key-options.sh revision 1.4
1# $OpenBSD: key-options.sh,v 1.4 2017/04/30 23:34:55 djm Exp $ 2# Placed in the Public Domain. 3 4tid="key options" 5 6origkeys="$OBJ/authkeys_orig" 7authkeys="$OBJ/authorized_keys_${USER}" 8cp $authkeys $origkeys 9 10# Test command= forced command 11for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do 12 sed "s/.*/$c &/" $origkeys >$authkeys 13 verbose "key option $c" 14 r=`${SSH} -q -F $OBJ/ssh_proxy somehost echo foo` 15 if [ "$r" = "foo" ]; then 16 fail "key option forced command not restricted" 17 fi 18 if [ "$r" != "bar" ]; then 19 fail "key option forced command not executed" 20 fi 21done 22 23# Test no-pty 24sed 's/.*/no-pty &/' $origkeys >$authkeys 25verbose "key option proto no-pty" 26r=`${SSH} -q -F $OBJ/ssh_proxy somehost tty` 27if [ -f "$r" ]; then 28 fail "key option failed no-pty (pty $r)" 29fi 30 31# Test environment= 32echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy 33sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys 34verbose "key option environment" 35r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo $FOO'` 36if [ "$r" != "bar" ]; then 37 fail "key option environment not set" 38fi 39 40# Test from= restriction 41start_sshd 42for f in 127.0.0.1 '127.0.0.0\/8'; do 43 cat $origkeys >$authkeys 44 ${SSH} -q -F $OBJ/ssh_proxy somehost true 45 if [ $? -ne 0 ]; then 46 fail "key option failed without restriction" 47 fi 48 49 sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys 50 from=`head -1 $authkeys | cut -f1 -d ' '` 51 verbose "key option $from" 52 r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'` 53 if [ "$r" = "true" ]; then 54 fail "key option $from not restricted" 55 fi 56 57 r=`${SSH} -q -F $OBJ/ssh_config somehost 'echo true'` 58 if [ "$r" != "true" ]; then 59 fail "key option $from not allowed but should be" 60 fi 61done 62 63rm -f "$origkeys" 64