11305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# $OpenBSD: key-options.sh,v 1.2 2008/06/30 08:07:34 djm Exp $ 21305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# Placed in the Public Domain. 31305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 41305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodtid="key options" 51305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 61305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodorigkeys="$OBJ/authkeys_orig" 71305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodauthkeys="$OBJ/authorized_keys_${USER}" 81305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodcp $authkeys $origkeys 91305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 101305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# Test command= forced command 111305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodfor p in 1 2; do 121305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do 131305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood sed "s/.*/$c &/" $origkeys >$authkeys 141305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood verbose "key option proto $p $c" 151305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost echo foo` 161305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ "$r" = "foo" ]; then 171305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "key option forced command not restricted" 181305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 191305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ "$r" != "bar" ]; then 201305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "key option forced command not executed" 211305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 221305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood done 231305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwooddone 241305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 251305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# Test no-pty 261305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodsed 's/.*/no-pty &/' $origkeys >$authkeys 271305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodfor p in 1 2; do 281305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood verbose "key option proto $p no-pty" 291305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty` 301305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ -f "$r" ]; then 311305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "key option failed proto $p no-pty (pty $r)" 321305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 331305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwooddone 341305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 351305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# Test environment= 361305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodecho 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy 371305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodsed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys 381305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodfor p in 1 2; do 391305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood verbose "key option proto $p environment" 401305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'` 411305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ "$r" != "bar" ]; then 421305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "key option environment not set" 431305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 441305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwooddone 451305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 461305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# Test from= restriction 471305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodstart_sshd 481305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodfor p in 1 2; do 491305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood for f in 127.0.0.1 '127.0.0.0\/8'; do 501305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood cat $origkeys >$authkeys 511305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood ${SSH} -$p -q -F $OBJ/ssh_proxy somehost true 521305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ $? -ne 0 ]; then 531305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "key option proto $p failed without restriction" 541305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 551305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 561305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys 571305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood from=`head -1 $authkeys | cut -f1 -d ' '` 581305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood verbose "key option proto $p $from" 591305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'` 601305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ "$r" = "true" ]; then 611305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "key option proto $p $from not restricted" 621305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 631305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 641305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood r=`${SSH} -$p -q -F $OBJ/ssh_config somehost 'echo true'` 651305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ "$r" != "true" ]; then 661305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "key option proto $p $from not allowed but should be" 671305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 681305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood done 691305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwooddone 701305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 711305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrm -f "$origkeys" 72