diff options
Diffstat (limited to 'regress/limit-keytype.sh')
-rw-r--r-- | regress/limit-keytype.sh | 19 |
1 files changed, 9 insertions, 10 deletions
diff --git a/regress/limit-keytype.sh b/regress/limit-keytype.sh index 2de037bd1..aaf2d2d44 100644 --- a/regress/limit-keytype.sh +++ b/regress/limit-keytype.sh | |||
@@ -1,4 +1,4 @@ | |||
1 | # $OpenBSD: limit-keytype.sh,v 1.1 2015/01/13 07:49:49 djm Exp $ | 1 | # $OpenBSD: limit-keytype.sh,v 1.2 2015/09/24 06:16:53 djm Exp $ |
2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
3 | 3 | ||
4 | tid="restrict pubkey type" | 4 | tid="restrict pubkey type" |
@@ -26,12 +26,11 @@ ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \ | |||
26 | # Copy the private key alongside the cert to allow better control of when | 26 | # Copy the private key alongside the cert to allow better control of when |
27 | # it is offered. | 27 | # it is offered. |
28 | mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub | 28 | mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub |
29 | cp -p $OBJ/user_key3 $OBJ/cert_user_key3 | ||
30 | 29 | ||
31 | grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy | 30 | grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy |
32 | 31 | ||
33 | opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes" | 32 | opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes" |
34 | fullopts="$opts -i $OBJ/cert_user_key3 -i $OBJ/user_key1 -i $OBJ/user_key2" | 33 | certopts="$opts -i $OBJ/user_key3 -oCertificateFile=$OBJ/cert_user_key3.pub" |
35 | 34 | ||
36 | echo mekmitasdigoat > $OBJ/authorized_principals_$USER | 35 | echo mekmitasdigoat > $OBJ/authorized_principals_$USER |
37 | cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER | 36 | cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER |
@@ -53,28 +52,28 @@ prepare_config() { | |||
53 | prepare_config | 52 | prepare_config |
54 | 53 | ||
55 | # Check we can log in with all key types. | 54 | # Check we can log in with all key types. |
56 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed" | 55 | ${SSH} $certopts proxy true || fatal "cert failed" |
57 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" | 56 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" |
58 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" | 57 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" |
59 | 58 | ||
60 | # Allow plain Ed25519 and RSA. The certificate should fail. | 59 | # Allow plain Ed25519 and RSA. The certificate should fail. |
61 | verbose "privsep=$privsep allow rsa,ed25519" | 60 | verbose "allow rsa,ed25519" |
62 | prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519" | 61 | prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519" |
63 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded" | 62 | ${SSH} $certopt proxy true && fatal "cert succeeded" |
64 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" | 63 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" |
65 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" | 64 | ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" |
66 | 65 | ||
67 | # Allow Ed25519 only. | 66 | # Allow Ed25519 only. |
68 | verbose "privsep=$privsep allow ed25519" | 67 | verbose "allow ed25519" |
69 | prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519" | 68 | prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519" |
70 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded" | 69 | ${SSH} $certopts proxy true && fatal "cert succeeded" |
71 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" | 70 | ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" |
72 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" | 71 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" |
73 | 72 | ||
74 | # Allow all certs. Plain keys should fail. | 73 | # Allow all certs. Plain keys should fail. |
75 | verbose "privsep=$privsep allow cert only" | 74 | verbose "allow cert only" |
76 | prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01@openssh.com" | 75 | prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01@openssh.com" |
77 | ${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed" | 76 | ${SSH} $certopts proxy true || fatal "cert failed" |
78 | ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded" | 77 | ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded" |
79 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" | 78 | ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" |
80 | 79 | ||