key-options.sh revision 1.6
1# $OpenBSD: key-options.sh,v 1.6 2018/03/04 01:46:48 djm Exp $ 2# Placed in the Public Domain. 3 4tid="key options" 5 6origkeys="$OBJ/authkeys_orig" 7authkeys="$OBJ/authorized_keys_${USER}" 8cp $authkeys $origkeys 9 10# Test command= forced command 11for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do 12 sed "s/.*/$c &/" $origkeys >$authkeys 13 verbose "key option $c" 14 r=`${SSH} -q -F $OBJ/ssh_proxy somehost echo foo` 15 if [ "$r" = "foo" ]; then 16 fail "key option forced command not restricted" 17 fi 18 if [ "$r" != "bar" ]; then 19 fail "key option forced command not executed" 20 fi 21done 22 23# Test no-pty 24expect_pty_succeed() { 25 which=$1 26 opts=$2 27 rm -f $OBJ/data 28 sed "s/.*/$opts &/" $origkeys >$authkeys 29 verbose "key option pty $which" 30 ${SSH} -ttq -F $OBJ/ssh_proxy somehost "tty > $OBJ/data; exit 0" 31 if [ $? -ne 0 ] ; then 32 fail "key option failed $which" 33 else 34 r=`cat $OBJ/data` 35 case "$r" in 36 /dev/*) ;; 37 *) fail "key option failed $which (pty $r)" ;; 38 esac 39 fi 40} 41expect_pty_fail() { 42 which=$1 43 opts=$2 44 rm -f $OBJ/data 45 sed "s/.*/$opts &/" $origkeys >$authkeys 46 verbose "key option pty $which" 47 ${SSH} -ttq -F $OBJ/ssh_proxy somehost "tty > $OBJ/data; exit 0" 48 if [ $? -eq 0 ]; then 49 r=`cat $OBJ/data` 50 if [ -e "$r" ]; then 51 fail "key option failed $which (pty $r)" 52 fi 53 case "$r" in 54 /dev/*) fail "key option failed $which (pty $r)" ;; 55 *) ;; 56 esac 57 fi 58} 59# First ensure that we can allocate a pty by default. 60expect_pty_succeed "default" "" 61expect_pty_fail "no-pty" "no-pty" 62expect_pty_fail "restrict" "restrict" 63expect_pty_succeed "restrict,pty" "restrict,pty" 64 65# Test environment= 66echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy 67sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys 68verbose "key option environment" 69r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo $FOO'` 70if [ "$r" != "bar" ]; then 71 fail "key option environment not set" 72fi 73 74# Test from= restriction 75start_sshd 76for f in 127.0.0.1 '127.0.0.0\/8'; do 77 cat $origkeys >$authkeys 78 ${SSH} -q -F $OBJ/ssh_proxy somehost true 79 if [ $? -ne 0 ]; then 80 fail "key option failed without restriction" 81 fi 82 83 sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys 84 from=`head -1 $authkeys | cut -f1 -d ' '` 85 verbose "key option $from" 86 r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'` 87 if [ "$r" = "true" ]; then 88 fail "key option $from not restricted" 89 fi 90 91 r=`${SSH} -q -F $OBJ/ssh_config somehost 'echo true'` 92 if [ "$r" != "true" ]; then 93 fail "key option $from not allowed but should be" 94 fi 95done 96 97rm -f "$origkeys" 98