1# $OpenBSD: hostkey-agent.sh,v 1.11 2019/12/16 02:39:05 djm Exp $ 2# Placed in the Public Domain. 3 4tid="hostkey agent" 5 6rm -f $OBJ/agent-key.* $OBJ/ssh_proxy.orig $OBJ/known_hosts.orig 7 8trace "start agent" 9eval `${SSHAGENT} ${EXTRA_AGENT_ARGS} -s` > /dev/null 10r=$? 11[ $r -ne 0 ] && fatal "could not start ssh-agent: exit code $r" 12 13grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig 14echo "HostKeyAgent $SSH_AUTH_SOCK" >> $OBJ/sshd_proxy.orig 15 16trace "load hostkeys" 17for k in $SSH_KEYTYPES ; do 18 ${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k" 19 ( 20 printf 'localhost-with-alias,127.0.0.1,::1 ' 21 cat $OBJ/agent-key.$k.pub 22 ) >> $OBJ/known_hosts.orig 23 ${SSHADD} $OBJ/agent-key.$k >/dev/null 2>&1 || \ 24 fatal "couldn't load key $OBJ/agent-key.$k" 25 echo "Hostkey $OBJ/agent-key.${k}" >> $OBJ/sshd_proxy.orig 26 # Remove private key so the server can't use it. 27 rm $OBJ/agent-key.$k || fatal "couldn't rm $OBJ/agent-key.$k" 28done 29cp $OBJ/known_hosts.orig $OBJ/known_hosts 30 31unset SSH_AUTH_SOCK 32 33for ps in yes; do 34 for k in $SSH_KEYTYPES ; do 35 verbose "key type $k privsep=$ps" 36 cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy 37 echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy 38 echo "HostKeyAlgorithms $k" >> $OBJ/sshd_proxy 39 opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy" 40 cp $OBJ/known_hosts.orig $OBJ/known_hosts 41 SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'` 42 if [ $? -ne 0 ]; then 43 fail "privsep=$ps failed" 44 fi 45 if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then 46 fail "bad SSH_CONNECTION key type $k privsep=$ps" 47 fi 48 done 49done 50 51trace "kill agent" 52${SSHAGENT} -k > /dev/null 53 54