1 # $OpenBSD: cert-userkey.sh,v 1.12 2013/12/06 13:52:46 markus Exp $
2 # Placed in the Public Domain.
4 tid="certified user keys"
6 rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
7 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
9 PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/;s/^ssh-//'`
13 ed25519*|ecdsa*) return 1 ;;
19 ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_ca_key ||\
20 fail "ssh-keygen of user_ca_key failed"
22 # Generate and sign user keys
23 for ktype in $PLAIN_TYPES ; do
24 verbose "$tid: sign user ${ktype} cert"
25 ${SSHKEYGEN} -q -N '' -t ${ktype} \
26 -f $OBJ/cert_user_key_${ktype} || \
27 fail "ssh-keygen of cert_user_key_${ktype} failed"
28 ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
29 -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
30 fail "couldn't sign cert_user_key_${ktype}"
31 type_has_legacy $ktype || continue
32 cp $OBJ/cert_user_key_${ktype} $OBJ/cert_user_key_${ktype}_v00
33 cp $OBJ/cert_user_key_${ktype}.pub $OBJ/cert_user_key_${ktype}_v00.pub
34 verbose "$tid: sign host ${ktype}_v00 cert"
35 ${SSHKEYGEN} -q -t v00 -s $OBJ/user_ca_key -I \
36 "regress user key for $USER" \
37 -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype}_v00 ||
38 fatal "couldn't sign cert_user_key_${ktype}_v00"
41 # Test explicitly-specified principals
42 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
43 for privsep in yes no ; do
44 _prefix="${ktype} privsep $privsep"
46 # Setup for AuthorizedPrincipalsFile
47 rm -f $OBJ/authorized_keys_$USER
49 cat $OBJ/sshd_proxy_bak
50 echo "UsePrivilegeSeparation $privsep"
51 echo "AuthorizedPrincipalsFile " \
52 "$OBJ/authorized_principals_%u"
53 echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
56 # Missing authorized_principals
57 verbose "$tid: ${_prefix} missing authorized_principals"
58 rm -f $OBJ/authorized_principals_$USER
59 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
60 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
62 fail "ssh cert connect succeeded unexpectedly"
65 # Empty authorized_principals
66 verbose "$tid: ${_prefix} empty authorized_principals"
67 echo > $OBJ/authorized_principals_$USER
68 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
69 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
71 fail "ssh cert connect succeeded unexpectedly"
74 # Wrong authorized_principals
75 verbose "$tid: ${_prefix} wrong authorized_principals"
76 echo gregorsamsa > $OBJ/authorized_principals_$USER
77 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
78 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
80 fail "ssh cert connect succeeded unexpectedly"
83 # Correct authorized_principals
84 verbose "$tid: ${_prefix} correct authorized_principals"
85 echo mekmitasdigoat > $OBJ/authorized_principals_$USER
86 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
87 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
89 fail "ssh cert connect failed"
92 # authorized_principals with bad key option
93 verbose "$tid: ${_prefix} authorized_principals bad key opt"
94 echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
95 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
96 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
98 fail "ssh cert connect succeeded unexpectedly"
101 # authorized_principals with command=false
102 verbose "$tid: ${_prefix} authorized_principals command=false"
103 echo 'command="false" mekmitasdigoat' > \
104 $OBJ/authorized_principals_$USER
105 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
106 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
107 if [ $? -eq 0 ]; then
108 fail "ssh cert connect succeeded unexpectedly"
112 # authorized_principals with command=true
113 verbose "$tid: ${_prefix} authorized_principals command=true"
114 echo 'command="true" mekmitasdigoat' > \
115 $OBJ/authorized_principals_$USER
116 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
117 -F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
118 if [ $? -ne 0 ]; then
119 fail "ssh cert connect failed"
122 # Setup for principals= key option
123 rm -f $OBJ/authorized_principals_$USER
125 cat $OBJ/sshd_proxy_bak
126 echo "UsePrivilegeSeparation $privsep"
129 # Wrong principals list
130 verbose "$tid: ${_prefix} wrong principals key option"
132 printf 'cert-authority,principals="gregorsamsa" '
133 cat $OBJ/user_ca_key.pub
134 ) > $OBJ/authorized_keys_$USER
135 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
136 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
137 if [ $? -eq 0 ]; then
138 fail "ssh cert connect succeeded unexpectedly"
141 # Correct principals list
142 verbose "$tid: ${_prefix} correct principals key option"
144 printf 'cert-authority,principals="mekmitasdigoat" '
145 cat $OBJ/user_ca_key.pub
146 ) > $OBJ/authorized_keys_$USER
147 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
148 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
149 if [ $? -ne 0 ]; then
150 fail "ssh cert connect failed"
157 if test "x$auth" = "xauthorized_keys" ; then
158 # Add CA to authorized_keys
160 printf 'cert-authority '
161 cat $OBJ/user_ca_key.pub
162 ) > $OBJ/authorized_keys_$USER
164 echo > $OBJ/authorized_keys_$USER
165 extra_sshd="TrustedUserCAKeys $OBJ/user_ca_key.pub"
168 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
169 for privsep in yes no ; do
170 _prefix="${ktype} privsep $privsep $auth"
172 verbose "$tid: ${_prefix} connect"
174 cat $OBJ/sshd_proxy_bak
175 echo "UsePrivilegeSeparation $privsep"
179 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
180 -F $OBJ/ssh_proxy somehost true
181 if [ $? -ne 0 ]; then
182 fail "ssh cert connect failed"
186 verbose "$tid: ${_prefix} revoked key"
188 cat $OBJ/sshd_proxy_bak
189 echo "UsePrivilegeSeparation $privsep"
190 echo "RevokedKeys $OBJ/cert_user_key_revoked"
193 cp $OBJ/cert_user_key_${ktype}.pub \
194 $OBJ/cert_user_key_revoked
195 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
196 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
197 if [ $? -eq 0 ]; then
198 fail "ssh cert connect succeeded unexpecedly"
200 verbose "$tid: ${_prefix} revoked via KRL"
201 rm $OBJ/cert_user_key_revoked
202 ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked \
203 $OBJ/cert_user_key_${ktype}.pub
204 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
205 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
206 if [ $? -eq 0 ]; then
207 fail "ssh cert connect succeeded unexpecedly"
209 verbose "$tid: ${_prefix} empty KRL"
210 ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked
211 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
212 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
213 if [ $? -ne 0 ]; then
214 fail "ssh cert connect failed"
219 verbose "$tid: ${ktype} $auth revoked CA key"
221 cat $OBJ/sshd_proxy_bak
222 echo "RevokedKeys $OBJ/user_ca_key.pub"
225 ${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
226 somehost true >/dev/null 2>&1
227 if [ $? -eq 0 ]; then
228 fail "ssh cert connect succeeded unexpecedly"
232 verbose "$tid: $auth CA does not authenticate"
234 cat $OBJ/sshd_proxy_bak
237 verbose "$tid: ensure CA key does not authenticate user"
238 ${SSH} -2i $OBJ/user_ca_key \
239 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
240 if [ $? -eq 0 ]; then
241 fail "ssh cert connect with CA key succeeded unexpectedly"
245 basic_tests authorized_keys
246 basic_tests TrustedUserCAKeys
255 if test "x$auth_choice" = "x" ; then
256 auth_choice="authorized_keys TrustedUserCAKeys"
259 for auth in $auth_choice ; do
260 for ktype in rsa rsa_v00 ; do
262 *_v00) keyv="-t v00" ;;
266 cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
267 if test "x$auth" = "xauthorized_keys" ; then
268 # Add CA to authorized_keys
270 printf "cert-authority${auth_opt} "
271 cat $OBJ/user_ca_key.pub
272 ) > $OBJ/authorized_keys_$USER
274 echo > $OBJ/authorized_keys_$USER
275 echo "TrustedUserCAKeys $OBJ/user_ca_key.pub" \
277 if test "x$auth_opt" != "x" ; then
278 echo $auth_opt >> $OBJ/sshd_proxy
282 verbose "$tid: $ident auth $auth expect $result $ktype"
283 ${SSHKEYGEN} -q -s $OBJ/user_ca_key \
284 -I "regress user key for $USER" \
286 $OBJ/cert_user_key_${ktype} ||
287 fail "couldn't sign cert_user_key_${ktype}"
289 ${SSH} -2i $OBJ/cert_user_key_${ktype} \
290 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
292 if [ "x$result" = "xsuccess" ] ; then
293 if [ $rc -ne 0 ]; then
294 fail "$ident failed unexpectedly"
297 if [ $rc -eq 0 ]; then
298 fail "$ident succeeded unexpectedly"
305 test_one "correct principal" success "-n ${USER}"
306 test_one "host-certificate" failure "-n ${USER} -h"
307 test_one "wrong principals" failure "-n foo"
308 test_one "cert not yet valid" failure "-n ${USER} -V20200101:20300101"
309 test_one "cert expired" failure "-n ${USER} -V19800101:19900101"
310 test_one "cert valid interval" success "-n ${USER} -V-1w:+2w"
311 test_one "wrong source-address" failure "-n ${USER} -Osource-address=10.0.0.0/8"
312 test_one "force-command" failure "-n ${USER} -Oforce-command=false"
314 # Behaviour is different here: TrustedUserCAKeys doesn't allow empty principals
315 test_one "empty principals" success "" authorized_keys
316 test_one "empty principals" failure "" TrustedUserCAKeys
318 # Check explicitly-specified principals: an empty principals list in the cert
319 # should always be refused.
321 # AuthorizedPrincipalsFile
322 rm -f $OBJ/authorized_keys_$USER
323 echo mekmitasdigoat > $OBJ/authorized_principals_$USER
324 test_one "AuthorizedPrincipalsFile principals" success "-n mekmitasdigoat" \
325 TrustedUserCAKeys "AuthorizedPrincipalsFile $OBJ/authorized_principals_%u"
326 test_one "AuthorizedPrincipalsFile no principals" failure "" \
327 TrustedUserCAKeys "AuthorizedPrincipalsFile $OBJ/authorized_principals_%u"
329 # principals= key option
330 rm -f $OBJ/authorized_principals_$USER
331 test_one "principals key option principals" success "-n mekmitasdigoat" \
332 authorized_keys ',principals="mekmitasdigoat"'
333 test_one "principals key option no principals" failure "" \
334 authorized_keys ',principals="mekmitasdigoat"'
337 cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
338 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
340 *_v00) args="-t v00" ;;
344 ${SSHKEYGEN} $args -q -s $OBJ/cert_user_key_${ktype} -I \
345 "regress user key for $USER" \
346 -n $USER $OBJ/cert_user_key_${ktype} ||
347 fail "couldn't sign cert_user_key_${ktype}"
348 verbose "$tid: user ${ktype} connect wrong cert"
349 ${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
350 somehost true >/dev/null 2>&1
351 if [ $? -eq 0 ]; then
352 fail "ssh cert connect $ident succeeded unexpectedly"
356 rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
357 rm -f $OBJ/authorized_principals_$USER