let principals-command.sh work for noexec /var/run
This commit is contained in:
Damien Miller
parent
2651e34cd1
commit
55b263fb7c
|
|
@ -14,15 +14,15 @@ fi
|
||||||
|
|
||||||
# Establish a AuthorizedPrincipalsCommand in /var/run where it will have
|
# Establish a AuthorizedPrincipalsCommand in /var/run where it will have
|
||||||
# acceptable directory permissions.
|
# acceptable directory permissions.
|
||||||
PRINCIPALS_COMMAND="/var/run/principals_command_${LOGNAME}"
|
PRINCIPALS_CMD="/var/run/principals_command_${LOGNAME}"
|
||||||
cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_COMMAND'"
|
cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_CMD'"
|
||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
test "x\$1" != "x${LOGNAME}" && exit 1
|
test "x\$1" != "x${LOGNAME}" && exit 1
|
||||||
test -f "$OBJ/authorized_principals_${LOGNAME}" &&
|
test -f "$OBJ/authorized_principals_${LOGNAME}" &&
|
||||||
exec cat "$OBJ/authorized_principals_${LOGNAME}"
|
exec cat "$OBJ/authorized_principals_${LOGNAME}"
|
||||||
_EOF
|
_EOF
|
||||||
test $? -eq 0 || fatal "couldn't prepare principals command"
|
test $? -eq 0 || fatal "couldn't prepare principals command"
|
||||||
$SUDO chmod 0755 "$PRINCIPALS_COMMAND"
|
$SUDO chmod 0755 "$PRINCIPALS_CMD"
|
||||||
|
|
||||||
# Create a CA key and a user certificate.
|
# Create a CA key and a user certificate.
|
||||||
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key || \
|
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key || \
|
||||||
|
|
@ -33,109 +33,113 @@ ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
|
||||||
-z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
|
-z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
|
||||||
fatal "couldn't sign cert_user_key"
|
fatal "couldn't sign cert_user_key"
|
||||||
|
|
||||||
# Test explicitly-specified principals
|
if [ -x $PRINCIPALS_CMD ]; then
|
||||||
for privsep in yes no ; do
|
# Test explicitly-specified principals
|
||||||
_prefix="privsep $privsep"
|
for privsep in yes no ; do
|
||||||
|
_prefix="privsep $privsep"
|
||||||
|
|
||||||
# Setup for AuthorizedPrincipalsCommand
|
# Setup for AuthorizedPrincipalsCommand
|
||||||
rm -f $OBJ/authorized_keys_$USER
|
rm -f $OBJ/authorized_keys_$USER
|
||||||
(
|
(
|
||||||
cat $OBJ/sshd_proxy_bak
|
cat $OBJ/sshd_proxy_bak
|
||||||
echo "UsePrivilegeSeparation $privsep"
|
echo "UsePrivilegeSeparation $privsep"
|
||||||
echo "AuthorizedKeysFile none"
|
echo "AuthorizedKeysFile none"
|
||||||
echo "AuthorizedPrincipalsCommand $PRINCIPALS_COMMAND %u"
|
echo "AuthorizedPrincipalsCommand $PRINCIPALS_CMD %u"
|
||||||
echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
|
echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
|
||||||
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
|
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
|
||||||
) > $OBJ/sshd_proxy
|
) > $OBJ/sshd_proxy
|
||||||
|
|
||||||
# XXX test missing command
|
# XXX test missing command
|
||||||
# XXX test failing command
|
# XXX test failing command
|
||||||
|
|
||||||
# Empty authorized_principals
|
# Empty authorized_principals
|
||||||
verbose "$tid: ${_prefix} empty authorized_principals"
|
verbose "$tid: ${_prefix} empty authorized_principals"
|
||||||
echo > $OBJ/authorized_principals_$USER
|
echo > $OBJ/authorized_principals_$USER
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||||
if [ $? -eq 0 ]; then
|
if [ $? -eq 0 ]; then
|
||||||
fail "ssh cert connect succeeded unexpectedly"
|
fail "ssh cert connect succeeded unexpectedly"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Wrong authorized_principals
|
# Wrong authorized_principals
|
||||||
verbose "$tid: ${_prefix} wrong authorized_principals"
|
verbose "$tid: ${_prefix} wrong authorized_principals"
|
||||||
echo gregorsamsa > $OBJ/authorized_principals_$USER
|
echo gregorsamsa > $OBJ/authorized_principals_$USER
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||||
if [ $? -eq 0 ]; then
|
if [ $? -eq 0 ]; then
|
||||||
fail "ssh cert connect succeeded unexpectedly"
|
fail "ssh cert connect succeeded unexpectedly"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Correct authorized_principals
|
# Correct authorized_principals
|
||||||
verbose "$tid: ${_prefix} correct authorized_principals"
|
verbose "$tid: ${_prefix} correct authorized_principals"
|
||||||
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
|
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||||
if [ $? -ne 0 ]; then
|
if [ $? -ne 0 ]; then
|
||||||
fail "ssh cert connect failed"
|
fail "ssh cert connect failed"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# authorized_principals with bad key option
|
# authorized_principals with bad key option
|
||||||
verbose "$tid: ${_prefix} authorized_principals bad key opt"
|
verbose "$tid: ${_prefix} authorized_principals bad key opt"
|
||||||
echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
|
echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||||
if [ $? -eq 0 ]; then
|
if [ $? -eq 0 ]; then
|
||||||
fail "ssh cert connect succeeded unexpectedly"
|
fail "ssh cert connect succeeded unexpectedly"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# authorized_principals with command=false
|
# authorized_principals with command=false
|
||||||
verbose "$tid: ${_prefix} authorized_principals command=false"
|
verbose "$tid: ${_prefix} authorized_principals command=false"
|
||||||
echo 'command="false" mekmitasdigoat' > \
|
echo 'command="false" mekmitasdigoat' > \
|
||||||
$OBJ/authorized_principals_$USER
|
$OBJ/authorized_principals_$USER
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||||
if [ $? -eq 0 ]; then
|
if [ $? -eq 0 ]; then
|
||||||
fail "ssh cert connect succeeded unexpectedly"
|
fail "ssh cert connect succeeded unexpectedly"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# authorized_principals with command=true
|
||||||
|
verbose "$tid: ${_prefix} authorized_principals command=true"
|
||||||
|
echo 'command="true" mekmitasdigoat' > \
|
||||||
|
$OBJ/authorized_principals_$USER
|
||||||
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
|
-F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
|
||||||
|
if [ $? -ne 0 ]; then
|
||||||
|
fail "ssh cert connect failed"
|
||||||
|
fi
|
||||||
|
|
||||||
# authorized_principals with command=true
|
# Setup for principals= key option
|
||||||
verbose "$tid: ${_prefix} authorized_principals command=true"
|
rm -f $OBJ/authorized_principals_$USER
|
||||||
echo 'command="true" mekmitasdigoat' > \
|
(
|
||||||
$OBJ/authorized_principals_$USER
|
cat $OBJ/sshd_proxy_bak
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
echo "UsePrivilegeSeparation $privsep"
|
||||||
-F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
|
) > $OBJ/sshd_proxy
|
||||||
if [ $? -ne 0 ]; then
|
|
||||||
fail "ssh cert connect failed"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Setup for principals= key option
|
# Wrong principals list
|
||||||
rm -f $OBJ/authorized_principals_$USER
|
verbose "$tid: ${_prefix} wrong principals key option"
|
||||||
(
|
(
|
||||||
cat $OBJ/sshd_proxy_bak
|
printf 'cert-authority,principals="gregorsamsa" '
|
||||||
echo "UsePrivilegeSeparation $privsep"
|
cat $OBJ/user_ca_key.pub
|
||||||
) > $OBJ/sshd_proxy
|
) > $OBJ/authorized_keys_$USER
|
||||||
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
|
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
fail "ssh cert connect succeeded unexpectedly"
|
||||||
|
fi
|
||||||
|
|
||||||
# Wrong principals list
|
# Correct principals list
|
||||||
verbose "$tid: ${_prefix} wrong principals key option"
|
verbose "$tid: ${_prefix} correct principals key option"
|
||||||
(
|
(
|
||||||
printf 'cert-authority,principals="gregorsamsa" '
|
printf 'cert-authority,principals="mekmitasdigoat" '
|
||||||
cat $OBJ/user_ca_key.pub
|
cat $OBJ/user_ca_key.pub
|
||||||
) > $OBJ/authorized_keys_$USER
|
) > $OBJ/authorized_keys_$USER
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
${SSH} -2i $OBJ/cert_user_key \
|
||||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||||
if [ $? -eq 0 ]; then
|
if [ $? -ne 0 ]; then
|
||||||
fail "ssh cert connect succeeded unexpectedly"
|
fail "ssh cert connect failed"
|
||||||
fi
|
fi
|
||||||
|
done
|
||||||
# Correct principals list
|
else
|
||||||
verbose "$tid: ${_prefix} correct principals key option"
|
echo "SKIPPED: $PRINCIPALS_COMMAND not executable " \
|
||||||
(
|
"(/var/run mounted noexec?)"
|
||||||
printf 'cert-authority,principals="mekmitasdigoat" '
|
fi
|
||||||
cat $OBJ/user_ca_key.pub
|
|
||||||
) > $OBJ/authorized_keys_$USER
|
|
||||||
${SSH} -2i $OBJ/cert_user_key \
|
|
||||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
|
||||||
if [ $? -ne 0 ]; then
|
|
||||||
fail "ssh cert connect failed"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue