key-options.sh revision 1.5
1# $OpenBSD: key-options.sh,v 1.5 2018/03/02 02:53:27 djm Exp $ 2# Placed in the Public Domain. 3 4tid="key options" 5 6origkeys="$OBJ/authkeys_orig" 7authkeys="$OBJ/authorized_keys_${USER}" 8cp $authkeys $origkeys 9 10# Test command= forced command 11for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do 12 sed "s/.*/$c &/" $origkeys >$authkeys 13 verbose "key option $c" 14 r=`${SSH} -q -F $OBJ/ssh_proxy somehost echo foo` 15 if [ "$r" = "foo" ]; then 16 fail "key option forced command not restricted" 17 fi 18 if [ "$r" != "bar" ]; then 19 fail "key option forced command not executed" 20 fi 21done 22 23# Test no-pty 24expect_pty_succeed() { 25 which=$1 26 opts=$2 27 rm -f $OBJ/data 28 sed "s/.*/$opts &/" $origkeys >$authkeys 29 verbose "key option pty $which" 30 ${SSH} -ttq -F $OBJ/ssh_proxy somehost "tty > $OBJ/data; exit 0" 31 if [ $? -ne 0 ] ; then 32 fail "key option failed $which" 33 else 34 r=`cat $OBJ/data` 35 if [ ! -e "$r" ]; then 36 fail "key option failed $which (pty $r)" 37 fi 38 fi 39} 40expect_pty_fail() { 41 which=$1 42 opts=$2 43 rm -f $OBJ/data 44 sed "s/.*/$opts &/" $origkeys >$authkeys 45 verbose "key option pty $which" 46 ${SSH} -ttq -F $OBJ/ssh_proxy somehost "tty > $OBJ/data; exit 0" 47 if [ $? -eq 0 ]; then 48 r=`cat $OBJ/data` 49 if [ -e "$r" ]; then 50 fail "key option failed $which (pty $r)" 51 fi 52 fi 53} 54# First ensure that we can allocate a pty by default. 55expect_pty_succeed "default" "" 56expect_pty_fail "no-pty" "no-pty" 57expect_pty_fail "restrict" "restrict" 58expect_pty_succeed "restrict,pty" "restrict,pty" 59 60# Test environment= 61echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy 62sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys 63verbose "key option environment" 64r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo $FOO'` 65if [ "$r" != "bar" ]; then 66 fail "key option environment not set" 67fi 68 69# Test from= restriction 70start_sshd 71for f in 127.0.0.1 '127.0.0.0\/8'; do 72 cat $origkeys >$authkeys 73 ${SSH} -q -F $OBJ/ssh_proxy somehost true 74 if [ $? -ne 0 ]; then 75 fail "key option failed without restriction" 76 fi 77 78 sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys 79 from=`head -1 $authkeys | cut -f1 -d ' '` 80 verbose "key option $from" 81 r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'` 82 if [ "$r" = "true" ]; then 83 fail "key option $from not restricted" 84 fi 85 86 r=`${SSH} -q -F $OBJ/ssh_config somehost 'echo true'` 87 if [ "$r" != "true" ]; then 88 fail "key option $from not allowed but should be" 89 fi 90done 91 92rm -f "$origkeys" 93