1 # $OpenBSD: cert-hostkey.sh,v 1.8 2013/12/06 13:52:46 markus Exp $
2 # Placed in the Public Domain.
4 tid="certified host keys"
6 rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
7 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
9 HOSTS='localhost-with-alias,127.0.0.1,::1'
11 # Create a CA key and add it to known hosts
12 ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/host_ca_key ||\
13 fail "ssh-keygen of host_ca_key failed"
15 printf '@cert-authority '
17 cat $OBJ/host_ca_key.pub
18 ) > $OBJ/known_hosts-cert
20 PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'`
24 ed25519*|ecdsa*) return 1 ;;
29 # Generate and sign host keys
30 for ktype in $PLAIN_TYPES ; do
31 verbose "$tid: sign host ${ktype} cert"
32 # Generate and sign a host key
33 ${SSHKEYGEN} -q -N '' -t ${ktype} \
34 -f $OBJ/cert_host_key_${ktype} || \
35 fail "ssh-keygen of cert_host_key_${ktype} failed"
36 ${SSHKEYGEN} -h -q -s $OBJ/host_ca_key \
37 -I "regress host key for $USER" \
38 -n $HOSTS $OBJ/cert_host_key_${ktype} ||
39 fail "couldn't sign cert_host_key_${ktype}"
40 type_has_legacy $ktype || continue
41 cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
42 cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
43 verbose "$tid: sign host ${ktype}_v00 cert"
44 ${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
45 -I "regress host key for $USER" \
46 -n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
47 fail "couldn't sign cert_host_key_${ktype}_v00"
51 for privsep in yes no ; do
52 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
53 verbose "$tid: host ${ktype} cert connect privsep $privsep"
55 cat $OBJ/sshd_proxy_bak
56 echo HostKey $OBJ/cert_host_key_${ktype}
57 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
58 echo UsePrivilegeSeparation $privsep
61 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
62 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
63 -F $OBJ/ssh_proxy somehost true
65 fail "ssh cert connect failed"
70 # Revoked certificates with key present
72 printf '@cert-authority '
74 cat $OBJ/host_ca_key.pub
75 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
76 test -f "$OBJ/cert_host_key_${ktype}.pub" || fatal "no pubkey"
77 printf "@revoked * `cat $OBJ/cert_host_key_${ktype}.pub`\n"
79 ) > $OBJ/known_hosts-cert
80 for privsep in yes no ; do
81 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
82 verbose "$tid: host ${ktype} revoked cert privsep $privsep"
84 cat $OBJ/sshd_proxy_bak
85 echo HostKey $OBJ/cert_host_key_${ktype}
86 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
87 echo UsePrivilegeSeparation $privsep
90 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
91 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
92 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
94 fail "ssh cert connect succeeded unexpectedly"
101 printf '@cert-authority '
103 cat $OBJ/host_ca_key.pub
106 cat $OBJ/host_ca_key.pub
107 ) > $OBJ/known_hosts-cert
108 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
109 verbose "$tid: host ${ktype} revoked cert"
111 cat $OBJ/sshd_proxy_bak
112 echo HostKey $OBJ/cert_host_key_${ktype}
113 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
115 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
116 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
117 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
118 if [ $? -eq 0 ]; then
119 fail "ssh cert connect succeeded unexpectedly"
123 # Create a CA key and add it to known hosts
125 printf '@cert-authority '
127 cat $OBJ/host_ca_key.pub
128 ) > $OBJ/known_hosts-cert
135 for kt in rsa rsa_v00 ; do
137 *_v00) args="-t v00" ;;
141 verbose "$tid: host cert connect $ident $kt expect $result"
142 ${SSHKEYGEN} -q -s $OBJ/host_ca_key \
143 -I "regress host key for $USER" \
145 $OBJ/cert_host_key_${kt} ||
146 fail "couldn't sign cert_host_key_${kt}"
148 cat $OBJ/sshd_proxy_bak
149 echo HostKey $OBJ/cert_host_key_${kt}
150 echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
153 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
154 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
155 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
157 if [ "x$result" = "xsuccess" ] ; then
158 if [ $rc -ne 0 ]; then
159 fail "ssh cert connect $ident failed unexpectedly"
162 if [ $rc -eq 0 ]; then
163 fail "ssh cert connect $ident succeeded unexpectedly"
169 test_one "user-certificate" failure "-n $HOSTS"
170 test_one "empty principals" success "-h"
171 test_one "wrong principals" failure "-h -n foo"
172 test_one "cert not yet valid" failure "-h -V20200101:20300101"
173 test_one "cert expired" failure "-h -V19800101:19900101"
174 test_one "cert valid interval" success "-h -V-1w:+2w"
175 test_one "cert has constraints" failure "-h -Oforce-command=false"
177 # Check downgrade of cert to raw key when no CA found
178 for v in v01 v00 ; do
179 for ktype in $PLAIN_TYPES ; do
180 type_has_legacy $ktype || continue
181 rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
182 verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
183 # Generate and sign a host key
184 ${SSHKEYGEN} -q -N '' -t ${ktype} \
185 -f $OBJ/cert_host_key_${ktype} || \
186 fail "ssh-keygen of cert_host_key_${ktype} failed"
187 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/host_ca_key \
188 -I "regress host key for $USER" \
189 -n $HOSTS $OBJ/cert_host_key_${ktype} ||
190 fail "couldn't sign cert_host_key_${ktype}"
193 cat $OBJ/cert_host_key_${ktype}.pub
194 ) > $OBJ/known_hosts-cert
196 cat $OBJ/sshd_proxy_bak
197 echo HostKey $OBJ/cert_host_key_${ktype}
198 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
201 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
202 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
203 -F $OBJ/ssh_proxy somehost true
204 if [ $? -ne 0 ]; then
205 fail "ssh cert connect failed"
212 printf '@cert-authority '
214 cat $OBJ/host_ca_key.pub
215 ) > $OBJ/known_hosts-cert
216 for v in v01 v00 ; do
217 for kt in $PLAIN_TYPES ; do
218 type_has_legacy $kt || continue
219 rm -f $OBJ/cert_host_key*
221 ${SSHKEYGEN} -q -N '' -t ${kt} \
222 -f $OBJ/cert_host_key_${kt} || \
223 fail "ssh-keygen of cert_host_key_${kt} failed"
224 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/cert_host_key_${kt} \
225 -I "regress host key for $USER" \
226 -n $HOSTS $OBJ/cert_host_key_${kt} ||
227 fail "couldn't sign cert_host_key_${kt}"
228 verbose "$tid: host ${kt} connect wrong cert"
230 cat $OBJ/sshd_proxy_bak
231 echo HostKey $OBJ/cert_host_key_${kt}
232 echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
235 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
236 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
237 -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
238 if [ $? -eq 0 ]; then
239 fail "ssh cert connect $ident succeeded unexpectedly"
244 rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*