1# $OpenBSD: hostkey-rotate.sh,v 1.9 2020/10/07 06:38:16 djm Exp $ 2# Placed in the Public Domain. 3 4tid="hostkey rotate" 5 6rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig $OBJ/ssh_proxy.orig 7 8grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig 9mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig 10grep -vi 'globalknownhostsfile' $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy 11echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy 12echo "GlobalKnownHostsFile=none" >> $OBJ/ssh_proxy 13rm $OBJ/known_hosts 14 15# The "primary" key type is ed25519 since it's supported even when built 16# without OpenSSL. The secondary is RSA if it's supported. 17primary="ssh-ed25519" 18secondary="$primary" 19 20trace "prepare hostkeys" 21nkeys=0 22all_algs="" 23for k in $SSH_HOSTKEY_TYPES; do 24 ${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k" 25 echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig 26 nkeys=`expr $nkeys + 1` 27 test "x$all_algs" = "x" || all_algs="${all_algs}," 28 all_algs="${all_algs}$k" 29 case "$k" in 30 ssh-rsa) secondary="ssh-rsa" ;; 31 esac 32done 33 34dossh() { 35 # All ssh should succeed in this test 36 ${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed" 37} 38 39expect_nkeys() { 40 _expected=$1 41 _message=$2 42 _n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed" 43 [ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)" 44} 45 46check_key_present() { 47 _type=$1 48 _kfile=$2 49 test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub" 50 _kpub=`awk "/$_type /"' { print $2 }' < $_kfile` || \ 51 fatal "awk failed" 52 fgrep "$_kpub" $OBJ/known_hosts > /dev/null 53} 54 55cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy 56 57# Connect to sshd with StrictHostkeyChecking=no 58verbose "learn hostkey with StrictHostKeyChecking=no" 59>$OBJ/known_hosts 60dossh -oHostKeyAlgorithms=$primary -oStrictHostKeyChecking=no 61# Verify no additional keys learned 62expect_nkeys 1 "unstrict connect keys" 63check_key_present $primary || fail "unstrict didn't learn key" 64 65# Connect to sshd as usual 66verbose "learn additional hostkeys" 67dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs 68# Check that other keys learned 69expect_nkeys $nkeys "learn hostkeys" 70for k in $SSH_HOSTKEY_TYPES; do 71 check_key_present $k || fail "didn't learn keytype $k" 72done 73 74# Check each key type 75for k in $SSH_HOSTKEY_TYPES; do 76 verbose "learn additional hostkeys, type=$k" 77 dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs 78 expect_nkeys $nkeys "learn hostkeys $k" 79 check_key_present $k || fail "didn't learn $k correctly" 80done 81 82# Change one hostkey (non primary) and relearn 83if [ "$primary" != "$secondary" ]; then 84 verbose "learn changed non-primary hostkey type=${secondary}" 85 mv $OBJ/hkr.${secondary}.pub $OBJ/hkr.${secondary}.pub.old 86 rm -f $OBJ/hkr.${secondary} 87 ${SSHKEYGEN} -qt ${secondary} -f $OBJ/hkr.${secondary} -N '' || \ 88 fatal "ssh-keygen $secondary" 89 dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs 90 # Check that the key was replaced 91 expect_nkeys $nkeys "learn hostkeys" 92 check_key_present ${secondary} $OBJ/hkr.${secondary}.pub.old && \ 93 fail "old key present" 94 check_key_present ${secondary} || fail "didn't learn changed key" 95fi 96 97# Add new hostkey (primary type) to sshd and connect 98verbose "learn new primary hostkey" 99${SSHKEYGEN} -qt ${primary} -f $OBJ/hkr.${primary}-new -N '' || fatal "ssh-keygen ed25519" 100( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.${primary}-new ) \ 101 > $OBJ/sshd_proxy 102# Check new hostkey added 103dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=${primary},$all_algs 104expect_nkeys `expr $nkeys + 1` "learn hostkeys" 105check_key_present ${primary} || fail "current key missing" 106check_key_present ${primary} $OBJ/hkr.${primary}-new.pub || fail "new key missing" 107 108# Remove old hostkey (primary type) from sshd 109verbose "rotate primary hostkey" 110cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy 111mv $OBJ/hkr.${primary}.pub $OBJ/hkr.${primary}.pub.old 112mv $OBJ/hkr.${primary}-new.pub $OBJ/hkr.${primary}.pub 113mv $OBJ/hkr.${primary}-new $OBJ/hkr.${primary} 114# Check old hostkey removed 115dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=${primary},$all_algs 116expect_nkeys $nkeys "learn hostkeys" 117check_key_present ${primary} $OBJ/hkr.${primary}.pub.old && fail "old key present" 118check_key_present ${primary} || fail "didn't learn changed key" 119 120# Connect again, forcing rotated key 121verbose "check rotate primary hostkey" 122dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=${primary} 123expect_nkeys 1 "learn hostkeys" 124check_key_present ${primary} || fail "didn't learn changed key" 125