diff options
Diffstat (limited to 'regress/hostkey-rotate.sh')
-rw-r--r-- | regress/hostkey-rotate.sh | 128 |
1 files changed, 128 insertions, 0 deletions
diff --git a/regress/hostkey-rotate.sh b/regress/hostkey-rotate.sh new file mode 100644 index 000000000..b5d542d12 --- /dev/null +++ b/regress/hostkey-rotate.sh | |||
@@ -0,0 +1,128 @@ | |||
1 | # $OpenBSD: hostkey-rotate.sh,v 1.2 2015/03/03 17:53:40 djm Exp $ | ||
2 | # Placed in the Public Domain. | ||
3 | |||
4 | tid="hostkey rotate" | ||
5 | |||
6 | # Need full names here since they are used in HostKeyAlgorithms | ||
7 | HOSTKEY_TYPES="ecdsa-sha2-nistp256 ssh-ed25519 ssh-rsa ssh-dss" | ||
8 | |||
9 | rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig | ||
10 | |||
11 | grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig | ||
12 | echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy | ||
13 | rm $OBJ/known_hosts | ||
14 | |||
15 | trace "prepare hostkeys" | ||
16 | nkeys=0 | ||
17 | all_algs="" | ||
18 | for k in `ssh -Q key-plain` ; do | ||
19 | ${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k" | ||
20 | echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig | ||
21 | nkeys=`expr $nkeys + 1` | ||
22 | test "x$all_algs" = "x" || all_algs="${all_algs}," | ||
23 | all_algs="${all_algs}$k" | ||
24 | done | ||
25 | |||
26 | dossh() { | ||
27 | # All ssh should succeed in this test | ||
28 | ${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed" | ||
29 | } | ||
30 | |||
31 | expect_nkeys() { | ||
32 | _expected=$1 | ||
33 | _message=$2 | ||
34 | _n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed" | ||
35 | [ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)" | ||
36 | } | ||
37 | |||
38 | check_key_present() { | ||
39 | _type=$1 | ||
40 | _kfile=$2 | ||
41 | test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub" | ||
42 | _kpub=`awk "/$_type /"' { print $2 }' < $_kfile` || \ | ||
43 | fatal "awk failed" | ||
44 | fgrep "$_kpub" $OBJ/known_hosts > /dev/null | ||
45 | } | ||
46 | |||
47 | cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy | ||
48 | |||
49 | # Connect to sshd with StrictHostkeyChecking=no | ||
50 | verbose "learn hostkey with StrictHostKeyChecking=no" | ||
51 | >$OBJ/known_hosts | ||
52 | dossh -oHostKeyAlgorithms=ssh-ed25519 -oStrictHostKeyChecking=no | ||
53 | # Verify no additional keys learned | ||
54 | expect_nkeys 1 "unstrict connect keys" | ||
55 | check_key_present ssh-ed25519 || fail "unstrict didn't learn key" | ||
56 | |||
57 | # Connect to sshd as usual | ||
58 | verbose "learn additional hostkeys" | ||
59 | dossh -oStrictHostKeyChecking=yes | ||
60 | # Check that other keys learned | ||
61 | expect_nkeys $nkeys "learn hostkeys" | ||
62 | check_key_present ssh-rsa || fail "didn't learn keys" | ||
63 | |||
64 | # Check each key type | ||
65 | for k in `ssh -Q key-plain` ; do | ||
66 | verbose "learn additional hostkeys, type=$k" | ||
67 | dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs | ||
68 | expect_nkeys $nkeys "learn hostkeys $k" | ||
69 | check_key_present $k || fail "didn't learn $k" | ||
70 | done | ||
71 | |||
72 | # Change one hostkey (non primary) and relearn | ||
73 | verbose "learn changed non-primary hostkey" | ||
74 | mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old | ||
75 | rm -f $OBJ/hkr.ssh-rsa | ||
76 | ${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa -N '' || fatal "ssh-keygen $k" | ||
77 | dossh -oStrictHostKeyChecking=yes | ||
78 | # Check that the key was replaced | ||
79 | expect_nkeys $nkeys "learn hostkeys" | ||
80 | check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present" | ||
81 | check_key_present ssh-rsa || fail "didn't learn changed key" | ||
82 | |||
83 | # Add new hostkey (primary type) to sshd and connect | ||
84 | verbose "learn new primary hostkey" | ||
85 | ${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa-new -N '' || fatal "ssh-keygen $k" | ||
86 | ( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.ssh-rsa-new ) \ | ||
87 | > $OBJ/sshd_proxy | ||
88 | # Check new hostkey added | ||
89 | dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs | ||
90 | expect_nkeys `expr $nkeys + 1` "learn hostkeys" | ||
91 | check_key_present ssh-rsa || fail "current key missing" | ||
92 | check_key_present ssh-rsa $OBJ/hkr.ssh-rsa-new.pub || fail "new key missing" | ||
93 | |||
94 | # Remove old hostkey (primary type) from sshd | ||
95 | verbose "rotate primary hostkey" | ||
96 | cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy | ||
97 | mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old | ||
98 | mv $OBJ/hkr.ssh-rsa-new.pub $OBJ/hkr.ssh-rsa.pub | ||
99 | mv $OBJ/hkr.ssh-rsa-new $OBJ/hkr.ssh-rsa | ||
100 | # Check old hostkey removed | ||
101 | dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs | ||
102 | expect_nkeys $nkeys "learn hostkeys" | ||
103 | check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present" | ||
104 | check_key_present ssh-rsa || fail "didn't learn changed key" | ||
105 | |||
106 | # Connect again, forcing rotated key | ||
107 | verbose "check rotate primary hostkey" | ||
108 | dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa | ||
109 | expect_nkeys 1 "learn hostkeys" | ||
110 | check_key_present ssh-rsa || fail "didn't learn changed key" | ||
111 | |||
112 | # $OpenBSD: hostkey-rotate.sh,v 1.2 2015/03/03 17:53:40 djm Exp $ | ||
113 | # Placed in the Public Domain. | ||
114 | |||
115 | tid="hostkey rotate" | ||
116 | |||
117 | # Prepare hostkeys file with one key | ||
118 | |||
119 | # Connect to sshd | ||
120 | |||
121 | # Check that other keys learned | ||
122 | |||
123 | # Change one hostkey (non primary) | ||
124 | |||
125 | # Connect to sshd | ||
126 | |||
127 | # Check that the key was replaced | ||
128 | |||