hostkey-rotate.sh revision 323134 
1#	$OpenBSD: hostkey-rotate.sh,v 1.5 2015/09/04 04:23:10 djm Exp $
2#	Placed in the Public Domain.
3
4tid="hostkey rotate"
5
6# Need full names here since they are used in HostKeyAlgorithms
7HOSTKEY_TYPES="ecdsa-sha2-nistp256 ssh-ed25519 ssh-rsa ssh-dss"
8
9rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig
10
11grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
12echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy
13rm $OBJ/known_hosts
14
15trace "prepare hostkeys"
16nkeys=0
17all_algs=""
18for k in `${SSH} -Q key-plain` ; do
19	${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k"
20	echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig
21	nkeys=`expr $nkeys + 1`
22	test "x$all_algs" = "x" || all_algs="${all_algs},"
23	all_algs="${all_algs}$k"
24done
25
26dossh() {
27	# All ssh should succeed in this test
28	${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed"
29}
30
31expect_nkeys() {
32	_expected=$1
33	_message=$2
34	_n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed"
35	[ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)"
36}
37
38check_key_present() {
39	_type=$1
40	_kfile=$2
41	test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub"
42	_kpub=`awk "/$_type /"' { print $2 }' < $_kfile` || \
43		fatal "awk failed"
44	fgrep "$_kpub" $OBJ/known_hosts > /dev/null
45}
46
47cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
48
49# Connect to sshd with StrictHostkeyChecking=no
50verbose "learn hostkey with StrictHostKeyChecking=no"
51>$OBJ/known_hosts
52dossh -oHostKeyAlgorithms=ssh-ed25519 -oStrictHostKeyChecking=no
53# Verify no additional keys learned
54expect_nkeys 1 "unstrict connect keys"
55check_key_present ssh-ed25519 || fail "unstrict didn't learn key"
56
57# Connect to sshd as usual
58verbose "learn additional hostkeys"
59dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
60# Check that other keys learned
61expect_nkeys $nkeys "learn hostkeys"
62check_key_present ssh-rsa || fail "didn't learn keys"
63
64# Check each key type
65for k in `${SSH} -Q key-plain` ; do
66	verbose "learn additional hostkeys, type=$k"
67	dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs
68	expect_nkeys $nkeys "learn hostkeys $k"
69	check_key_present $k || fail "didn't learn $k"
70done
71
72# Change one hostkey (non primary) and relearn
73verbose "learn changed non-primary hostkey"
74mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
75rm -f $OBJ/hkr.ssh-rsa
76${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa -N '' || fatal "ssh-keygen $k"
77dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
78# Check that the key was replaced
79expect_nkeys $nkeys "learn hostkeys"
80check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
81check_key_present ssh-rsa || fail "didn't learn changed key"
82
83# Add new hostkey (primary type) to sshd and connect
84verbose "learn new primary hostkey"
85${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa-new -N '' || fatal "ssh-keygen $k"
86( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.ssh-rsa-new ) \
87    > $OBJ/sshd_proxy
88# Check new hostkey added
89dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
90expect_nkeys `expr $nkeys + 1` "learn hostkeys"
91check_key_present ssh-rsa || fail "current key missing"
92check_key_present ssh-rsa $OBJ/hkr.ssh-rsa-new.pub || fail "new key missing"
93
94# Remove old hostkey (primary type) from sshd
95verbose "rotate primary hostkey"
96cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
97mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
98mv $OBJ/hkr.ssh-rsa-new.pub $OBJ/hkr.ssh-rsa.pub
99mv $OBJ/hkr.ssh-rsa-new $OBJ/hkr.ssh-rsa
100# Check old hostkey removed
101dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
102expect_nkeys $nkeys "learn hostkeys"
103check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
104check_key_present ssh-rsa || fail "didn't learn changed key"
105
106# Connect again, forcing rotated key
107verbose "check rotate primary hostkey"
108dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
109expect_nkeys 1 "learn hostkeys"
110check_key_present ssh-rsa || fail "didn't learn changed key"
111