avoid use of SHA-1

refactor producing samizdat-ssh-uid

3 files changed, 131 insertions, 66 deletions

diff --git a/src/dyndns-command.sh b/src/dyndns-command.sh
index 1061b31..8530058 100755
--- a/src/dyndns-command.sh
+++ b/src/dyndns-command.sh
@@ -1,24 +1,24 @@
 #!/bin/bash
-subdomain=${SSH_REMOTE_FINGERPRINT//:/}
-ip_address=${SSH_CLIENT%% *}
-lan_address="$SSH_ORIGINAL_COMMAND"
 
-domain=ssh.cryptonomic.net 
+die() { printf '%s\n' "$*" >&2; exit 1; }
 
-sqlescape()
+sql_string()
 {
-        printf '%s' "'${1/\'/\'\'}'"
+        printf '%s' "'${1//\'/\'\'}'"
 }
 
-add()
+powerdns_sqlite_add_replace_record()
 {
-        local newdomain="$(sqlescape "$1.$domain")" ip_address="$(sqlescape "$2")" domain="$(sqlescape "$domain")"
+        local sql_new_domain="$(sql_string "$1.$3")"
+        local sql_ip_address="$(sql_string "$2")"
+        local sql_domain="$(sql_string "$3")"
+        local record_type="$(sql_string "$4")"
 
         sqlite3 /etc/powerdns/powerdns.sqlite3 <<END
 BEGIN;
-        delete from records where type='A' and name=$newdomain;
+        DELETE FROM records WHERE type=$record_type AND name=$sql_new_domain;
 
-        insert into records
+        INSERT INTO records
 
                 (domain_id,
                 name,
@@ -27,33 +27,58 @@ BEGIN;
                 ttl,
                 prio)
 
-                select
+                SELECT
                         id,
-                        $newdomain,
-                        'A',
-                        $ip_address,
+                        $sql_new_domain,
+                        $record_type,
+                        $sql_ip_address,
                         3600,
                         0
-                from domains
-                where name=$domain;
+                FROM domains
+                WHERE name=$sql_domain;
 COMMIT;
 END
-        if [ $? = 0 ]; then
-                printf '%s\n' "$1 $2"
-        fi
 }
 
-add "$subdomain" "$ip_address"
-
-set -- $lan_address
-while [ $# -ge 2 ]; do
-        d=$1
-        ip=$2
-        shift 2
-        
-        case "$d" in
-                *.*) continue;;
+add()
+{
+        local record_type
+        case "$2" in
+                *.*.*.*) record_type=A ;;
+                *:*) record_type=AAAA ;;
+                *) exit 1 ;;
         esac
-        
-        add "$d.$subdomain" "$ip"
-done
+
+        powerdns_sqlite_add_replace_record "$1" "$2" "$domain" "$record_type" \
+        && printf '%s %s\n' "$1.$domain $2"
+}
+
+main()
+{
+        add "$subdomain" "$ip_address"
+
+        set -- $SSH_ORIGINAL_COMMAND
+        while [ $# -ge 2 ]; do
+                d=$1
+                ip=$2
+                shift 2
+
+                case "$d" in
+                        *.*) continue;;
+                esac
+
+                add "$d.$subdomain" "$ip"
+        done
+}
+
+PEM_DEST=$HOME/public_rsync
+
+PATH=$HOME/bin:$PATH
+
+eval "$(samizdat-ssh-uid --copy-pem "$PEM_DEST")"
+
+domain=${SSH_CLIENT_DOMAIN}
+subdomain=${SSH_CLIENT_FINGERPRINT}
+ip_address=${SSH_CLIENT%% *}
+
+main "$@"
diff --git a/src/samizdat-ssh-command b/src/samizdat-ssh-command
index 94679f2..79053fd 100755
--- a/src/samizdat-ssh-command
+++ b/src/samizdat-ssh-command
@@ -1,12 +1,21 @@
 #!/bin/dash
+default_command="$HOME/samizdat-default-command"
+if ! [ "$default_command" ] || ! [ -e "$default_command" ]
+then
+  default_command=password_authentication
+fi
+
 authorize()
 {
-  local pkey line authorized_keys_line cmd
+  local authtype authdata forced_command comment authorized_keys_line
   [ "$SSH_USER_AUTH" -a -f "$SSH_USER_AUTH" ] || return
-  read pkey line < "$SSH_USER_AUTH" || return
-  [ "$pkey" = publickey ] || return
+  read authtype authdata < "$SSH_USER_AUTH" || return
+  [ "$authtype" = publickey ] || return
+
+  forced_command="command=\"${0} authorize-full-access\",no-port-forwarding"
+  comment="samizdat: password-authenticated from ${SSH_CONNECTION%% *}"
 
-  authorized_keys_line="$line samizdat: password-authenticated from ${SSH_CONNECTION%% *}"
+  authorized_keys_line="$forced_command $authdata $comment"
   sentinel='Samizdat - YES WE CAN'
 
   su - "$USER" -c 'mkdir -p "$HOME"/.ssh; touch "$HOME"/.ssh/authorized_keys' &&
@@ -14,6 +23,7 @@ authorize()
                       "$authorized_keys_line" \
                       "$HOME"/.ssh/authorized_keys
 }
+
 add_before_sentinel()
 {
     local sentinel="$1" add_me="$2" target="$3"
@@ -25,7 +35,7 @@ add_before_sentinel()
 password_authentication()
 {
   [ "$USER" ] || { echo 'Error: no $USER' >&2; exit 1; }
-  [ "$SSH_REMOTE_KEY" ] || { echo 'Error: no $SSH_REMOTE_KEY' >&2; exit 1; }
+  [ "$SSH_CLIENT_FINGERPRINT" ] || { echo 'Error: no $SSH_CLIENT_FINGERPRINT' >&2; exit 1; }
 
   tty=$(tty) && [ "$tty" != 'not a tty' ] || tty=
 
@@ -143,7 +153,7 @@ valid_new_public_repo()
 
 check_if_ssh_user_owns_repository()
 {
-  git --git-dir "$git_dir" config --get-all samizdat.anonymous-ssh-owner | grep -xqF "$SSH_REMOTE_FINGERPRINT_TRIMMED"
+  git --git-dir "$git_dir" config --get-all samizdat.anonymous-ssh-owner | grep -xqF "$SSH_CLIENT_FINGERPRINT"
 }
 ssh_user_owns_repository()
 {
@@ -165,11 +175,11 @@ is_public_repository()
 
 authorized()
 {
-  # TODO: check SSH_REMOTE_FINGERPRINT against a blacklist
+  # TODO: check SSH_CLIENT_FINGERPRINT against a blacklist
   ssh_user_owns_repository && return
   is_public_repository && return
   test "$(git --git-dir "$1" config --bool --get samizdat.allow-anonymous-access)" = true 2>/dev/null && return 0
-  # TODO: check SSH_REMOTE_FINGERPRINT against a whitelist
+  # TODO: check SSH_CLIENT_FINGERPRINT against a whitelist
 }
 
 maybe_initialize_heads()
@@ -197,31 +207,20 @@ if [ "$1" = "authorize-full-access" ]; then
     "")
       shell=$(getent passwd $USER|cut -d: -f7)
       argv0=-${shell##*/}
-      exec chpst -b "$argv0" "$shell"
+      if which chpst >/dev/null 2>&1; then
+        exec chpst -b "$argv0" "$shell"
+      else
+        exec "$shell"
+      fi
     ;;
     *)
       exec /bin/sh -c "$SSH_ORIGINAL_COMMAND"
     ;;
   esac
+  exit
 fi
 
-
-(exec >&2
-#env | grep '^SSH_'
-#cat "${SSH_USER_AUTH}"
-#ssh-keygen -l -f "${SSH_USER_AUTH}"
-#sed -i -e 's/^publickey //' "${SSH_USER_AUTH}"
-#set -x
-#ssh-keygen -r . -f "${SSH_USER_AUTH}" | sed -ne 's/^. IN SSHFP [0-9]* 1 /SHA1:/p'
-)
-
-USE_MD5_SIG=
-if [ "$USE_MD5_SIG" ]; then
-  SSH_REMOTE_FINGERPRINT_TRIMMED=$(echo $SSH_REMOTE_FINGERPRINT|tr -d :)
-else
-  sed -i -e 's/^publickey //' "${SSH_USER_AUTH}" || die "error rewriting SSH_USER_AUTH file"
-  SSH_REMOTE_FINGERPRINT_TRIMMED=$(ssh-keygen -r . -f "${SSH_USER_AUTH}" | sed -ne 's/^. IN SSHFP [0-9]* 1 //p')
-fi
+eval "$(samizdat-ssh-uid)" || die eval
 
 # TODO: call password_authentication on all authorization failures
 
@@ -262,14 +261,15 @@ case "$SSH_ORIGINAL_COMMAND" in
     exit 1
   ;;
   rsync\ --server\ *)
-    [ -d "$HOME"/incoming_rsync -a "${SSH_REMOTE_FINGERPRINT_TRIMMED}" ] || { password_authentication; exit 1; }
-    destdir=$HOME/incoming_rsync/$SSH_REMOTE_FINGERPRINT_TRIMMED/
+    [ -d "$HOME"/incoming_rsync -a "${SSH_CLIENT_FINGERPRINT}" ] || { password_authentication; exit 1; }
+    destdir=$HOME/incoming_rsync/$SSH_CLIENT_FINGERPRINT/
     mkdir -p "$destdir" && exec rrsync "$destdir"
     exit 1
   ;;
   *)
-    password_authentication
-    exit 1 # unreached
+    #password_authentication
+    $default_command
+    exit
   ;;
 esac
 
@@ -293,7 +293,7 @@ elif [ "$git_cmd" = 'git-receive-pack' ]; then
 
   if [ ! -d "$git_dir" ]; then
     if valid_new_public_repo "$git_dir"; then
-      initialize_git "$git_dir" "$SSH_REMOTE_FINGERPRINT_TRIMMED"
+      initialize_git "$git_dir" "$SSH_CLIENT_FINGERPRINT"
     else
       deny
     fi
@@ -305,13 +305,14 @@ if authorized "$git_dir"; then
   if [ "$git_cmd" = 'git-receive-pack' ]; then
     if ! ssh_user_owns_repository
     then
-      export GIT_NAMESPACE="$SSH_REMOTE_FINGERPRINT_TRIMMED"
+      export GIT_NAMESPACE="$SSH_CLIENT_FINGERPRINT"
       maybe_initialize_heads
       printf '%s:%s\n' 'd@cryptonomic.net' "git_namespace/$GIT_NAMESPACE/${git_dir#${HOME}/}" >&2
     fi
   fi
   exec "$git_cmd" "$git_dir"
 else
-  password_authentication
-  echo 'Error: git access is unauthorized' >&2; exit 1 # unreached
+  $default_command
+  exit
+  # echo 'Error: git access is unauthorized' >&2; exit 1 # unreached
 fi
diff --git a/src/samizdat-ssh-uid b/src/samizdat-ssh-uid
new file mode 100755
index 0000000..c87232b
--- /dev/null
+++ b/src/samizdat-ssh-uid
@@ -0,0 +1,39 @@
+#!/bin/dash
+
+die() { echo "$0: Error: $*" >&2; exit 1; }
+
+[ "$SSH_USER_AUTH" ] || die "not defined: \$SSH_USER_AUTH"
+[ -f "$SSH_USER_AUTH" ] || die "file does not exist: \$SSH_USER_AUTH=${SSH_USER_AUTH}"
+
+PEMFILE="${SSH_USER_AUTH}.tmp"
+
+sed -ne 's/^publickey //p' < "${SSH_USER_AUTH}" > "${PEMFILE}" || die "could not rewrite SSH_USER_AUTH file"
+
+SSH_CLIENT_FINGERPRINT=$(ssh-keygen -r . -f "${PEMFILE}" | sed -ne 's/^. IN SSHFP [0-9]* 1 //p') &&
+  [ "$SSH_CLIENT_FINGERPRINT" ] || die "could not determine ssh client fingerprint"
+
+read keytype keydata < "${PEMFILE}" || die "reading from PEMFILE=$PEMFILE"
+case "$keytype" in
+        ssh-rsa|ssh-dss|ecdsa-sha2-nistp256|ssh-ed25519)
+                domain=$keytype.cryptonomic.net ;;
+        *)
+                die "Unsupported key type: $keytype" ;;
+esac
+
+if [ "$1" = '--copy-pem' -a "$2" ]
+then
+  if [ -d "$2" ] || mkdir "$2"
+  then
+    mv "${PEMFILE}" "$2"/${SSH_CLIENT_FINGERPRINT}.${keytype}.pem
+  fi
+else
+  rm -f "${PEMFILE}"
+fi
+
+env -i \
+  SSH_CLIENT_FINGERPRINT="$SSH_CLIENT_FINGERPRINT" \
+  SSH_CLIENT_KEYTYPE="$keytype" \
+  SSH_CLIENT_DOMAIN="$domain" \
+  SSH_CLIENT_PEMFILE="$PEMFILE" \
+  SSH_CLIENT_KEYDATA="$keydata"
+