diff options
Diffstat (limited to 'regress/limit-keytype.sh')
-rw-r--r-- | regress/limit-keytype.sh | 37 |
1 files changed, 27 insertions, 10 deletions
diff --git a/regress/limit-keytype.sh b/regress/limit-keytype.sh index 2de037bd1..c0cf2fed6 100644 --- a/regress/limit-keytype.sh +++ b/regress/limit-keytype.sh | |||
@@ -1,4 +1,4 @@ | |||
1 | # $OpenBSD: limit-keytype.sh,v 1.1 2015/01/13 07:49:49 djm Exp $ | 1 | # $OpenBSD: limit-keytype.sh,v 1.4 2015/10/29 08:05:17 djm Exp $ |
2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
3 | 3 | ||
4 | tid="restrict pubkey type" | 4 | tid="restrict pubkey type" |
@@ -20,18 +20,19 @@ ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key2 || \ | |||
20 | fatal "ssh-keygen failed" | 20 | fatal "ssh-keygen failed" |
21 | ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key3 || \ | 21 | ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key3 || \ |
22 | fatal "ssh-keygen failed" | 22 | fatal "ssh-keygen failed" |
23 | ${SSHKEYGEN} -q -N '' -t dsa -f $OBJ/user_key4 || \ | ||
24 | fatal "ssh-keygen failed" | ||
23 | ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \ | 25 | ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \ |
24 | -z $$ -n ${USER},mekmitasdigoat $OBJ/user_key3 || | 26 | -z $$ -n ${USER},mekmitasdigoat $OBJ/user_key3 || |
25 | fatal "couldn't sign user_key1" | 27 | fatal "couldn't sign user_key1" |
26 | # Copy the private key alongside the cert to allow better control of when | 28 | # Copy the private key alongside the cert to allow better control of when |
27 | # it is offered. | 29 | # it is offered. |
28 | mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub | 30 | mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub |
29 | cp -p $OBJ/user_key3 $OBJ/cert_user_key3 | ||
30 | 31 | ||
31 | grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy | 32 | grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy |
32 | 33 | ||
33 | opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes" | 34 | opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes" |
34 | fullopts="$opts -i $OBJ/cert_user_key3 -i $OBJ/user_key1 -i $OBJ/user_key2" | 35 | certopts="$opts -i $OBJ/user_key3 -oCertificateFile=$OBJ/cert_user_key3.pub" |
35 | 36 | ||
36 | echo mekmitasdigoat > $OBJ/authorized_principals_$USER | 37 | echo mekmitasdigoat > $OBJ/authorized_principals_$USER |
37 | cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER | 38 | cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER |
@@ -53,28 +54,44 @@ prepare_config() { | |||
53 | prepare_config | 54 | prepare_config |
54 | 55 | ||
55 | # Check we can log in with all key types. | 56 | # Check we can log in with all key types. |
56 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed" | 57 | ${SSH} $certopts proxy true || fatal "cert failed" |
57 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" | 58 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" |
58 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" | 59 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" |
59 | 60 | ||
60 | # Allow plain Ed25519 and RSA. The certificate should fail. | 61 | # Allow plain Ed25519 and RSA. The certificate should fail. |
61 | verbose "privsep=$privsep allow rsa,ed25519" | 62 | verbose "allow rsa,ed25519" |
62 | prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519" | 63 | prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519" |
63 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded" | 64 | ${SSH} $certopts proxy true && fatal "cert succeeded" |
64 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" | 65 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" |
65 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" | 66 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" |
66 | 67 | ||
67 | # Allow Ed25519 only. | 68 | # Allow Ed25519 only. |
68 | verbose "privsep=$privsep allow ed25519" | 69 | verbose "allow ed25519" |
69 | prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519" | 70 | prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519" |
70 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded" | 71 | ${SSH} $certopts proxy true && fatal "cert succeeded" |
71 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" | 72 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" |
72 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" | 73 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" |
73 | 74 | ||
74 | # Allow all certs. Plain keys should fail. | 75 | # Allow all certs. Plain keys should fail. |
75 | verbose "privsep=$privsep allow cert only" | 76 | verbose "allow cert only" |
76 | prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01@openssh.com" | 77 | prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01@openssh.com" |
77 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed" | 78 | ${SSH} $certopts proxy true || fatal "cert failed" |
78 | ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded" | 79 | ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded" |
79 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" | 80 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" |
80 | 81 | ||
82 | # Allow RSA in main config, Ed25519 for non-existent user. | ||
83 | verbose "match w/ no match" | ||
84 | prepare_config "PubkeyAcceptedKeyTypes ssh-rsa" \ | ||
85 | "Match user x$USER" "PubkeyAcceptedKeyTypes +ssh-ed25519" | ||
86 | ${SSH} $certopts proxy true && fatal "cert succeeded" | ||
87 | ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded" | ||
88 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" | ||
89 | |||
90 | # Allow only DSA in main config, Ed25519 for user. | ||
91 | verbose "match w/ matching" | ||
92 | prepare_config "PubkeyAcceptedKeyTypes ssh-dss" \ | ||
93 | "Match user $USER" "PubkeyAcceptedKeyTypes +ssh-ed25519" | ||
94 | ${SSH} $certopts proxy true || fatal "cert failed" | ||
95 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" | ||
96 | ${SSH} $opts -i $OBJ/user_key4 proxy true && fatal "key4 succeeded" | ||
97 | |||