1*ce3adf43SDag-Erling Smørgrav# $OpenBSD: keys-command.sh,v 1.2 2012/12/06 06:06:54 dtucker Exp $ 2*ce3adf43SDag-Erling Smørgrav# Placed in the Public Domain. 3*ce3adf43SDag-Erling Smørgrav 4*ce3adf43SDag-Erling Smørgravtid="authorized keys from command" 5*ce3adf43SDag-Erling Smørgrav 6*ce3adf43SDag-Erling Smørgravif test -z "$SUDO" ; then 7*ce3adf43SDag-Erling Smørgrav echo "skipped (SUDO not set)" 8*ce3adf43SDag-Erling Smørgrav echo "need SUDO to create file in /var/run, test won't work without" 9*ce3adf43SDag-Erling Smørgrav exit 0 10*ce3adf43SDag-Erling Smørgravfi 11*ce3adf43SDag-Erling Smørgrav 12*ce3adf43SDag-Erling Smørgrav# Establish a AuthorizedKeysCommand in /var/run where it will have 13*ce3adf43SDag-Erling Smørgrav# acceptable directory permissions. 14*ce3adf43SDag-Erling SmørgravKEY_COMMAND="/var/run/keycommand_${LOGNAME}" 15*ce3adf43SDag-Erling Smørgravcat << _EOF | $SUDO sh -c "cat > '$KEY_COMMAND'" 16*ce3adf43SDag-Erling Smørgrav#!/bin/sh 17*ce3adf43SDag-Erling Smørgravtest "x\$1" != "x${LOGNAME}" && exit 1 18*ce3adf43SDag-Erling Smørgravexec cat "$OBJ/authorized_keys_${LOGNAME}" 19*ce3adf43SDag-Erling Smørgrav_EOF 20*ce3adf43SDag-Erling Smørgrav$SUDO chmod 0755 "$KEY_COMMAND" 21*ce3adf43SDag-Erling Smørgrav 22*ce3adf43SDag-Erling Smørgravcp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak 23*ce3adf43SDag-Erling Smørgrav( 24*ce3adf43SDag-Erling Smørgrav grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak 25*ce3adf43SDag-Erling Smørgrav echo AuthorizedKeysFile none 26*ce3adf43SDag-Erling Smørgrav echo AuthorizedKeysCommand $KEY_COMMAND 27*ce3adf43SDag-Erling Smørgrav echo AuthorizedKeysCommandUser ${LOGNAME} 28*ce3adf43SDag-Erling Smørgrav) > $OBJ/sshd_proxy 29*ce3adf43SDag-Erling Smørgrav 30*ce3adf43SDag-Erling Smørgravif [ -x $KEY_COMMAND ]; then 31*ce3adf43SDag-Erling Smørgrav ${SSH} -F $OBJ/ssh_proxy somehost true 32*ce3adf43SDag-Erling Smørgrav if [ $? -ne 0 ]; then 33*ce3adf43SDag-Erling Smørgrav fail "connect failed" 34*ce3adf43SDag-Erling Smørgrav fi 35*ce3adf43SDag-Erling Smørgravelse 36*ce3adf43SDag-Erling Smørgrav echo "SKIPPED: $KEY_COMMAND not executable (/var/run mounted noexec?)" 37*ce3adf43SDag-Erling Smørgravfi 38*ce3adf43SDag-Erling Smørgrav 39*ce3adf43SDag-Erling Smørgrav$SUDO rm -f $KEY_COMMAND 40