]> UNRAID_VER=$(sed -n "s/^version=\"\(.*\)\"/\1/p" /etc/unraid-version 2>/dev/null) MIN_VER="7.3.1" if [ -z "$UNRAID_VER" ]; then echo "Cannot read /etc/unraid-version. Installation aborted." exit 1 fi LOWEST=$(printf "%s\n%s\n" "$UNRAID_VER" "$MIN_VER" | sort -V | head -1) TOO_OLD=0 if [ "$UNRAID_VER" != "$MIN_VER" ]; then if [ "$LOWEST" != "$MIN_VER" ]; then TOO_OLD=1 fi fi if [ "$TOO_OLD" = "1" ]; then echo "" echo "----------------------------------------------------" echo " Aegis MFA requires Unraid ${MIN_VER} or newer." echo " This server runs ${UNRAID_VER}." echo "" echo " Older releases ship different PHP and nginx internals," echo " and this plugin patches the login path. Installing on" echo " an unverified base is not safe, so it is refused." echo "" echo " Installation aborted. Nothing was changed." echo "----------------------------------------------------" echo "" exit 1 fi &pluginURL; &md5; # Fix ownership and permissions chown -R root:root /usr/local/emhttp/plugins/&name; find /usr/local/emhttp/plugins/&name; -type d -exec chmod 755 {} \; find /usr/local/emhttp/plugins/&name; -type f -exec chmod 644 {} \; find /usr/local/emhttp/plugins/&name; -name "*.sh" -exec chmod 755 {} \; # no-extension files chmodded by name, emhttpd only runs an executable hook chmod 755 /usr/local/emhttp/plugins/&name;/event/started chmod 755 /usr/local/emhttp/plugins/&name;/scripts/aegis-mfa chmod 755 /usr/local/emhttp/plugins/&name;/scripts/aegis-mfa-cron # the CLI on PATH is how a locked-out admin gets back in: ssh, then aegis-mfa disable ln -sf /usr/local/emhttp/plugins/&name;/scripts/aegis-mfa /usr/local/sbin/aegis-mfa # second re-apply mechanism next to the boot hook. no dot in the filename, cron.d skips dotted files on some builds install -m 0644 /usr/local/emhttp/plugins/&name;/&name;.cron /etc/cron.d/aegis-mfa /etc/rc.d/rc.crond restart >/dev/null 2>/dev/null # first install only, an upgrade leaves the existing config exactly as it is. no merge step, # the PHP layer deep-merges defaults at read time. copied from the package, a heredoc is not valid XML here mkdir -p /boot/config/plugins/&name; if [ ! -f /boot/config/plugins/&name;/config.json ]; then cp /usr/local/emhttp/plugins/&name;/config.default.json /boot/config/plugins/&name;/config.json fi # secrets.json is never written here, an upgrade must not touch a single byte of it # the pure-bash recovery script goes on the flash: reachable with the plugin folder gone, # working with PHP broken. overwritten every install to stay current cp -f /usr/local/emhttp/plugins/&name;/scripts/aegis-mfa-recover.sh \ /boot/config/plugins/&name;/recover.sh 2>/dev/null chmod 0755 /boot/config/plugins/&name;/recover.sh 2>/dev/null # reset opcache so the login path runs the upgraded files, not stale bytecode php -r "if (function_exists(\"opcache_reset\")) opcache_reset();" >/dev/null 2>/dev/null # fold the shipped baseline into the flash compat.json, the flash copy wins. runs before # the reconcile so the tested notice is right from the first look php -r "require \"/usr/local/emhttp/plugins/&name;/include/AegisMfaInstall.php\"; aegis_mfa_merge_compat();" >/dev/null 2>/dev/null # bring the patches in line with the saved setting: no-op on first install, on an upgrade with MFA # on it re-points the hooks at this build. anything off removes the patches, never half-wired php -r "require \"/usr/local/emhttp/plugins/&name;/include/AegisMfaInstall.php\"; \$r = aegis_mfa_reconcile_patches(); echo \"patch state: \" . (\$r[\"state\"] ?? \"unknown\") . PHP_EOL;" 2>/dev/null echo "" echo "----------------------------------------------------" echo " &name; (&branch; build) installed successfully." echo " Version : &version;" echo " Settings: Settings > Aegis MFA" echo "" echo " MFA is OFF until you enable it. Enabling starts a" echo " 24h dry-run so you can confirm it works before it" echo " is enforced." echo "" echo " Locked out? From SSH or the console: aegis-mfa disable" echo "----------------------------------------------------" echo "" # 1. Un-patch the two Unraid login files FIRST, while our code still exists. if [[ -f /usr/local/emhttp/plugins/&name;/include/AegisMfaInstall.php ]]; then php -r "require \"/usr/local/emhttp/plugins/&name;/include/AegisMfaInstall.php\"; \$r = aegis_mfa_uninstall(); echo \"login files restored: \" . (\$r[\"state\"] ?? \"unknown\") . PHP_EOL;" 2>/dev/null fi # 2. drop the CLI symlink and the cron entry rm -f /usr/local/sbin/aegis-mfa rm -f /etc/cron.d/aegis-mfa /etc/rc.d/rc.crond restart >/dev/null 2>/dev/null # 3. drop the in-RAM lockout counters rm -rf /var/local/&name; # 4. now the package and the plugin folder can go removepkg &name;-&version; rm -rf /usr/local/emhttp/plugins/&name; # 5. flash config last, it takes the secrets with it, a reinstall starts clean rm -rf /boot/config/plugins/&name; # clear opcache so the restored login files are the ones that run php -r "if (function_exists(\"opcache_reset\")) opcache_reset();" >/dev/null 2>/dev/null echo "" echo "----------------------------------------------------" echo " &name; has been removed." echo " The Unraid login files were restored to stock and" echo " password-only login is active again." echo "----------------------------------------------------" echo ""