avoid use of SHA-1

refactor producing samizdat-ssh-uid

1 files changed, 35 insertions, 34 deletions

diff --git a/src/samizdat-ssh-command b/src/samizdat-ssh-command
index 94679f2..79053fd 100755
--- a/src/samizdat-ssh-command
+++ b/src/samizdat-ssh-command
@@ -1,12 +1,21 @@
 #!/bin/dash
+default_command="$HOME/samizdat-default-command"
+if ! [ "$default_command" ] || ! [ -e "$default_command" ]
+then
+  default_command=password_authentication
+fi
+
 authorize()
 {
-  local pkey line authorized_keys_line cmd
+  local authtype authdata forced_command comment authorized_keys_line
   [ "$SSH_USER_AUTH" -a -f "$SSH_USER_AUTH" ] || return
-  read pkey line < "$SSH_USER_AUTH" || return
-  [ "$pkey" = publickey ] || return
+  read authtype authdata < "$SSH_USER_AUTH" || return
+  [ "$authtype" = publickey ] || return
+
+  forced_command="command=\"${0} authorize-full-access\",no-port-forwarding"
+  comment="samizdat: password-authenticated from ${SSH_CONNECTION%% *}"
 
-  authorized_keys_line="$line samizdat: password-authenticated from ${SSH_CONNECTION%% *}"
+  authorized_keys_line="$forced_command $authdata $comment"
   sentinel='Samizdat - YES WE CAN'
 
   su - "$USER" -c 'mkdir -p "$HOME"/.ssh; touch "$HOME"/.ssh/authorized_keys' &&
@@ -14,6 +23,7 @@ authorize()
                       "$authorized_keys_line" \
                       "$HOME"/.ssh/authorized_keys
 }
+
 add_before_sentinel()
 {
     local sentinel="$1" add_me="$2" target="$3"
@@ -25,7 +35,7 @@ add_before_sentinel()
 password_authentication()
 {
   [ "$USER" ] || { echo 'Error: no $USER' >&2; exit 1; }
-  [ "$SSH_REMOTE_KEY" ] || { echo 'Error: no $SSH_REMOTE_KEY' >&2; exit 1; }
+  [ "$SSH_CLIENT_FINGERPRINT" ] || { echo 'Error: no $SSH_CLIENT_FINGERPRINT' >&2; exit 1; }
 
   tty=$(tty) && [ "$tty" != 'not a tty' ] || tty=
 
@@ -143,7 +153,7 @@ valid_new_public_repo()
 
 check_if_ssh_user_owns_repository()
 {
-  git --git-dir "$git_dir" config --get-all samizdat.anonymous-ssh-owner | grep -xqF "$SSH_REMOTE_FINGERPRINT_TRIMMED"
+  git --git-dir "$git_dir" config --get-all samizdat.anonymous-ssh-owner | grep -xqF "$SSH_CLIENT_FINGERPRINT"
 }
 ssh_user_owns_repository()
 {
@@ -165,11 +175,11 @@ is_public_repository()
 
 authorized()
 {
-  # TODO: check SSH_REMOTE_FINGERPRINT against a blacklist
+  # TODO: check SSH_CLIENT_FINGERPRINT against a blacklist
   ssh_user_owns_repository && return
   is_public_repository && return
   test "$(git --git-dir "$1" config --bool --get samizdat.allow-anonymous-access)" = true 2>/dev/null && return 0
-  # TODO: check SSH_REMOTE_FINGERPRINT against a whitelist
+  # TODO: check SSH_CLIENT_FINGERPRINT against a whitelist
 }
 
 maybe_initialize_heads()
@@ -197,31 +207,20 @@ if [ "$1" = "authorize-full-access" ]; then
     "")
       shell=$(getent passwd $USER|cut -d: -f7)
       argv0=-${shell##*/}
-      exec chpst -b "$argv0" "$shell"
+      if which chpst >/dev/null 2>&1; then
+        exec chpst -b "$argv0" "$shell"
+      else
+        exec "$shell"
+      fi
     ;;
     *)
       exec /bin/sh -c "$SSH_ORIGINAL_COMMAND"
     ;;
   esac
+  exit
 fi
 
-
-(exec >&2
-#env | grep '^SSH_'
-#cat "${SSH_USER_AUTH}"
-#ssh-keygen -l -f "${SSH_USER_AUTH}"
-#sed -i -e 's/^publickey //' "${SSH_USER_AUTH}"
-#set -x
-#ssh-keygen -r . -f "${SSH_USER_AUTH}" | sed -ne 's/^. IN SSHFP [0-9]* 1 /SHA1:/p'
-)
-
-USE_MD5_SIG=
-if [ "$USE_MD5_SIG" ]; then
-  SSH_REMOTE_FINGERPRINT_TRIMMED=$(echo $SSH_REMOTE_FINGERPRINT|tr -d :)
-else
-  sed -i -e 's/^publickey //' "${SSH_USER_AUTH}" || die "error rewriting SSH_USER_AUTH file"
-  SSH_REMOTE_FINGERPRINT_TRIMMED=$(ssh-keygen -r . -f "${SSH_USER_AUTH}" | sed -ne 's/^. IN SSHFP [0-9]* 1 //p')
-fi
+eval "$(samizdat-ssh-uid)" || die eval
 
 # TODO: call password_authentication on all authorization failures
 
@@ -262,14 +261,15 @@ case "$SSH_ORIGINAL_COMMAND" in
     exit 1
   ;;
   rsync\ --server\ *)
-    [ -d "$HOME"/incoming_rsync -a "${SSH_REMOTE_FINGERPRINT_TRIMMED}" ] || { password_authentication; exit 1; }
-    destdir=$HOME/incoming_rsync/$SSH_REMOTE_FINGERPRINT_TRIMMED/
+    [ -d "$HOME"/incoming_rsync -a "${SSH_CLIENT_FINGERPRINT}" ] || { password_authentication; exit 1; }
+    destdir=$HOME/incoming_rsync/$SSH_CLIENT_FINGERPRINT/
     mkdir -p "$destdir" && exec rrsync "$destdir"
     exit 1
   ;;
   *)
-    password_authentication
-    exit 1 # unreached
+    #password_authentication
+    $default_command
+    exit
   ;;
 esac
 
@@ -293,7 +293,7 @@ elif [ "$git_cmd" = 'git-receive-pack' ]; then
 
   if [ ! -d "$git_dir" ]; then
     if valid_new_public_repo "$git_dir"; then
-      initialize_git "$git_dir" "$SSH_REMOTE_FINGERPRINT_TRIMMED"
+      initialize_git "$git_dir" "$SSH_CLIENT_FINGERPRINT"
     else
       deny
     fi
@@ -305,13 +305,14 @@ if authorized "$git_dir"; then
   if [ "$git_cmd" = 'git-receive-pack' ]; then
     if ! ssh_user_owns_repository
     then
-      export GIT_NAMESPACE="$SSH_REMOTE_FINGERPRINT_TRIMMED"
+      export GIT_NAMESPACE="$SSH_CLIENT_FINGERPRINT"
       maybe_initialize_heads
       printf '%s:%s\n' 'd@cryptonomic.net' "git_namespace/$GIT_NAMESPACE/${git_dir#${HOME}/}" >&2
     fi
   fi
   exec "$git_cmd" "$git_dir"
 else
-  password_authentication
-  echo 'Error: git access is unauthorized' >&2; exit 1 # unreached
+  $default_command
+  exit
+  # echo 'Error: git access is unauthorized' >&2; exit 1 # unreached
 fi