#!/bin/bash
set -eu
ROOT=${1:?Pass an empty evidence directory}
sudo useradd --home-dir "$ROOT/remote-home" --create-home --shell /bin/bash evidence31396
sudo passwd -d evidence31396
ssh-keygen -q -t ed25519 -N '' -f "$ROOT/client-key"
ssh-keygen -q -t ed25519 -N '' -f "$ROOT/host-key"
sudo install -d -m 700 -o evidence31396 -g evidence31396 "$ROOT/remote-home/.ssh"
sudo install -m 600 -o evidence31396 -g evidence31396 "$ROOT/client-key.pub" "$ROOT/remote-home/.ssh/authorized_keys"
cat > "$ROOT/sshd.conf" <<CONFIG
Port 22396
ListenAddress 127.0.0.1
HostKey $ROOT/host-key
PidFile $ROOT/sshd.pid
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
KbdInteractiveAuthentication no
UsePAM no
StrictModes no
AllowUsers evidence31396
Subsystem sftp internal-sftp
CONFIG
sudo iptables -I OUTPUT 1 -m owner --uid-owner evidence31396 -p tcp --dport 443 -j REJECT
# Give the fixture a synthetic hostname without changing the host's hostname.
sudo unshare --uts /bin/bash -c 'hostname mirror-target; exec /usr/sbin/sshd -D -f "$1/sshd.conf" -E "$1/sshd.log"' _ "$ROOT"