{"id":391017,"date":"2024-12-13T07:15:09","date_gmt":"2024-12-13T07:15:09","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=391017"},"modified":"2024-12-13T07:15:09","modified_gmt":"2024-12-13T07:15:09","slug":"desactivation-de-la-connexion-automatique-sous-linux","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/desactivation-de-la-connexion-automatique-sous-linux\/","title":{"rendered":"Configuration des banni\u00e8res de connexion et d\u00e9sactivation de la connexion automatique sous Linux gr\u00e2ce \u00e0 un script personnalis\u00e9\u00a0"},"content":{"rendered":"

Dans les environnements informatiques, maintenir la s\u00e9curit\u00e9 tout en assurant une exp\u00e9rience utilisateur transparente est un d\u00e9fi permanent. Les banni\u00e8res de connexion et les param\u00e8tres de connexion contr\u00f4l\u00e9s jouent un r\u00f4le essentiel dans le renforcement des politiques de s\u00e9curit\u00e9, l’information des utilisateurs sur les conditions d’utilisation et le respect des exigences de conformit\u00e9.<\/p>\n

Cet article pr\u00e9sente un script Bash qui automatise ces configurations, offrant ainsi aux professionnels de l’informatique et aux fournisseurs de services g\u00e9r\u00e9s (MSP)<\/a> un outil puissant pour rationaliser la gestion de la s\u00e9curit\u00e9.<\/p>\n

Comprendre l’objectif et l’importance du script<\/h2>\n

Ce script est con\u00e7u pour automatiser le processus de configuration des banni\u00e8res de connexion dans les environnements Linux<\/a>, la modification du fichier \/etc\/issue, et la mise \u00e0 jour des configurations pour SSH et les interfaces graphiques comme Gnome. Il permet \u00e9galement la d\u00e9sactivation de la connexion automatique, ce qui renforce la s\u00e9curit\u00e9 en obligeant les utilisateurs \u00e0 s’authentifier manuellement.<\/p>\n

Pour les professionnels de l’informatique et les entreprises MSP, ces configurations sont souvent n\u00e9cessaires pour la conformit\u00e9 r\u00e9glementaire (par exemple, la HIPAA<\/a> ou la RGPD<\/a>) ou les protocoles de s\u00e9curit\u00e9 internes. La capacit\u00e9 du script \u00e0 automatiser et \u00e0 rationaliser ces t\u00e2ches en fait un compl\u00e9ment pr\u00e9cieux \u00e0 la bo\u00eete \u00e0 outils de tout administrateur.<\/p>\n

Le script\u00a0:<\/h2>\n
#!\/usr\/bin\/env bash\r\n#\r\n# Description: Updates the \/etc\/issue file and adds it to the SSH banner. If Gnome is installed, ensure a banner is displayed above login and disable automatic login.\r\n# By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n# Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n# Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n# Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n# Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n# Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n# Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n# EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#\r\n# Preset Parameter: --bannerText \"ReplaceMeWithYourMessage\"\r\n#   The message you would like to display inside the logon banner.\r\n#\r\n# Preset Parameter: --clear\r\n#   Clears \/etc\/issue, Gnome banner text, and reverts sshd config.\r\n#\r\n# Preset Parameter: --forceRestart\r\n#   Schedules a restart 60 seconds from now so that the login banner may take immediate effect.'\r\n#\r\n# Release Notes: Initial Release\r\n\r\n# Initialize variables\r\n_arg_bannertext=\r\n_arg_clear=\"off\"\r\n_arg_forceRestart=\"off\"\r\n\r\n# Function to display help message\r\nprint_help() {\r\n  printf '\\n\\n%s\\n\\n' 'Usage: --bannerText <arg> [--clear|-c] [--forceRestart|-r] [--help|-h]'\r\n  printf '%s\\n' 'Preset Parameter: --bannerText \"ReplaceMeWithYourMessage\"'\r\n  printf '\\t%s\\n' 'The message you would like to display inside the logon banner.'\r\n  printf '%s\\n' 'Preset Parameter: --clear'\r\n  printf '\\t%s\\n' 'Clears \/etc\/issue, Gnome banner text, and reverts sshd config.' \r\n  printf '%s\\n' 'Preset Parameter: --forceRestart'\r\n  printf '\\t%s\\n' 'Schedules a restart 60 seconds from now so that the login banner may take immediate effect.'\r\n  printf '%s\\n' 'Preset Parameter: --help'\r\n  printf '\\t%s\\n' \"Displays this help menu.\"\r\n}\r\n\r\n# Function to display error message and exit\r\ndie() {\r\n  local _ret=\"${2:-1}\"\r\n  echo \"$1\" >&2\r\n  test \"${_PRINT_HELP:-no}\" = yes && print_help >&2\r\n  exit \"${_ret}\"\r\n}\r\n\r\n# Function to parse command line arguments\r\nparse_commandline() {\r\n  while test $# -gt 0; do\r\n    _key=\"$1\"\r\n    case \"$_key\" in\r\n    --bannerText | --bannertext | -b)\r\n      test $# -lt 2 && die \"Missing value for argument '$_key'.\" 1\r\n      _arg_bannertext=$2\r\n      shift\r\n      ;;\r\n    --bannerText=*)\r\n      _arg_bannertext=\"${_key##--bannerText=}\"\r\n      ;;\r\n    --clear | -c)\r\n      _arg_clear=\"on\"\r\n      ;;\r\n    --forceRestart | --forcerestart | -r)\r\n      _arg_forceRestart=\"on\"\r\n      ;;\r\n    --help | -h)\r\n      _PRINT_HELP=yes die 0\r\n      ;;\r\n    *)\r\n      _PRINT_HELP=yes die \"FATAL ERROR: Got an unexpected argument '$1'\" 1\r\n      ;;\r\n    esac\r\n    shift\r\n  done\r\n}\r\n\r\n# Parse command line arguments\r\nparse_commandline \"$@\"\r\n\r\n# Check if script variables are set and replace command line arguments with the script variables.\r\nif [[ -n $bannerText ]]; then\r\n  _arg_bannertext=\"$bannerText\"\r\nfi\r\nif [[ -n $forceRestart && $forceRestart == \"true\" ]]; then\r\n  _arg_forceRestart=\"on\"\r\nfi\r\nif [[ -n $clearAndRemoveConfigChanges && $clearAndRemoveConfigChanges == \"true\" ]]; then\r\n  _arg_clear=\"on\"\r\nfi\r\n\r\n# Trim leading and trailing whitespace from _arg_bannertext\r\nif [[ -n $_arg_bannertext ]]; then\r\n  _arg_bannertext=$(echo \"$_arg_bannertext\" | sed 's\/^[ \\t]*\/\/' | sed 's\/\\ *$\/\/g')\r\nfi\r\n\r\n# Check if banner text is required and not provided\r\nif [[ -z $_arg_bannertext && $_arg_clear != \"on\" ]]; then\r\n  echo \"[Error] banner text is required!\" >&2\r\n  exit 1\r\nfi\r\n\r\n# Check if both setting and clearing banner text are requested\r\nif [[ -n $_arg_bannertext && $_arg_clear == \"on\" ]]; then\r\n  echo \"[Error] Cannot set and clear banner text at the same time. Please do not fill in the banner text box when the clear and remove checkbox is checked.\" >&2\r\n  exit 1\r\nfi\r\n\r\n# Display the current \/etc\/issue content\r\necho \"### Modifying \/etc\/issue From ###\"\r\ncat '\/etc\/issue'\r\necho \"\"\r\n\r\n# Display the new banner text\r\necho \"### To ###\"\r\necho \"$_arg_bannertext\"\r\necho \"\"\r\n\r\n# Update \/etc\/issue with the new banner text\r\necho \"$_arg_bannertext\" >\/etc\/issue\r\n\r\n# Extract the Banner configuration from the sshd_config file, ignoring commented lines\r\nbannerFile=$(grep \"Banner\" \/etc\/ssh\/sshd_config | grep -v \"#\" | xargs | cut -f2 -d' ')\r\n\r\n# Check conditions to back up the sshd_config file\r\nif [[ -f \/etc\/ssh\/sshd_config && (((-z $bannerFile || $bannerFile != \"\/etc\/issue\" ) && $_arg_clear == \"off\") || (-n $bannerFile && $_arg_clear == \"on\")) ]]; then\r\n  # Get the current timestamp\r\n  timestamp=$(date +%s)\r\n  # Create a backup file name\r\n  backupFile=\"sshd_config.$timestamp.back\"\r\n\r\n  echo \"Backing up sshd config to \/etc\/ssh\/$backupFile\"\r\n\r\n  # Attempt to copy sshd_config to the backup file\r\n  if ! cp \"\/etc\/ssh\/sshd_config\" \"\/etc\/ssh\/$backupFile\"; then\r\n    echo \"[Error] Unable to backup sshd config!\" >&2\r\n    EXITCODE=1\r\n    # Set the flag to indicate backup failure\r\n    failedBackup=\"true\"\r\n  fi\r\nfi\r\n\r\n# Create or update the Banner configuration based on conditions\r\nif [[ -f \/etc\/ssh\/sshd_config && -z $failedBackup && $_arg_clear == \"off\" && -z $bannerFile ]]; then\r\n  # If Banner is not set and clear is off, add the Banner configuration\r\n  if echo \"    Banner \/etc\/issue\" >>\"\/etc\/ssh\/sshd_config\"; then\r\n    echo \"Successfully created sshd login banner.\"\r\n  else\r\n    echo \"[Error] Unable to create sshd login banner!\" >&2\r\n    EXITCODE=1\r\n  fi\r\nelif [[ -f \/etc\/ssh\/sshd_config && -z $failedBackup && $_arg_clear == \"off\" && $bannerFile != \"\/etc\/issue\" ]]; then\r\n  # If Banner is set to a different value and clear is off, update the Banner configuration\r\n  if sed -i 's\/Banner.*\/Banner \\\/etc\\\/issue\/' \/etc\/ssh\/sshd_config &>\/dev\/null; then\r\n    echo \"Successfully updated sshd login banner.\"\r\n  else\r\n    echo \"[Error] Failed to update sshd login banner!\" >&2\r\n    EXITCODE=1\r\n  fi\r\nelif [[ -f \/etc\/ssh\/sshd_config && -z $failedBackup && $_arg_clear == \"on\" && -n $bannerFile ]]; then\r\n   # If Banner is set and clear is on, comment out the Banner configuration\r\n  if sed -i 's\/Banner\/#Banner\/' \/etc\/ssh\/sshd_config &>\/dev\/null; then\r\n    echo \"Successfully removed sshd login banner.\"\r\n  else\r\n    echo \"[Error] Failed to remove sshd login banner!\" >&2\r\n    EXITCODE=1\r\n  fi\r\nfi\r\n\r\n# Check for Gnome and KDE session files to determine if they are installed\r\nfor f in \/usr\/bin\/*session; do\r\n  if echo \"$f\" | grep \"gnome\" &>\/dev\/null; then\r\n    gnomeInstalled=\"true\"\r\n  fi\r\n\r\n  if echo \"$f\" | grep \"plasma\" &>\/dev\/null; then\r\n    kdeInstalled=\"true\"\r\n  fi\r\ndone\r\n\r\n# Add login banner for Gnome if Gnome is installed and clear is off\r\nif [[ -n $gnomeInstalled && $_arg_clear == \"off\" ]]; then\r\n  echo \"\"\r\n  echo \"Gnome installation detected.\"\r\n\r\n  automaticLogins=$(grep \"AutomaticLoginEnable\" \/etc\/gdm3\/custom.conf | grep -v \"#\" | grep -i \"true\")\r\n  if [[ -n $automaticLogins ]]; then\r\n    echo \"\"\r\n    echo \"Automatic logins detected. Disabling automatic login.\"\r\n    \r\n    # Get the current timestamp\r\n    timestamp=$(date +%s)\r\n    # Create a backup file name\r\n    backupFile=\"custom.conf.$timestamp.back\"\r\n\r\n    echo \"Backing up gdm3 custom.conf config to \/etc\/gdm3\/$backupFile\"\r\n\r\n    sed -i \"s\/AutomaticLoginEnable.*\/AutomaticLoginEnable=False\/g\" \/etc\/gdm3\/custom.conf &>\/dev\/null\r\n    echo \"\"\r\n  fi\r\n\r\n  echo \"Adding login banner for gui logins.\"\r\n\r\n  # Create the dconf profile for gdm if it doesn't exist\r\n  if [[ ! -f '\/etc\/dconf\/profile\/gdm' ]]; then\r\n    {\r\n      echo \"user-db:user\"\r\n      echo \"system-db:gdm\"\r\n      echo \"file-db:\/usr\/share\/gdm\/greeter-dconf-defaults\"\r\n    } >>'\/etc\/dconf\/profile\/gdm'\r\n  fi\r\n\r\n  # Create the dconf database directory for gdm if it doesn't exist\r\n  if [[ ! -d '\/etc\/dconf\/db\/gdm.d' ]]; then\r\n    mkdir \/etc\/dconf\/db\/gdm.d\r\n  fi\r\n\r\n  # Escape single quotes in _arg_bannertext for use in the GUI banner text\r\n  guiBannerText=${_arg_bannertext\/\/\\'\/\\\\\\'}\r\n\r\n  # Check if the Gnome banner configuration file does not exist\r\n  if [[ ! -f '\/etc\/dconf\/db\/gdm.d\/01-banner-message' ]]; then\r\n    # Create the banner configuration file with the specified settings\r\n    {\r\n      echo \"[org\/gnome\/login-screen]\"\r\n      echo \"banner-message-enable=true\"\r\n      echo \"banner-message-text='$guiBannerText'\"\r\n    } >>'\/etc\/dconf\/db\/gdm.d\/01-banner-message'\r\n  else\r\n    # Escape single quotes again for updating existing configuration\r\n    guiBannerText=${_arg_bannertext\/\/\\'\/\\\\\\\\\\'}\r\n    # Enable the banner message and update the text in the existing configuration file\r\n    sed -i \"s\/banner-message-enable=false\/banner-message-enable=true\/\" '\/etc\/dconf\/db\/gdm.d\/01-banner-message' &>\/dev\/null\r\n    sed -i \"s\/banner-message-text=.*\/banner-message-text='$guiBannerText'\/\" '\/etc\/dconf\/db\/gdm.d\/01-banner-message' &>\/dev\/null\r\n  fi\r\n\r\n  # Apply the changes to the dconf database\r\n  if dconf update; then\r\n    echo \"Successfully added graphical login banner.\"\r\n  else\r\n    echo \"Failed to add graphical login banner\" >&2\r\n    exit 1\r\n  fi\r\n# Check if Gnome is installed and clear argument is set to \"on\"\r\nelif [[ -n $gnomeInstalled && $_arg_clear == \"on\" ]]; then\r\n  echo \"\"\r\n  echo \"Gnome installation detected. Removing login banner for gui logins (if present).\"\r\n\r\n  # If the Gnome banner configuration file exists, disable the banner message\r\n  if [[ -f '\/etc\/dconf\/db\/gdm.d\/01-banner-message' ]]; then\r\n    sed -i \"s\/banner-message-enable=true\/banner-message-enable=false\/\" '\/etc\/dconf\/db\/gdm.d\/01-banner-message' &>\/dev\/null\r\n  fi\r\n\r\n  # Apply the changes to the dconf database\r\n  if dconf update; then\r\n    echo \"Successfully removed graphical login banner.\"\r\n  else\r\n    echo \"Failed to remove graphical login banner\" >&2\r\n    exit 1\r\n  fi\r\nfi\r\n\r\n# Check if KDE is installed\r\nif [[ -n $kdeInstalled ]]; then\r\n  echo \"WARNING: KDE install detected. Unable to set login banner for KDE gui.\"\r\nfi\r\n\r\n# Checks if an error code is set and exits the script with that code.\r\nif [[ -n $EXITCODE ]]; then\r\n  exit \"$EXITCODE\"\r\nfi\r\n\r\n# If forceRestart argument is set to \"on\", schedule a system restart in 1 minute\r\nif [[ $_arg_forceRestart == \"on\" ]]; then\r\n  echo \"\"\r\n  shutdown -r \"+1\"\r\nfi<\/pre>\n
 <\/p>\n\n
Gagnez du temps gr\u00e2ce \u00e0 plus de 300 scripts du Dojo NinjaOne.<\/p>\n
\u2192 Obtenir l’acc\u00e8s<\/a><\/p>\n<\/div>\n
D\u00e9composons les \u00e9l\u00e9ments du script\u00a0:<\/h2>\n
Principales caract\u00e9ristiques et fonctionnalit\u00e9s<\/h3>\n
1. Arguments de la ligne de commande<\/h4>\n
Le script accepte plusieurs arguments\u00a0:<\/p>\n
a. –bannerText\u00a0: Sp\u00e9cifie le texte \u00e0 afficher dans la banni\u00e8re de connexion.<\/p>\n
b. –clear\u00a0: R\u00e9initialise toutes les configurations, y compris l’effacement de \/etc\/issue et l’annulation des param\u00e8tres SSH et Gnome.<\/p>\n
c. –forceRestart\u00a0: Planifie un red\u00e9marrage du syst\u00e8me pour appliquer imm\u00e9diatement les modifications.<\/p>\n
2. Analyse des arguments<\/h4>\n
Une fonction robuste analyse les arguments fournis par l’utilisateur, les valide et attribue des valeurs par d\u00e9faut ou sp\u00e9cifi\u00e9es aux variables. Par exemple, si l’option –clear est utilis\u00e9e, aucun texte de banni\u00e8re ne sera d\u00e9fini.<\/p>\n
3. Mise \u00e0 jour de \/etc\/issue<\/h4>\n
Le script \u00e9crit le texte de la banni\u00e8re sp\u00e9cifi\u00e9e dans le fichier \/etc\/issue, qui affiche la banni\u00e8re lors des connexions locales.<\/p>\n
4. Modification de la configuration SSH<\/h4>\n
a. Si la banni\u00e8re SSH n’est pas d\u00e9finie dans \/etc\/issue, le script met \u00e0 jour le fichier sshd_config.<\/p>\n
b. Si l’effacement est demand\u00e9, le script d\u00e9sactive la banni\u00e8re SSH.<\/p>\n
5. Gestion des param\u00e8tres de connexion de Gnome<\/h4>\n
a. D\u00e9tecte si Gnome est install\u00e9 et ajoute une banni\u00e8re graphique pour les \u00e9crans de connexion.<\/p>\n
b. D\u00e9sactive la connexion automatique en modifiant le fichier custom.conf.<\/p>\n
6. Gestion des erreurs et sauvegarde<\/h4>\n
S’assure que les fichiers critiques tels que sshd_config et custom.conf sont sauvegard\u00e9s avant d’effectuer des modifications, ce qui permet de les restaurer facilement en cas d’erreur.<\/p>\n
7. Red\u00e9marrage programm\u00e9<\/h4>\n
Si l’option –forceRestart est activ\u00e9e, le syst\u00e8me est programm\u00e9 pour un red\u00e9marrage dans 60 secondes, ce qui garantit que toutes les modifications prennent effet imm\u00e9diatement.<\/p>\n
Cas d’utilisation potentiels<\/h2>\n
\u00c9tude de cas\u00a0: Respect des politiques de s\u00e9curit\u00e9<\/h3>\n
Imaginez un MSP qui g\u00e8re plusieurs serveurs Linux pour un prestataire de soins de sant\u00e9. La conformit\u00e9 r\u00e9glementaire exige l’affichage d’un avertissement l\u00e9gal avant la connexion et la d\u00e9sactivation de la connexion automatique pour une s\u00e9curit\u00e9 accrue. En d\u00e9ployant ce script\u00a0:<\/p>\n