo "--- files ---"
|
||||
ls -la "$D" "$D/home/.ssh" /3rd_rw/hamservice
|
||||
echo "=== deploy_sshd: done ==="
|
||||
Executable
+37
@@ -0,0 +1,37 @@
|
||||
#!/bin/sh
|
||||
# enable_sftp.sh — after a successful `sftp -P 2222` test, swap the
|
||||
# SFTP-capable Dropbear onto port 22.
|
||||
#
|
||||
# Backs up the current binary as /3rd_rw/sshd/dropbear.nosftp, schedules
|
||||
# swap_sftp.sh detached (the caller's SSH session will drop), and returns.
|
||||
set -e
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
APP=/3rd_rw/appdata
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
[ -f "$D/sftp-server" ] || { echo "missing $D/sftp-server"; exit 1; }
|
||||
[ -f "$D/dropbear-sftp" ] || { echo "missing $D/dropbear-sftp"; exit 1; }
|
||||
[ -f "$APP/swap_sftp.sh" ] || { echo "missing $APP/swap_sftp.sh"; exit 1; }
|
||||
|
||||
# stop the 2222 test instance
|
||||
if [ -f "$D/dropbear2222.pid" ]; then
|
||||
kill "$(cat "$D/dropbear2222.pid")" 2>/dev/null || true
|
||||
rm -f "$D/dropbear2222.pid"
|
||||
fi
|
||||
|
||||
# one-time backup of the known-good non-SFTP binary
|
||||
if [ ! -f "$D/dropbear.nosftp" ]; then
|
||||
cp -f "$D/dropbear" "$D/dropbear.nosftp"
|
||||
chmod 755 "$D/dropbear.nosftp"
|
||||
fi
|
||||
|
||||
cp -f "$D/dropbear-sftp" "$D/dropbear.new"
|
||||
chmod 755 "$D/dropbear.new"
|
||||
|
||||
if /bin/busybox --list 2>/dev/null | grep -q '^nohup$'; then
|
||||
/bin/busybox nohup /bin/sh "$APP/swap_sftp.sh" >"$D/swap.log" 2>&1 &
|
||||
else
|
||||
/bin/sh "$APP/swap_sftp.sh" >"$D/swap.log" 2>&1 &
|
||||
fi
|
||||
echo "swap scheduled; port 22 will restart in ~3s; reconnect after ~6s"
|
||||
Executable
+13
@@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
# /3rd_rw/hamservice/HamService (wrapper; install via deploy_sshd.sh)
|
||||
# Early-ish boot hook (startHam.sh, after ~15 s): starts the root loop and
|
||||
# Dropbear, then executes the real HamService. Reversible:
|
||||
# rm /3rd_rw/hamservice/HamService
|
||||
# ln -s /3rd/hamservice/HamService /3rd_rw/hamservice/HamService
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
|
||||
/bin/sh /3rd_rw/appdata/root_loop.sh >/dev/null 2>&1 &
|
||||
[ -x /3rd_rw/sshd/start_sshd.sh ] && /bin/sh /3rd_rw/sshd/start_sshd.sh >/dev/null 2>&1 &
|
||||
|
||||
exec /3rd/hamservice/HamService "$@"
|
||||
Executable
+51
@@ -0,0 +1,51 @@
|
||||
#!/bin/sh
|
||||
# install_sftp_stage.sh — stage SFTP on the TV without touching port 22.
|
||||
#
|
||||
# Expects in /3rd_rw/appdata:
|
||||
# sftp-server static OpenSSH sftp-server
|
||||
# dropbear-sftp Dropbear with SFTPSERVER_PATH=/3rd_rw/sshd/sftp-server
|
||||
#
|
||||
# Copies both to /3rd_rw/sshd and starts a test Dropbear on port 2222.
|
||||
# The caller then tests `sftp -P 2222`. Only if that works, enable_sftp.sh
|
||||
# swaps the binary on port 22.
|
||||
set -e
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
|
||||
APP=/3rd_rw/appdata
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== sftp stage: start ==="
|
||||
for f in sftp-server dropbear-sftp; do
|
||||
[ -f "$APP/$f" ] || { echo "missing: $APP/$f"; exit 1; }
|
||||
done
|
||||
mkdir -p "$D"
|
||||
cp -f "$APP/sftp-server" "$D/sftp-server"; chmod 755 "$D/sftp-server"
|
||||
cp -f "$APP/dropbear-sftp" "$D/dropbear-sftp"; chmod 755 "$D/dropbear-sftp"
|
||||
|
||||
# Verify the patched path and static server
|
||||
echo "--- patched path ---"
|
||||
if grep -q '/3rd_rw/sshd/sftp-server' "$D/dropbear-sftp" 2>/dev/null; then
|
||||
echo "patched SFTPSERVER_PATH OK"
|
||||
else
|
||||
echo "WARNING: patched path not found (continuing; SFTP may fail)"
|
||||
fi
|
||||
|
||||
# Stop a previous test instance
|
||||
if [ -f "$D/dropbear2222.pid" ]; then
|
||||
kill "$(cat "$D/dropbear2222.pid")" 2>/dev/null || true
|
||||
rm -f "$D/dropbear2222.pid"
|
||||
fi
|
||||
sleep 1
|
||||
|
||||
"$D/dropbear-sftp" -r "$D/host_key" -p 2222 \
|
||||
-P "$D/dropbear2222.pid" -E >> "$D/dropbear2222.log" 2>&1 &
|
||||
sleep 2
|
||||
|
||||
echo "--- processes ---"
|
||||
ps | grep dropbear | grep -v grep || true
|
||||
echo "--- tcp 2222 (08AE) ---"
|
||||
cat /proc/net/tcp | grep -i ':08AE' || true
|
||||
echo "--- log ---"
|
||||
/bin/busybox tail -n 10 "$D/dropbear2222.log" 2>&1 || true
|
||||
echo "=== sftp stage: done; test with: sftp -P 2222 root@<tv> ==="
|
||||
Executable
+29
@@ -0,0 +1,29 @@
|
||||
#!/bin/sh
|
||||
# rollback.sh — remove the root/SSH persistence layers (run as root).
|
||||
# The rootfs is untouched; this only removes /3rd_rw changes + runtime mounts.
|
||||
# Reboot afterwards for a clean state.
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== rollback: stopping loop/dropbear ==="
|
||||
[ -f /3rd_rw/appdata/root_loop.pid ] && kill "$(cat /3rd_rw/appdata/root_loop.pid)" 2>/dev/null || true
|
||||
[ -f "$D/dropbear.pid" ] && kill "$(cat "$D/dropbear.pid")" 2>/dev/null || true
|
||||
|
||||
echo "=== restore HamService symlink ==="
|
||||
rm -f /3rd_rw/hamservice/HamService
|
||||
ln -s /3rd/hamservice/HamService /3rd_rw/hamservice/HamService
|
||||
|
||||
echo "=== unmount runtime bind mounts ==="
|
||||
umount /etc/passwd 2>/dev/null || true
|
||||
umount /dev/pts 2>/dev/null || true
|
||||
umount /dev/shm/pts 2>/dev/null || true
|
||||
|
||||
echo "=== remove sshd dir + shadows ==="
|
||||
rm -rf "$D"
|
||||
rm -f /3rd_rw/loglevel/lib/libtvsysinfo.so
|
||||
rm -f /3rd_rw/ms-screen/lib/liblogLevel.so
|
||||
rm -f /3rd_rw/appdata/liblogLevel.so
|
||||
sync
|
||||
|
||||
echo "=== rollback done; reboot recommended ==="
|
||||
Executable
+25
@@ -0,0 +1,25 @@
|
||||
#!/bin/sh
|
||||
# /3rd_rw/appdata/root_loop.sh
|
||||
# Root command loop. One instance per boot (boot_id lock).
|
||||
# Write /3rd_rw/appdata/root_cmd.sh; read /3rd_rw/appdata/root_out.txt.
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
|
||||
BID=""
|
||||
[ -r /proc/sys/kernel/random/boot_id ] && BID=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null)
|
||||
[ -z "$BID" ] && BID=0
|
||||
LOCK="/3rd_rw/appdata/root_loop.lock.$BID"
|
||||
mkdir "$LOCK" 2>/dev/null || exit 0
|
||||
|
||||
echo "$$" > /3rd_rw/appdata/root_loop.pid
|
||||
echo "loop started $$ $BID" > /3rd_rw/appdata/root_loop.log
|
||||
|
||||
while true; do
|
||||
if [ -f /3rd_rw/appdata/root_cmd.sh ]; then
|
||||
mv /3rd_rw/appdata/root_cmd.sh /3rd_rw/appdata/root_cmd.run
|
||||
/bin/sh /3rd_rw/appdata/root_cmd.run > /3rd_rw/appdata/root_out.txt 2>&1
|
||||
echo "rc=$?" >> /3rd_rw/appdata/root_out.txt
|
||||
mv /3rd_rw/appdata/root_cmd.run /3rd_rw/appdata/root_cmd.done
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/bin/sh
|
||||
# /3rd_rw/sshd/start_sshd.sh
|
||||
# Starts Dropbear with key-only auth. Also re-creates the runtime bind mounts:
|
||||
# /etc/passwd -> /3rd_rw/sshd/etc_passwd (root home -> /3rd_rw/sshd/home)
|
||||
# /dev/pts -> devpts on /dev/shm/pts (PTY workaround; /dev is static ro)
|
||||
# Must run as root. Idempotent.
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
mkdir -p /3rd_rw/sshd
|
||||
|
||||
# 1) passwd bind mount (root home must be writable for ~/.ssh/authorized_keys)
|
||||
if ! grep -q '^root:x:0:0:root:/3rd_rw/sshd/home:' /etc/passwd 2>/dev/null; then
|
||||
mount --bind /3rd_rw/sshd/etc_passwd /etc/passwd 2>>/3rd_rw/sshd/mount.log \
|
||||
|| mount -o bind /3rd_rw/sshd/etc_passwd /etc/passwd 2>>/3rd_rw/sshd/mount.log
|
||||
fi
|
||||
|
||||
# 2) PTY: /dev is a static ro squashfs, no devtmpfs. Mount devpts on tmpfs
|
||||
# and bind it over /dev/pts. /dev/ptmx (5,2) remains the static node.
|
||||
mkdir -p /dev/shm/pts
|
||||
if ! grep -q ' /dev/shm/pts ' /proc/mounts; then
|
||||
mount -t devpts -o mode=620,ptmxmode=666,gid=5 devpts /dev/shm/pts 2>>/3rd_rw/sshd/mount.log \
|
||||
|| mount -t devpts devpts /dev/shm/pts 2>>/3rd_rw/sshd/mount.log
|
||||
fi
|
||||
if ! grep -q ' /dev/pts ' /proc/mounts; then
|
||||
mount --bind /dev/shm/pts /dev/pts 2>>/3rd_rw/sshd/mount.log
|
||||
fi
|
||||
|
||||
# 3) already running?
|
||||
if [ -f /3rd_rw/sshd/dropbear.pid ]; then
|
||||
PID=$(cat /3rd_rw/sshd/dropbear.pid)
|
||||
if kill -0 "$PID" 2>/dev/null && grep -q dropbear "/proc/$PID/cmdline" 2>/dev/null; then
|
||||
exit 0
|
||||
fi
|
||||
rm -f /3rd_rw/sshd/dropbear.pid
|
||||
fi
|
||||
|
||||
# 4) start key-only Dropbear (password auth is disabled at build time)
|
||||
/3rd_rw/sshd/dropbear -r /3rd_rw/sshd/host_key -p 22 \
|
||||
-P /3rd_rw/sshd/dropbear.pid -E >> /3rd_rw/sshd/dropbear.log 2>&1 &
|
||||
Executable
+34
@@ -0,0 +1,34 @@
|
||||
#!/bin/sh
|
||||
# swap_sftp.sh — runs detached from enable_sftp.sh.
|
||||
# Stops the old Dropbear, swaps in the SFTP-capable binary, restarts, and
|
||||
# falls back to dropbear.nosftp if port 22 does not come up.
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== swap_sftp $(date) ==="
|
||||
sleep 1
|
||||
|
||||
if [ -f "$D/dropbear.pid" ]; then
|
||||
kill "$(cat "$D/dropbear.pid")" 2>/dev/null || true
|
||||
fi
|
||||
sleep 1
|
||||
|
||||
mv -f "$D/dropbear.new" "$D/dropbear"
|
||||
chmod 755 "$D/dropbear"
|
||||
/bin/sh "$D/start_sshd.sh"
|
||||
sleep 3
|
||||
|
||||
if cat /proc/net/tcp | grep -qi ':0016'; then
|
||||
echo "port 22 listening with SFTP-capable dropbear"
|
||||
else
|
||||
echo "port 22 NOT listening; restoring dropbear.nosftp"
|
||||
cp -f "$D/dropbear.nosftp" "$D/dropbear"
|
||||
chmod 755 "$D/dropbear"
|
||||
/bin/sh "$D/start_sshd.sh"
|
||||
sleep 2
|
||||
cat /proc/net/tcp | grep -i ':0016' || true
|
||||
fi
|
||||
|
||||
echo "=== swap_sftp done ==="
|
||||
ps | grep dropbear | grep -v grep || true
|
||||
Executable
+47
@@ -0,0 +1,47 @@
|
||||
#!/bin/sh
|
||||
# verify.sh — quick health check for the rooted TV (run as root).
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== proof ==="
|
||||
cat /3rd_rw/root_proof.txt 2>&1
|
||||
|
||||
echo "=== root loop ==="
|
||||
cat /3rd_rw/appdata/root_loop.pid 2>&1
|
||||
ps | grep root_loop | grep -v grep || true
|
||||
|
||||
echo "=== dropbear ==="
|
||||
ps | grep dropbear | grep -v grep || true
|
||||
cat /proc/net/tcp | grep -i ':0016' || true
|
||||
/bin/busybox tail -n 10 "$D/dropbear.log" 2>&1 || true
|
||||
|
||||
echo "=== sftp (optional) ==="
|
||||
if [ -f /3rd_rw/sshd/sftp-server ]; then
|
||||
echo "sftp-server present"
|
||||
else
|
||||
echo "sftp-server missing (optional)"
|
||||
fi
|
||||
if grep -q '/3rd_rw/sshd/sftp-server' /3rd_rw/sshd/dropbear 2>/dev/null; then
|
||||
echo "dropbear SFTP path OK"
|
||||
else
|
||||
echo "dropbear unpatched (optional; install_sftp.sh)"
|
||||
fi
|
||||
|
||||
echo "=== passwd / root home ==="
|
||||
grep '^root:' /etc/passwd
|
||||
|
||||
echo "=== authorized key ==="
|
||||
ls -l "$D/home/.ssh/authorized_keys" 2>&1
|
||||
/bin/busybox head -c 120 "$D/home/.ssh/authorized_keys" 2>&1; echo
|
||||
|
||||
echo "=== mounts ==="
|
||||
grep -E ' /etc/passwd | /dev/pts | /dev/shm/pts ' /proc/mounts
|
||||
|
||||
echo "=== current uid/gid (this shell) ==="
|
||||
grep -E '^(Uid|Gid|CapEff):' /proc/self/status
|
||||
|
||||
echo "=== host key ==="
|
||||
"$D/dropbearkey" -y -f "$D/host_key" 2>&1 | /bin/busybox tail -n 3 || true
|
||||
|
||||
echo "=== verify done ==="
|
||||
Reference in new issue
Block a user