regress/keys-command.sh

   1 #       $OpenBSD: keys-command.sh,v 1.8 2021/09/30 04:22:50 dtucker Exp $
   2 #       Placed in the Public Domain.
   3
   4 tid="authorized keys from command"
   5
   6 if [ -z "$SUDO" -a ! -w /var/run ]; then
   7         skip "need SUDO to create file in /var/run, test won't work without"
   8 fi
   9
  10 rm -f $OBJ/keys-command-args
  11
  12 touch $OBJ/keys-command-args
  13 chmod a+rw $OBJ/keys-command-args
  14
  15 expected_key_text=`awk '{ print $2 }' < $OBJ/ssh-ed25519.pub`
  16 expected_key_fp=`$SSHKEYGEN -lf $OBJ/ssh-ed25519.pub | awk '{ print $2 }'`
  17
  18 # Establish a AuthorizedKeysCommand in /var/run where it will have
  19 # acceptable directory permissions.
  20 KEY_COMMAND="/var/run/keycommand_${LOGNAME}.$$"
  21 trap "${SUDO} rm -f ${KEY_COMMAND}" 0
  22 cat << _EOF | $SUDO sh -c "rm -f '$KEY_COMMAND' ; cat > '$KEY_COMMAND'"
  23 #!/bin/sh
  24 echo args: "\$@" >> $OBJ/keys-command-args
  25 echo "$PATH" | grep -q mekmitasdigoat && exit 7
  26 test "x\$1" != "x${LOGNAME}" && exit 1
  27 if test $# -eq 6 ; then
  28         test "x\$2" != "xblah" && exit 2
  29         test "x\$3" != "x${expected_key_text}" && exit 3
  30         test "x\$4" != "xssh-rsa" && exit 4
  31         test "x\$5" != "x${expected_key_fp}" && exit 5
  32         test "x\$6" != "xblah" && exit 6
  33 fi
  34 exec cat "$OBJ/authorized_keys_${LOGNAME}"
  35 _EOF
  36 $SUDO chmod 0755 "$KEY_COMMAND"
  37
  38 if ! $OBJ/check-perm -m keys-command $KEY_COMMAND ; then
  39         echo "skipping: $KEY_COMMAND is unsuitable as AuthorizedKeysCommand"
  40         $SUDO rm -f $KEY_COMMAND
  41         exit 0
  42 fi
  43
  44 if [ -x $KEY_COMMAND ]; then
  45         cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
  46
  47         verbose "AuthorizedKeysCommand with arguments"
  48         (
  49                 grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
  50                 echo AuthorizedKeysFile none
  51                 echo AuthorizedKeysCommand $KEY_COMMAND %u blah %k %t %f blah
  52                 echo AuthorizedKeysCommandUser ${LOGNAME}
  53         ) > $OBJ/sshd_proxy
  54
  55         # Ensure that $PATH is sanitised in sshd
  56         env PATH=$PATH:/sbin/mekmitasdigoat \
  57             ${SSH} -F $OBJ/ssh_proxy somehost true
  58         if [ $? -ne 0 ]; then
  59                 fail "connect failed"
  60         fi
  61
  62         verbose "AuthorizedKeysCommand without arguments"
  63         # Check legacy behavior of no-args resulting in username being passed.
  64         (
  65                 grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
  66                 echo AuthorizedKeysFile none
  67                 echo AuthorizedKeysCommand $KEY_COMMAND
  68                 echo AuthorizedKeysCommandUser ${LOGNAME}
  69         ) > $OBJ/sshd_proxy
  70
  71         # Ensure that $PATH is sanitised in sshd
  72         env PATH=$PATH:/sbin/mekmitasdigoat \
  73             ${SSH} -F $OBJ/ssh_proxy somehost true
  74         if [ $? -ne 0 ]; then
  75                 fail "connect failed"
  76         fi
  77 else
  78         skip "$KEY_COMMAND not executable (/var/run mounted noexec?)"
  79 fi