paivana-httpd.postinst (2204B)
1 #!/bin/sh 2 3 set -e 4 5 # paivana-httpd keeps no state of its own -- no database, no cache, no 6 # spool -- so it has no home to create. The account used to name 7 # /var/lib/paivana/ with --no-create-home, and postrm purged a third 8 # path again (/var/lib/paivana/httpd/); none of the three ever existed. 9 PAIVANA_HOME="/nonexistent" 10 SECRET_CONF="/etc/paivana/secrets/paivana.secret.conf" 11 12 case "${1}" in 13 configure) 14 if ! getent passwd paivana-httpd >/dev/null; 15 then 16 adduser --quiet --system --ingroup www-data --no-create-home \ 17 --home ${PAIVANA_HOME} paivana-httpd 18 fi 19 20 # The secrets file carries the merchant bearer token and the key for 21 # the access-cookie MAC. Either is enough to take the instance over: 22 # the token is authority over its orders and templates, and the key 23 # lets an attacker mint access cookies for any visitor. Neither 24 # belongs in a 0644 file that every local account -- a compromised 25 # www-data process included -- can read. Same treatment the merchant 26 # package gives its own secrets. 27 if ! dpkg-statoverride --list ${SECRET_CONF} >/dev/null 2>&1 28 then 29 dpkg-statoverride \ 30 --add \ 31 --update \ 32 paivana-httpd root 0460 \ 33 ${SECRET_CONF} 34 fi 35 36 # Generate the cookie key on first install. paivana-httpd refuses to 37 # start without one, and leaving the operator to invent it invites 38 # either a weak value or a per-start random key that logs everyone out 39 # on every restart. Only ever written when the placeholder is still 40 # in place, so an upgrade never disturbs a configured system -- and 41 # never regenerates, which would invalidate every outstanding cookie. 42 if [ -f ${SECRET_CONF} ] && grep -q '^# SECRET = CHANGE-ME' ${SECRET_CONF}; 43 then 44 SECRET="$(head -c 32 /dev/urandom | base64 | tr -d '\n')" 45 sed -i "s|^# SECRET = CHANGE-ME|SECRET = ${SECRET}|" ${SECRET_CONF} 46 SECRET="" 47 echo "paivana-httpd: generated a random SECRET in ${SECRET_CONF}." >&2 48 echo "paivana-httpd: copy it to every other host serving this site." >&2 49 fi 50 ;; 51 52 abort-upgrade | abort-remove | abort-deconfigure) ;; 53 54 *) 55 echo "postinst called with unknown argument \`${1}'" >&2 56 exit 1 57 ;; 58 esac 59 60 #DEBHELPER# 61 62 exit 0