1# $OpenBSD: forcecommand.sh,v 1.7 2023/11/01 02:08:38 dtucker Exp $ 2# Placed in the Public Domain. 3 4tid="forced command" 5 6cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak 7 8authorized_keys() { 9 cmd=$1 10 cp /dev/null $OBJ/authorized_keys_$USER 11 for t in ${SSH_KEYTYPES}; do 12 test -z "$cmd" || \ 13 printf "command=\"$cmd\" " >>$OBJ/authorized_keys_$USER 14 cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER 15 done 16} 17 18trace "test config with sftp" 19authorized_keys 20rm -f $OBJ/ssh_proxy.tmp 21echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ 22 ${SFTP} -S ${SSH} -b - -qF $OBJ/ssh_proxy somehost 2>/dev/null || \ 23 fail "sftp failed" 24test -f "$OBJ/ssh_proxy.tmp" || fail "sftp did not download file" 25rm -f $OBJ/ssh_proxy.tmp 26 27trace "forced command in key option" 28authorized_keys true 29${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key option" 30 31authorized_keys false 32cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 33echo "ForceCommand true" >> $OBJ/sshd_proxy 34 35trace "forced command in sshd_config overrides key option" 36${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command config" 37 38authorized_keys 39cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 40echo "ForceCommand false" >> $OBJ/sshd_proxy 41 42trace "force command overriding subsystem" 43echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ 44 ${SFTP} -S ${SSH} -F $OBJ/ssh_proxy -oLoglevel=quiet somehost && \ 45 fail "sftp succeeded" 46 47echo "Match User $USER" >> $OBJ/sshd_proxy 48echo " ForceCommand true" >> $OBJ/sshd_proxy 49 50trace "forced command with match" 51${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command match" 52 53trace "force command in match overriding subsystem" 54echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ 55 ${SFTP} -S ${SSH} -F $OBJ/ssh_proxy -oLoglevel=quiet somehost && \ 56 fail "sftp succeeded" 57 58trace "force command to sftpserver" 59grep -vi subsystem $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy 60echo "Subsystem sftp /bin/false" >> $OBJ/sshd_proxy 61echo "ForceCommand ${SFTPSERVER}" >> $OBJ/sshd_proxy 62rm -f $OBJ/ssh_proxy.tmp 63echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ 64 ${SFTP} -S ${SSH} -b - -qF $OBJ/ssh_proxy somehost 2>/dev/null || \ 65 fail "sftp failed" 66test -f "$OBJ/ssh_proxy.tmp" || fail "sftp did not download file" 67rm -f $OBJ/ssh_proxy.tmp 68