1 # $OpenBSD: keys-command.sh,v 1.4 2016/09/26 21:34:38 bluhm Exp $
2 # Placed in the Public Domain.
4 tid="authorized keys from command"
6 if [ -z "$SUDO" -a ! -w /var/run ]; then
7 echo "skipped (SUDO not set)"
8 echo "need SUDO to create file in /var/run, test won't work without"
12 rm -f $OBJ/keys-command-args
14 touch $OBJ/keys-command-args
15 chmod a+rw $OBJ/keys-command-args
17 expected_key_text=`awk '{ print $2 }' < $OBJ/rsa.pub`
18 expected_key_fp=`$SSHKEYGEN -lf $OBJ/rsa.pub | awk '{ print $2 }'`
20 # Establish a AuthorizedKeysCommand in /var/run where it will have
21 # acceptable directory permissions.
22 KEY_COMMAND="/var/run/keycommand_${LOGNAME}"
23 cat << _EOF | $SUDO sh -c "rm -f '$KEY_COMMAND' ; cat > '$KEY_COMMAND'"
25 echo args: "\$@" >> $OBJ/keys-command-args
26 echo "$PATH" | grep -q mekmitasdigoat && exit 7
27 test "x\$1" != "x${LOGNAME}" && exit 1
28 if test $# -eq 6 ; then
29 test "x\$2" != "xblah" && exit 2
30 test "x\$3" != "x${expected_key_text}" && exit 3
31 test "x\$4" != "xssh-rsa" && exit 4
32 test "x\$5" != "x${expected_key_fp}" && exit 5
33 test "x\$6" != "xblah" && exit 6
35 exec cat "$OBJ/authorized_keys_${LOGNAME}"
37 $SUDO chmod 0755 "$KEY_COMMAND"
39 if ! $OBJ/check-perm -m keys-command $KEY_COMMAND ; then
40 echo "skipping: $KEY_COMMAND is unsuitable as AuthorizedKeysCommand"
41 $SUDO rm -f $KEY_COMMAND
45 if [ -x $KEY_COMMAND ]; then
46 cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
48 verbose "AuthorizedKeysCommand with arguments"
50 grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
51 echo AuthorizedKeysFile none
52 echo AuthorizedKeysCommand $KEY_COMMAND %u blah %k %t %f blah
53 echo AuthorizedKeysCommandUser ${LOGNAME}
56 # Ensure that $PATH is sanitised in sshd
57 env PATH=$PATH:/sbin/mekmitasdigoat \
58 ${SSH} -F $OBJ/ssh_proxy somehost true
63 verbose "AuthorizedKeysCommand without arguments"
64 # Check legacy behavior of no-args resulting in username being passed.
66 grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
67 echo AuthorizedKeysFile none
68 echo AuthorizedKeysCommand $KEY_COMMAND
69 echo AuthorizedKeysCommandUser ${LOGNAME}
72 # Ensure that $PATH is sanitised in sshd
73 env PATH=$PATH:/sbin/mekmitasdigoat \
74 ${SSH} -F $OBJ/ssh_proxy somehost true
79 echo "SKIPPED: $KEY_COMMAND not executable (/var/run mounted noexec?)"
82 $SUDO rm -f $KEY_COMMAND