hostkey-agent.sh revision 323134 
1#	$OpenBSD: hostkey-agent.sh,v 1.6 2015/07/10 06:23:25 markus Exp $
2#	Placed in the Public Domain.
3
4tid="hostkey agent"
5
6rm -f $OBJ/agent-key.* $OBJ/ssh_proxy.orig $OBJ/known_hosts.orig
7
8trace "start agent"
9eval `${SSHAGENT} -s` > /dev/null
10r=$?
11[ $r -ne 0 ] && fatal "could not start ssh-agent: exit code $r"
12
13grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
14echo "HostKeyAgent $SSH_AUTH_SOCK" >> $OBJ/sshd_proxy.orig
15
16trace "load hostkeys"
17for k in `${SSH} -Q key-plain` ; do
18	${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
19	(
20		printf 'localhost-with-alias,127.0.0.1,::1 '
21		cat $OBJ/agent-key.$k.pub
22	) >> $OBJ/known_hosts.orig
23	${SSHADD} $OBJ/agent-key.$k >/dev/null 2>&1 || \
24		fatal "couldn't load key $OBJ/agent-key.$k"
25	echo "Hostkey $OBJ/agent-key.${k}" >> $OBJ/sshd_proxy.orig
26	# Remove private key so the server can't use it.
27	rm $OBJ/agent-key.$k || fatal "couldn't rm $OBJ/agent-key.$k"
28done
29cp $OBJ/known_hosts.orig $OBJ/known_hosts
30
31unset SSH_AUTH_SOCK
32
33for ps in no yes; do
34	for k in `${SSH} -Q key-plain` ; do
35		verbose "key type $k privsep=$ps"
36		cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
37		echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
38		echo "HostKeyAlgorithms $k" >> $OBJ/sshd_proxy
39		opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
40		cp $OBJ/known_hosts.orig $OBJ/known_hosts
41		SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
42		if [ $? -ne 0 ]; then
43			fail "protocol $p privsep=$ps failed"
44		fi
45		if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
46			fail "bad SSH_CONNECTION key type $k privsep=$ps"
47		fi
48	done
49done
50
51trace "kill agent"
52${SSHAGENT} -k > /dev/null
53
54