/etc/molly-guard/run.d/30-query-hostname is in molly-guard 0.4.4-2.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 | #!/bin/sh
#
# 30-ask-hostname - request the user to type in the hostname of the local host
#
# Copyright © martin f. krafft <madduck@madduck.net>
# Released under the terms of the Artistic Licence 2.0
#
set -eu
ME=molly-guard
[ -f "$MOLLYGUARD_SETTINGS" ] && . "$MOLLYGUARD_SETTINGS"
PRETEND_SSH=0
for arg in "$@"; do
case "$arg" in
(*-pretend-ssh) PRETEND_SSH=1;;
esac
done
# require an interactive terminal connected to stdin
test -t 0 || exit 0
# we've been asked to always protect this host
case "${ALWAYS_QUERY_HOSTNAME:-0}" in
0|false|False|no|No|off|Off)
# only run if we are being called over SSH, that is if the current terminal
# was created by sshd.
PTS=$(readlink /proc/$$/fd/0)
if ! pgrep -f "^sshd.+${PTS#/dev/}\>" >/dev/null \
&& [ -z "${SSH_CONNECTION:-}" ]; then
if [ $PRETEND_SSH -eq 1 ]; then
echo "I: $ME: this is not an SSH session, but --pretend-ssh was given..." >&2
else
exit 0
fi
else
echo "W: $ME: SSH session detected!" >&2
fi
;;
*)
echo "I: $ME: $MOLLYGUARD_CMD is always molly-guarded on this system." >&2
;;
esac
HOSTNAME="$(hostname --short)"
sigh()
{
echo "Good thing I asked; I won't $MOLLYGUARD_CMD $HOSTNAME ..." >&2
exit 1
}
trap 'echo;sigh' 1 2 3 9 10 12 15
echo -n "Please type in hostname of the machine to $MOLLYGUARD_CMD: "
read HOSTNAME_USER || :
[ "$HOSTNAME_USER" = "$HOSTNAME" ] || sigh
trap - 1 2 3 9 10 12 15
exit 0
|