hostkey-rotate.sh revision 1.1 
1#	$OpenBSD: hostkey-rotate.sh,v 1.1 2015/01/26 06:12:18 djm Exp $
2#	Placed in the Public Domain.
3
4tid="hostkey rotate"
5
6# Need full names here since they are used in HostKeyAlgorithms
7HOSTKEY_TYPES="ecdsa-sha2-nistp256 ssh-ed25519 ssh-rsa ssh-dss"
8
9rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig
10
11grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
12echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy
13rm $OBJ/known_hosts
14
15trace "prepare hostkeys"
16nkeys=0
17all_algs=""
18for k in `ssh -Q key-plain` ; do
19	${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k"
20	echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig
21	nkeys=`expr $nkeys + 1`
22	test "x$all_algs" = "x" || all_algs="${all_algs},"
23	all_algs="${all_algs}$k"
24done
25
26dossh() {
27	# All ssh should succeed in this test
28	${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed"
29}
30
31expect_nkeys() {
32	_expected=$1
33	_message=$2
34	_n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed"
35	[ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)"
36}
37
38check_key_present() {
39	_type=$1
40	_kfile=$2
41	_prog='print $2 " " $3'
42	test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub"
43	_ktext=`awk "/ $_type / { $_prog }" < $OBJ/known_hosts` || \
44		fatal "awk failed"
45	grep -q "$_ktext" $_kfile
46}
47
48cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
49
50# Connect to sshd with StrictHostkeyChecking=no
51verbose "learn hostkey with StrictHostKeyChecking=no"
52>$OBJ/known_hosts
53dossh -oHostKeyAlgorithms=ssh-ed25519 -oStrictHostKeyChecking=no
54# Verify no additional keys learned
55expect_nkeys 1 "unstrict connect keys"
56check_key_present ssh-ed25519 || fail "unstrict didn't learn key"
57
58# Connect to sshd as usual
59verbose "learn additional hostkeys"
60dossh -oStrictHostKeyChecking=yes
61# Check that other keys learned
62expect_nkeys $nkeys "learn hostkeys"
63check_key_present ssh-rsa || fail "didn't learn keys"
64
65# Check each key type
66for k in `ssh -Q key-plain` ; do
67	verbose "learn additional hostkeys, type=$k"
68	dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs
69	expect_nkeys $nkeys "learn hostkeys $k"
70	check_key_present $k || fail "didn't learn $k"
71done
72
73# Change one hostkey (non primary) and relearn
74verbose "learn changed non-primary hostkey"
75mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
76rm -f $OBJ/hkr.ssh-rsa
77${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa -N '' || fatal "ssh-keygen $k"
78dossh -oStrictHostKeyChecking=yes
79# Check that the key was replaced
80expect_nkeys $nkeys "learn hostkeys"
81check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
82check_key_present ssh-rsa || fail "didn't learn changed key"
83
84# Add new hostkey (primary type) to sshd and connect
85verbose "learn new primary hostkey"
86${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa-new -N '' || fatal "ssh-keygen $k"
87( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.ssh-rsa-new ) \
88    > $OBJ/sshd_proxy
89# Check new hostkey added
90dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
91expect_nkeys `expr $nkeys + 1` "learn hostkeys"
92check_key_present ssh-rsa || fail "current key missing"
93check_key_present ssh-rsa $OBJ/hkr.ssh-rsa-new.pub || fail "new key missing"
94
95# Remove old hostkey (primary type) from sshd
96verbose "rotate primary hostkey"
97cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
98mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
99mv $OBJ/hkr.ssh-rsa-new.pub $OBJ/hkr.ssh-rsa.pub
100mv $OBJ/hkr.ssh-rsa-new $OBJ/hkr.ssh-rsa
101# Check old hostkey removed
102dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
103expect_nkeys $nkeys "learn hostkeys"
104check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
105check_key_present ssh-rsa || fail "didn't learn changed key"
106
107# Connect again, forcing rotated key
108verbose "check rotate primary hostkey"
109dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
110expect_nkeys 1 "learn hostkeys"
111check_key_present ssh-rsa || fail "didn't learn changed key"
112
113#	$OpenBSD: hostkey-rotate.sh,v 1.1 2015/01/26 06:12:18 djm Exp $
114#	Placed in the Public Domain.
115
116tid="hostkey rotate"
117
118# Prepare hostkeys file with one key
119
120# Connect to sshd
121
122# Check that other keys learned
123
124# Change one hostkey (non primary)
125
126# Connect to sshd
127
128# Check that the key was replaced
129
130