key-options.sh revision 1.4 
1#	$OpenBSD: key-options.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
2#	Placed in the Public Domain.
3
4tid="key options"
5
6origkeys="$OBJ/authkeys_orig"
7authkeys="$OBJ/authorized_keys_${USER}"
8cp $authkeys $origkeys
9
10# Test command= forced command
11for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
12	sed "s/.*/$c &/" $origkeys >$authkeys
13	verbose "key option $c"
14	r=`${SSH} -q -F $OBJ/ssh_proxy somehost echo foo`
15	if [ "$r" = "foo" ]; then
16		fail "key option forced command not restricted"
17	fi
18	if [ "$r" != "bar" ]; then
19		fail "key option forced command not executed"
20	fi
21done
22
23# Test no-pty
24sed 's/.*/no-pty &/' $origkeys >$authkeys
25verbose "key option proto no-pty"
26r=`${SSH} -q -F $OBJ/ssh_proxy somehost tty`
27if [ -f "$r" ]; then
28	fail "key option failed no-pty (pty $r)"
29fi
30
31# Test environment=
32echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy
33sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys
34verbose "key option environment"
35r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
36if [ "$r" != "bar" ]; then
37	fail "key option environment not set"
38fi
39
40# Test from= restriction
41start_sshd
42for f in 127.0.0.1 '127.0.0.0\/8'; do
43	cat  $origkeys >$authkeys
44	${SSH} -q -F $OBJ/ssh_proxy somehost true
45	if [ $? -ne 0 ]; then
46		fail "key option failed without restriction"
47	fi
48
49	sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys
50	from=`head -1 $authkeys | cut -f1 -d ' '`
51	verbose "key option $from"
52	r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'`
53	if [ "$r" = "true" ]; then
54		fail "key option $from not restricted"
55	fi
56
57	r=`${SSH} -q -F $OBJ/ssh_config somehost 'echo true'`
58	if [ "$r" != "true" ]; then
59		fail "key option $from not allowed but should be"
60	fi
61done
62
63rm -f "$origkeys"
64