initial code drop

.gitignore

@@ -0,0 +1,2 @@
+bin/
+coverage.*

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 Ricky Pike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,20 @@
+SRCS=*.go
+
+EXECUTABLE=bin/jacksquat
+
+LINUX=$(EXECUTABLE)-linux
+LINUX_AMD64=$(LINUX)-amd64
+
+all: linux-amd64
+
+linux-amd64: $(LINUX_AMD64)
+
+test:
+	go test -race -coverprofile=coverage.txt -covermode=atomic jacksquat*.go
+	go tool cover -html=coverage.txt -o coverage.html
+
+$(LINUX_AMD64): $(SRCS)
+	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o $@ $(SRCS)
+
+clean:
+	rm -rf bin coverage.txt coverage.html

README.md

@@ -0,0 +1,52 @@
+# Jack Squat
+
+[![Build Status](https://travis-ci.com/arcanericky/jacksquat.svg?branch=master)](https://travis-ci.com/arcanericky/jacksquat)
+[![codecov](https://codecov.io/gh/arcanericky/jacksquat/branch/master/graph/badge.svg)](https://codecov.io/gh/arcanericky/jacksquat)
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](http://makeapullrequest.com)
+
+For when you need a login shell that can't do Jack Squat.
+
+### Quick Start
+
+Copy `jacksquat` to a place where it can be used as a login shell. For Debian, `/usr/sbin/` is a good location.
+
+```
+$ cp jacksquat /usr/sbin/
+```
+
+Create the locked user, configured with the `jacksquat` shell.
+
+```
+$ useradd -m -s /usr/sbin/jacksquat jack
+$ passwd jack
+New password: 
+Retype new password: 
+passwd: password updated successfully
+```
+
+Validate the user "can't do jack squat".
+
+```
+$ ssh jack@localhost
+Password:
+```
+
+If a log entry and/or a notice is desired when `jacksquat` is executed, add an `/etc/jacksquat.conf` file in json format containing a Go template of your log line (`logtemplate`) and notice (`noticetemplate`). Both fields are optional as is the configuration file. Logging is done with the `jacksquat` tag with a priority of `syslog.LOG_NOTICE|syslog.LOG_AUTH`. The following is an example and shows all of the available fields.
+
+```
+echo '{"logtemplate":"login by {{.UserName}} (UID: {{.UserID}}) on {{.TTYName}}","noticetemplate":"Welcome {{.UserName}}. This is a captive account."}' > /etc/jacksquat.conf
+```
+
+You may want to use a [tool such as `jq`](https://stedolan.github.io/jq/) to validate the json is parsable.
+
+```
+cat /etc/jacksquat.conf | jq '.'
+{
+  "logtemplate": "login by {{.UserName}} (UID: {{.UserID}}) on {{.TTYName}}",
+  "noticetemplate": "Welcome {{.UserName}}. This is a captive account."
+}
+```
+
+### Inspiration
+
+I need a user login that could remain logged in yet "can't do jack squat". The logging, use of Go templates in a configuration file, and testing are most certainly overkill.

jacksquat.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"log/syslog"
+	"os"
+	"os/user"
+	"text/template"
+	"time"
+)
+
+const (
+	unknown = "UNKNOWN"
+)
+
+type configValues struct {
+	LogTemplate    string `json:"logtemplate"`
+	NoticeTemplate string `json:"noticetemplate"`
+}
+
+func thisUser() (string, string) {
+	userName := unknown
+	uID := unknown
+
+	if c, err := user.Current(); err == nil {
+		userName = c.Username
+		uID = c.Uid
+	}
+
+	return userName, uID
+}
+
+func thisTTYName() string {
+	tty := unknown
+
+	dest, _ := os.Readlink("/proc/self/fd/0")
+
+	if len(dest) > 0 {
+		tty = dest
+	}
+
+	return tty
+}
+
+func log(data string) {
+	if lw, err := syslog.New(syslog.LOG_NOTICE|syslog.LOG_AUTH, "jacksquat"); err == nil {
+		fmt.Fprintf(lw, data)
+		lw.Close()
+	}
+}
+
+func getConfigFromReader(configReader io.Reader) configValues {
+	var byteValue []byte
+	var err error
+	var config configValues
+
+	if byteValue, err = ioutil.ReadAll(configReader); err != nil {
+		log("config file could not be read")
+	} else if json.Unmarshal(byteValue, &config) != nil {
+		log("config file could not be parsed")
+	}
+
+	return config
+}
+
+func getConfig(configFile string) configValues {
+	var config configValues
+
+	if reader, err := os.Open(configFile); err == nil {
+		defer reader.Close()
+		config = getConfigFromReader(reader)
+	}
+
+	return config
+}
+
+func captureLoginWithConfig(config configValues, duration time.Duration, exitCheck func() bool) {
+	if len(config.LogTemplate) > 0 {
+		loginID, uID := thisUser()
+		loginInfo := struct {
+			UserName string
+			UserID   string
+			TTYName  string
+		}{loginID, uID, thisTTYName()}
+		if t, err := template.New("sysloginfo").Parse(config.LogTemplate); err == nil {
+			var buf bytes.Buffer
+			if t.Execute(&buf, loginInfo) == nil {
+				log(buf.String())
+			}
+		}
+
+		if t, err := template.New("noticeinfo").Parse(config.NoticeTemplate); err == nil {
+			var buf bytes.Buffer
+			if t.Execute(&buf, loginInfo) == nil {
+				fmt.Println(buf.String())
+			}
+		}
+	}
+
+	for exitCheck() {
+		time.Sleep(duration)
+	}
+}
+
+func captureLogin(configFile string, duration time.Duration, exitCheck func() bool) {
+	captureLoginWithConfig(getConfig(configFile), duration, exitCheck)
+}

jacksquat_test.go

@@ -0,0 +1,89 @@
+package main
+
+import (
+	"io"
+	"io/ioutil"
+	"os"
+	"testing"
+)
+
+type testReader struct {
+	data       string
+	done       bool
+	throwError bool
+}
+
+func (t *testReader) Read(p []byte) (n int, err error) {
+	if t.throwError {
+		return 0, io.ErrNoProgress
+	}
+
+	if t.done {
+		return 0, io.EOF
+	}
+
+	for i, b := range []byte(t.data) {
+		p[i] = b
+	}
+
+	t.done = true
+	return len(t.data), nil
+}
+
+func TestJackSquat(t *testing.T) {
+	// Retrieval of user name
+	userName, userID := thisUser()
+	if len(userName) == 0 {
+		t.Error("Getting user name failed")
+	}
+	if len(userID) == 0 {
+		t.Error("Getting user ID failed")
+	}
+
+	// Retrieval of TTY name
+	ttyName := thisTTYName()
+	if len(ttyName) == 0 {
+		t.Error("Getting TTY name failed")
+	}
+
+	const configFilename = "jacksquat.conf"
+
+	// Config file does not exist
+	os.Remove(configFilename)
+	getConfig(configFilename)
+
+	ioutil.WriteFile(configFilename,
+		[]byte(`{ "logtemplate": "login by {{.UserName}} (UID: {{.UserID}}) on {{.TTYName}}",
+"noticetemplate": "Welcome {{.UserName}}. This is a captive account." }`),
+		0644)
+
+	// Config file exists with valid data
+	loopCount := 0
+	captureLogin(configFilename, 0, func() bool {
+		ret := true
+
+		if loopCount > 0 {
+			ret = false
+		}
+		loopCount++
+
+		return ret
+	})
+
+	os.Remove(configFilename)
+	if loopCount == 0 {
+		t.Error("capture loop was not called")
+	}
+
+	// Data parse error
+	tr := &testReader{"data", false, false}
+	if len(getConfigFromReader(tr).LogTemplate) > 0 {
+		t.Error("config returned data on data parse error")
+	}
+
+	// Reader returns error
+	tr.throwError = true
+	if len(getConfigFromReader(tr).LogTemplate) > 0 {
+		t.Error("config returned data on read error")
+	}
+}

main.go

@@ -0,0 +1,12 @@
+package main
+
+import (
+	"os"
+	"time"
+)
+
+func main() {
+	if len(os.Args) == 1 {
+		captureLogin("/etc/jacksquat.conf", 24*time.Hour, func() bool { return true })
+	}
+}