hostkey-rotate.sh revision 1.10
1# $OpenBSD: hostkey-rotate.sh,v 1.10 2022/01/05 08:25:05 djm Exp $ 2# Placed in the Public Domain. 3 4tid="hostkey rotate" 5 6rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig $OBJ/ssh_proxy.orig 7 8grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig 9mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig 10grep -vi 'globalknownhostsfile' $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy 11echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy 12echo "GlobalKnownHostsFile=none" >> $OBJ/ssh_proxy 13rm $OBJ/known_hosts 14 15# The "primary" key type is ed25519 since it's supported even when built 16# without OpenSSL. The secondary is RSA if it's supported. 17primary="ssh-ed25519" 18secondary="$primary" 19 20trace "prepare hostkeys" 21nkeys=0 22all_algs="" 23for k in $SSH_HOSTKEY_TYPES; do 24 ${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k" 25 echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig 26 nkeys=`expr $nkeys + 1` 27 test "x$all_algs" = "x" || all_algs="${all_algs}," 28 case "$k" in 29 ssh-rsa) 30 secondary="ssh-rsa" 31 all_algs="${all_algs}rsa-sha2-256,rsa-sha2-512,$k" 32 ;; 33 *) 34 all_algs="${all_algs}$k" 35 ;; 36 esac 37done 38 39dossh() { 40 # All ssh should succeed in this test 41 ${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed" 42} 43 44expect_nkeys() { 45 _expected=$1 46 _message=$2 47 _n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed" 48 [ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)" 49} 50 51check_key_present() { 52 _type=$1 53 _kfile=$2 54 test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub" 55 _kpub=`awk "/$_type /"' { print $2 }' < $_kfile` || \ 56 fatal "awk failed" 57 fgrep "$_kpub" $OBJ/known_hosts > /dev/null 58} 59 60cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy 61 62# Connect to sshd with StrictHostkeyChecking=no 63verbose "learn hostkey with StrictHostKeyChecking=no" 64>$OBJ/known_hosts 65dossh -oHostKeyAlgorithms=$primary -oStrictHostKeyChecking=no 66# Verify no additional keys learned 67expect_nkeys 1 "unstrict connect keys" 68check_key_present $primary || fail "unstrict didn't learn key" 69 70# Connect to sshd as usual 71verbose "learn additional hostkeys" 72dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs 73# Check that other keys learned 74expect_nkeys $nkeys "learn hostkeys" 75for k in $SSH_HOSTKEY_TYPES; do 76 check_key_present $k || fail "didn't learn keytype $k" 77done 78 79# Check each key type 80for k in $SSH_HOSTKEY_TYPES; do 81 case "$k" in 82 ssh-rsa) alg="rsa-sha2-256,rsa-sha2-512,ssh-rsa" ;; 83 *) alg="$k" ;; 84 esac 85 verbose "learn additional hostkeys, type=$k" 86 dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$alg,$all_algs 87 expect_nkeys $nkeys "learn hostkeys $k" 88 check_key_present $k || fail "didn't learn $k correctly" 89done 90 91# Change one hostkey (non primary) and relearn 92if [ "$primary" != "$secondary" ]; then 93 verbose "learn changed non-primary hostkey type=${secondary}" 94 mv $OBJ/hkr.${secondary}.pub $OBJ/hkr.${secondary}.pub.old 95 rm -f $OBJ/hkr.${secondary} 96 ${SSHKEYGEN} -qt ${secondary} -f $OBJ/hkr.${secondary} -N '' || \ 97 fatal "ssh-keygen $secondary" 98 dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs 99 # Check that the key was replaced 100 expect_nkeys $nkeys "learn hostkeys" 101 check_key_present ${secondary} $OBJ/hkr.${secondary}.pub.old && \ 102 fail "old key present" 103 check_key_present ${secondary} || fail "didn't learn changed key" 104fi 105 106# Add new hostkey (primary type) to sshd and connect 107verbose "learn new primary hostkey" 108${SSHKEYGEN} -qt ${primary} -f $OBJ/hkr.${primary}-new -N '' || fatal "ssh-keygen ed25519" 109( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.${primary}-new ) \ 110 > $OBJ/sshd_proxy 111# Check new hostkey added 112dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=${primary},$all_algs 113expect_nkeys `expr $nkeys + 1` "learn hostkeys" 114check_key_present ${primary} || fail "current key missing" 115check_key_present ${primary} $OBJ/hkr.${primary}-new.pub || fail "new key missing" 116 117# Remove old hostkey (primary type) from sshd 118verbose "rotate primary hostkey" 119cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy 120mv $OBJ/hkr.${primary}.pub $OBJ/hkr.${primary}.pub.old 121mv $OBJ/hkr.${primary}-new.pub $OBJ/hkr.${primary}.pub 122mv $OBJ/hkr.${primary}-new $OBJ/hkr.${primary} 123# Check old hostkey removed 124dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=${primary},$all_algs 125expect_nkeys $nkeys "learn hostkeys" 126check_key_present ${primary} $OBJ/hkr.${primary}.pub.old && fail "old key present" 127check_key_present ${primary} || fail "didn't learn changed key" 128 129# Connect again, forcing rotated key 130verbose "check rotate primary hostkey" 131dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=${primary} 132expect_nkeys 1 "learn hostkeys" 133check_key_present ${primary} || fail "didn't learn changed key" 134