|
| 1 | +#!/bin/bash |
| 2 | +if [[ ! -f /tmp/perform_cleanup ]]; then |
| 3 | +echo "Skipping cleanup" |
| 4 | +exit 0 |
| 5 | +else |
| 6 | +sudo rm -f /tmp/perform_cleanup |
| 7 | +fi |
| 8 | + |
| 9 | +function cleanup() { |
| 10 | +FILES=("$@") |
| 11 | +for FILE in " "; do |
| 12 | +if [[ -f "$FILE" ]]; then |
| 13 | +echo "Deleting $FILE"; |
| 14 | +sudo shred -zuf $FILE; |
| 15 | +fi; |
| 16 | +if [[ -f $FILE ]]; then |
| 17 | +echo "Failed to delete '$FILE'. Failing." |
| 18 | +exit 1 |
| 19 | +fi; |
| 20 | +done |
| 21 | +}; |
| 22 | + |
| 23 | + |
| 24 | +# Clean up for cloud-init files |
| 25 | +CLOUD_INIT_FILES=( |
| 26 | +"/etc/sudoers.d/90-cloud-init-users" |
| 27 | +"/etc/locale.conf" |
| 28 | +"/var/log/cloud-init.log" |
| 29 | +"/var/log/cloud-init-output.log" |
| 30 | +) |
| 31 | +if [[ -f /tmp/skip_cleanup_cloudinit_files ]]; then |
| 32 | +echo "Skipping cleanup of cloud init files" |
| 33 | +else |
| 34 | +echo "Cleaning up cloud init files" |
| 35 | +cleanup " " |
| 36 | +if [[ $( sudo find /var/lib/cloud -type f | sudo wc -l ) -gt 0 ]]; then |
| 37 | +echo "Deleting files within /var/lib/cloud/*" |
| 38 | +sudo find /var/lib/cloud -type f -exec shred -zuf {} \; |
| 39 | +fi; |
| 40 | + |
| 41 | +if [[ $( sudo ls /var/lib/cloud | sudo wc -l ) -gt 0 ]]; then |
| 42 | +echo "Deleting /var/lib/cloud/*" |
| 43 | +sudo rm -rf /var/lib/cloud/* || true |
| 44 | +fi; |
| 45 | +fi; |
| 46 | + |
| 47 | + |
| 48 | +# Clean up for temporary instance files |
| 49 | +INSTANCE_FILES=( |
| 50 | +"/etc/.updated" |
| 51 | +"/etc/aliases.db" |
| 52 | +"/etc/hostname" |
| 53 | +"/var/lib/misc/postfix.aliasesdb-stamp" |
| 54 | +"/var/lib/postfix/master.lock" |
| 55 | +"/var/spool/postfix/pid/master.pid" |
| 56 | +"/var/.updated" |
| 57 | +"/var/cache/yum/x86_64/2/.gpgkeyschecked.yum" |
| 58 | +) |
| 59 | +if [[ -f /tmp/skip_cleanup_instance_files ]]; then |
| 60 | +echo "Skipping cleanup of instance files" |
| 61 | +else |
| 62 | +echo "Cleaning up instance files" |
| 63 | +cleanup " " |
| 64 | +fi; |
| 65 | + |
| 66 | + |
| 67 | +# Clean up for ssh files |
| 68 | +SSH_FILES=( |
| 69 | +"/etc/ssh/ssh_host_rsa_key" |
| 70 | +"/etc/ssh/ssh_host_rsa_key.pub" |
| 71 | +"/etc/ssh/ssh_host_ecdsa_key" |
| 72 | +"/etc/ssh/ssh_host_ecdsa_key.pub" |
| 73 | +"/etc/ssh/ssh_host_ed25519_key" |
| 74 | +"/etc/ssh/ssh_host_ed25519_key.pub" |
| 75 | +"/root/.ssh/authorized_keys" |
| 76 | +) |
| 77 | +if [[ -f /tmp/skip_cleanup_ssh_files ]]; then |
| 78 | +echo "Skipping cleanup of ssh files" |
| 79 | +else |
| 80 | +echo "Cleaning up ssh files" |
| 81 | +cleanup " " |
| 82 | +USERS=$(ls /home/) |
| 83 | +for user in $USERS; do |
| 84 | +echo Deleting /home/"$user"/.ssh/authorized_keys; |
| 85 | +sudo find /home/"$user"/.ssh/authorized_keys -type f -exec shred -zuf {} \; |
| 86 | +done |
| 87 | +for user in $USERS; do |
| 88 | +if [[ -f /home/"$user"/.ssh/authorized_keys ]]; then |
| 89 | +echo Failed to delete /home/"$user"/.ssh/authorized_keys; |
| 90 | +exit 1 |
| 91 | +fi; |
| 92 | +done; |
| 93 | +fi; |
| 94 | + |
| 95 | + |
| 96 | +# Clean up for instance log files |
| 97 | +INSTANCE_LOG_FILES=( |
| 98 | +"/var/log/audit/audit.log" |
| 99 | +"/var/log/boot.log" |
| 100 | +"/var/log/dmesg" |
| 101 | +"/var/log/cron" |
| 102 | +) |
| 103 | +if [[ -f /tmp/skip_cleanup_instance_log_files ]]; then |
| 104 | +echo "Skipping cleanup of instance log files" |
| 105 | +else |
| 106 | +echo "Cleaning up instance log files" |
| 107 | +cleanup " " |
| 108 | +fi; |
| 109 | + |
| 110 | +# Clean up for TOE files |
| 111 | +if [[ -f /tmp/skip_cleanup_toe_files ]]; then |
| 112 | +echo "Skipping cleanup of TOE files" |
| 113 | +else |
| 114 | +echo "Cleaning TOE files" |
| 115 | +if [[ $( sudo find /tmp/TOE_* -type f | sudo wc -l) -gt 0 ]]; then |
| 116 | +echo "Deleting files within /tmp/TOE_*" |
| 117 | +sudo find /tmp/TOE_* -type f -exec shred -zuf {} \; |
| 118 | +fi |
| 119 | +if [[ $( sudo find /tmp/TOE_* -type f | sudo wc -l) -gt 0 ]]; then |
| 120 | +echo "Failed to delete /tmp/TOE_*" |
| 121 | +exit 1 |
| 122 | +fi |
| 123 | +if [[ $( sudo find /tmp/TOE_* -type d | sudo wc -l) -gt 0 ]]; then |
| 124 | +echo "Deleting /tmp/TOE_*" |
| 125 | +sudo rm -rf /tmp/TOE_* |
| 126 | +fi |
| 127 | +if [[ $( sudo find /tmp/TOE_* -type d | sudo wc -l) -gt 0 ]]; then |
| 128 | +echo "Failed to delete /tmp/TOE_*" |
| 129 | +exit 1 |
| 130 | +fi |
| 131 | +fi |
| 132 | + |
| 133 | +# Clean up for ssm log files |
| 134 | +if [[ -f /tmp/skip_cleanup_ssm_log_files ]]; then |
| 135 | +echo "Skipping cleanup of ssm log files" |
| 136 | +else |
| 137 | +echo "Cleaning up ssm log files" |
| 138 | +if [[ $( sudo find /var/log/amazon/ssm -type f | sudo wc -l) -gt 0 ]]; then |
| 139 | +echo "Deleting files within /var/log/amazon/ssm/*" |
| 140 | +sudo find /var/log/amazon/ssm -type f -exec shred -zuf {} \; |
| 141 | +fi |
| 142 | +if [[ $( sudo find /var/log/amazon/ssm -type f | sudo wc -l) -gt 0 ]]; then |
| 143 | +echo "Failed to delete /var/log/amazon/ssm" |
| 144 | +exit 1 |
| 145 | +fi |
| 146 | +if [[ -d "/var/log/amazon/ssm" ]]; then |
| 147 | +echo "Deleting /var/log/amazon/ssm/*" |
| 148 | +sudo rm -rf /var/log/amazon/ssm |
| 149 | +fi |
| 150 | +if [[ -d "/var/log/amazon/ssm" ]]; then |
| 151 | +echo "Failed to delete /var/log/amazon/ssm" |
| 152 | +exit 1 |
| 153 | +fi |
| 154 | +fi |
| 155 | + |
| 156 | + |
| 157 | +if [[ $( sudo find /var/log/sa/sa* -type f | sudo wc -l ) -gt 0 ]]; then |
| 158 | +echo "Deleting /var/log/sa/sa*" |
| 159 | +sudo shred -zuf /var/log/sa/sa* |
| 160 | +fi |
| 161 | +if [[ $( sudo find /var/log/sa/sa* -type f | sudo wc -l ) -gt 0 ]]; then |
| 162 | +echo "Failed to delete /var/log/sa/sa*" |
| 163 | +exit 1 |
| 164 | +fi |
| 165 | + |
| 166 | +if [[ $( sudo find /var/lib/dhclient/dhclient*.lease -type f | sudo wc -l ) -gt 0 ]]; then |
| 167 | +echo "Deleting /var/lib/dhclient/dhclient*.lease" |
| 168 | +sudo shred -zuf /var/lib/dhclient/dhclient*.lease |
| 169 | +fi |
| 170 | +if [[ $( sudo find /var/lib/dhclient/dhclient*.lease -type f | sudo wc -l ) -gt 0 ]]; then |
| 171 | +echo "Failed to delete /var/lib/dhclient/dhclient*.lease" |
| 172 | +exit 1 |
| 173 | +fi |
| 174 | + |
| 175 | +if [[ $( sudo find /var/tmp -type f | sudo wc -l) -gt 0 ]]; then |
| 176 | +echo "Deleting files within /var/tmp/*" |
| 177 | +sudo find /var/tmp -type f -exec shred -zuf {} \; |
| 178 | +fi |
| 179 | +if [[ $( sudo find /var/tmp -type f | sudo wc -l) -gt 0 ]]; then |
| 180 | +echo "Failed to delete /var/tmp" |
| 181 | +exit 1 |
| 182 | +fi |
| 183 | +if [[ $( sudo ls /var/tmp | sudo wc -l ) -gt 0 ]]; then |
| 184 | +echo "Deleting /var/tmp/*" |
| 185 | +sudo rm -rf /var/tmp/* |
| 186 | +fi |
| 187 | + |
| 188 | +# Shredding is not guaranteed to work well on rolling logs |
| 189 | + |
| 190 | +if [[ -f "/var/lib/rsyslog/imjournal.state" ]]; then |
| 191 | +echo "Deleting /var/lib/rsyslog/imjournal.state" |
| 192 | +sudo shred -zuf /var/lib/rsyslog/imjournal.state |
| 193 | +sudo rm -f /var/lib/rsyslog/imjournal.state |
| 194 | +fi |
| 195 | + |
| 196 | +if [[ $( sudo ls /var/log/journal/ | sudo wc -l ) -gt 0 ]]; then |
| 197 | +echo "Deleting /var/log/journal/*" |
| 198 | +sudo find /var/log/journal/ -type f -exec shred -zuf {} \; |
| 199 | +sudo rm -rf /var/log/journal/* |
| 200 | +fi |
| 201 | + |
| 202 | +sudo touch /etc/machine-id |
| 203 | + |
| 204 | +#!/bin/bash -e |
| 205 | + |
| 206 | +SERVICE_ROOT_WORKING_DIR="/tmp/imagebuilder_service" |
| 207 | +SSM_UNINSTALL_CONDITION="SSM_INSTALLED_BY_CUSTOMER" |
| 208 | + |
| 209 | +function error_exit { |
| 210 | +echo "$1" 1>&2 |
| 211 | +exit 1 |
| 212 | +} |
| 213 | + |
| 214 | +function package_exists() { |
| 215 | +$(which "$1" > /dev/null 2>&1 ) |
| 216 | +return $? |
| 217 | +} |
| 218 | + |
| 219 | + |
| 220 | +function cleanup_image() { |
| 221 | +rm -rf " " |
| 222 | +} |
| 223 | + |
| 224 | + |
| 225 | +function ssm_exists() { |
| 226 | +eval "$1" > /dev/null 2>&1 |
| 227 | +echo $? |
| 228 | +} |
| 229 | + |
| 230 | +function uninstall_ssm_agent() { |
| 231 | + |
| 232 | +uninstall_package="$1" |
| 233 | +uninstall_all="" |
| 234 | +uninstall_success="false" |
| 235 | + |
| 236 | +if [ " " == "" ]; then |
| 237 | +uninstall_all="true" |
| 238 | +fi |
| 239 | + |
| 240 | +yum="sudo yum search amazon-ssm-agent | grep amazon-ssm-agent" |
| 241 | +snap="sudo snap list amazon-ssm-agent" |
| 242 | +rpm="sudo rpm -qa amazon-ssm-agent | grep amazon-ssm-agent" |
| 243 | +dpkg="sudo dpkg --get-selections | grep amazon-ssm-agent" |
| 244 | +pkg="su -m root -c \"pkg info -l amazon-ssm-agent | grep amazon-ssm-agent\"" |
| 245 | + |
| 246 | + |
| 247 | +if [[ (" ") -eq 0 ]]; then |
| 248 | +echo "Package found in Snap.... Uninstalling" |
| 249 | +(sleep 30 ; sudo snap remove amazon-ssm-agent) &>/dev/null & |
| 250 | +uninstall_success="true" |
| 251 | +fi |
| 252 | + |
| 253 | +if [[ (" ") -eq 0 ]]; then |
| 254 | +echo "Package found in Yum.... Uninstalling" |
| 255 | +(sleep 30 ; sudo yum remove -y amazon-ssm-agent) &>/dev/null & |
| 256 | +uninstall_success="true" |
| 257 | +fi |
| 258 | + |
| 259 | +if [[ (" ") -eq 0 ]]; then |
| 260 | +echo "Package found in Rpm.... Uninstalling" |
| 261 | +(sleep 30 ; sudo rpm -e amazon-ssm-agent) &>/dev/null & |
| 262 | +uninstall_success="true" |
| 263 | +fi |
| 264 | + |
| 265 | +if [[ (" ") -eq 0 ]]; then |
| 266 | +echo "Package found in Dpkg.... Uninstalling" |
| 267 | +(sleep 30 ; sudo dpkg -r --force-all amazon-ssm-agent) &>/dev/null & |
| 268 | +uninstall_success="true" |
| 269 | +fi |
| 270 | + |
| 271 | +if [[ (" ") -eq 0 ]]; then |
| 272 | +echo "Package found in FreeBSD.... Uninstalling" |
| 273 | +(sleep 30 ; su -m root -c "pkg remove -y amazon-ssm-agent") &> /dev/null & |
| 274 | +uninstall_success="true" |
| 275 | +fi |
| 276 | + |
| 277 | +if [ " " == "false" ] ; then |
| 278 | +error_exit "Unable to uninstall an SSM agent" |
| 279 | +fi |
| 280 | +} |
| 281 | + |
| 282 | + |
| 283 | +function get_os_type() { |
| 284 | +FILE=/etc/os-release |
| 285 | +if [ -e $FILE ]; then |
| 286 | +. $FILE |
| 287 | +echo $ID |
| 288 | +else |
| 289 | +echo "" |
| 290 | +fi |
| 291 | +} |
| 292 | + |
| 293 | +if [ " " == "SSM_INSTALLED_BY_CUSTOMER" ] ; then |
| 294 | +echo "{\"message\":\"Uninstall after build set to true.... Uninstalling ssm agent.\", \"verifyUninstallSSMAgent\": \"YES\"}" |
| 295 | +uninstall_ssm_agent |
| 296 | + |
| 297 | +elif [ " " == "SSM_INSTALLED_BY_IMAGE_BUILDER" ] ; then |
| 298 | +echo "Uninstall after build set to null....Checking if SSM Agent was installed by image builder" |
| 299 | +if [[ -f /ssm_installed ]] ; then |
| 300 | +package_manager="$(cat /ssm_installed)" |
| 301 | +echo "{\"message\":\"Uninstalling SSM Agent installed by image builder using " |
| 302 | +uninstall_ssm_agent " " |
| 303 | +fi |
| 304 | +else |
| 305 | +echo "{\"message\":\"Uninstall after build set to false...Skip Uninstall ssm agent\", \"verifyUninstallSSMAgent\": \"NO\"}" |
| 306 | +fi |
| 307 | + |
| 308 | + |
| 309 | +cleanup_image |
0 commit comments