1# $OpenBSD: keys-command.sh,v 1.8 2021/09/30 04:22:50 dtucker Exp $ 2# Placed in the Public Domain. 3 4tid="authorized keys from command" 5 6if [ -z "$SUDO" -a ! -w /var/run ]; then 7 skip "need SUDO to create file in /var/run, test won't work without" 8fi 9 10rm -f $OBJ/keys-command-args 11 12touch $OBJ/keys-command-args 13chmod a+rw $OBJ/keys-command-args 14 15expected_key_text=`awk '{ print $2 }' < $OBJ/ssh-ed25519.pub` 16expected_key_fp=`$SSHKEYGEN -lf $OBJ/ssh-ed25519.pub | awk '{ print $2 }'` 17 18# Establish a AuthorizedKeysCommand in /var/run where it will have 19# acceptable directory permissions. 20KEY_COMMAND="/var/run/keycommand_${LOGNAME}.$$" 21trap "${SUDO} rm -f ${KEY_COMMAND}" 0 22cat << _EOF | $SUDO sh -c "rm -f '$KEY_COMMAND' ; cat > '$KEY_COMMAND'" 23#!/bin/sh 24echo args: "\$@" >> $OBJ/keys-command-args 25echo "$PATH" | grep -q mekmitasdigoat && exit 7 26test "x\$1" != "x${LOGNAME}" && exit 1 27if test $# -eq 6 ; then 28 test "x\$2" != "xblah" && exit 2 29 test "x\$3" != "x${expected_key_text}" && exit 3 30 test "x\$4" != "xssh-rsa" && exit 4 31 test "x\$5" != "x${expected_key_fp}" && exit 5 32 test "x\$6" != "xblah" && exit 6 33fi 34exec cat "$OBJ/authorized_keys_${LOGNAME}" 35_EOF 36$SUDO chmod 0755 "$KEY_COMMAND" 37 38if ! $OBJ/check-perm -m keys-command $KEY_COMMAND ; then 39 echo "skipping: $KEY_COMMAND is unsuitable as AuthorizedKeysCommand" 40 $SUDO rm -f $KEY_COMMAND 41 exit 0 42fi 43 44if [ -x $KEY_COMMAND ]; then 45 cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak 46 47 verbose "AuthorizedKeysCommand with arguments" 48 ( 49 grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak 50 echo AuthorizedKeysFile none 51 echo AuthorizedKeysCommand $KEY_COMMAND %u blah %k %t %f blah 52 echo AuthorizedKeysCommandUser ${LOGNAME} 53 ) > $OBJ/sshd_proxy 54 55 # Ensure that $PATH is sanitised in sshd 56 env PATH=$PATH:/sbin/mekmitasdigoat \ 57 ${SSH} -F $OBJ/ssh_proxy somehost true 58 if [ $? -ne 0 ]; then 59 fail "connect failed" 60 fi 61 62 verbose "AuthorizedKeysCommand without arguments" 63 # Check legacy behavior of no-args resulting in username being passed. 64 ( 65 grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak 66 echo AuthorizedKeysFile none 67 echo AuthorizedKeysCommand $KEY_COMMAND 68 echo AuthorizedKeysCommandUser ${LOGNAME} 69 ) > $OBJ/sshd_proxy 70 71 # Ensure that $PATH is sanitised in sshd 72 env PATH=$PATH:/sbin/mekmitasdigoat \ 73 ${SSH} -F $OBJ/ssh_proxy somehost true 74 if [ $? -ne 0 ]; then 75 fail "connect failed" 76 fi 77else 78 skip "$KEY_COMMAND not executable (/var/run mounted noexec?)" 79fi 80