diff options
| -rw-r--r-- | openssh/Makefile | 80 | ||||
| -rwxr-xr-x | openssh/bin/ssh-ca | 40 | ||||
| -rwxr-xr-x | openssh/bin/ssh-keycheck | 176 |
3 files changed, 296 insertions, 0 deletions
diff --git a/openssh/Makefile b/openssh/Makefile new file mode 100644 index 0000000..6b3744b --- /dev/null +++ b/openssh/Makefile @@ -0,0 +1,80 @@ +# Open Infrastructure: service-tools + +# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net> +# +# SPDX-License-Identifier: GPL-3.0+ +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <https://www.gnu.org/licenses/>. + +SHELL := sh -e + +SCRIPTS = bin/* + +all: build + +test: + @echo -n "Checking for syntax errors with sh... " + @for SCRIPT in $(SCRIPTS); \ + do \ + sh -n $${SCRIPT}; \ + echo -n "."; \ + done + @echo " done." + + @echo -n "Checking for bashisms... " + @if [ -x /usr/bin/checkbashisms ]; \ + then \ + for SCRIPT in $(SCRIPTS); \ + do \ + checkbashisms -f -x $${SCRIPT}; \ + echo -n "."; \ + done; \ + else \ + echo "Note: devscripts not installed, skipping checkbashisms."; \ + fi + @echo " done." + + @echo -n "Checking with shellcheck... " + @if [ -x /usr/bin/shellcheck ]; \ + then \ + for SCRIPT in $(SCRIPTS); \ + do \ + shellcheck -e SC2039 $${SCRIPT}; \ + echo -n "."; \ + done; \ + else \ + echo "Note: shellcheck not installed, skipping shellcheck."; \ + fi + @echo " done." + +build: + +install: build + mkdir -p $(DESTDIR)/usr/bin + cp -r bin/* $(DESTDIR)/usr/bin + +uninstall: + for FILE in bin/*; \ + do \ + rm -f $(DESTDIR)/usr/bin/$$(basename $${FILE}); \ + done + rmdir --ignore-fail-on-non-empty --parents $(DESTDIR)/usr/bin || true + + rmdir --ignore-fail-on-non-empty --parents $(DESTDIR) || true + +clean: + +distclean: + +reinstall: uninstall install diff --git a/openssh/bin/ssh-ca b/openssh/bin/ssh-ca new file mode 100755 index 0000000..675a2cf --- /dev/null +++ b/openssh/bin/ssh-ca @@ -0,0 +1,40 @@ +#!/bin/sh + +set -e + +HOST="$(cat /etc/hostname)" + +Init () +{ + echo "Init: creating CA key..." + + if [ -e "/etc/ssh-ca/keys/ssh-ca@${HOST}" ] || [ -e "/etc/ssh-ca/keys/ssh-ca@${HOST}.pub" ] + then + echo "/etc/ssh-ca/keys/ssh-ca@${HOST} key already exists" + exit 1 + fi + + mkdir -p /etc/ssh-ca/keys + ssh-keygen -f "/etc/ssh-ca/keys/ssh-ca@${HOST}" -t ed25519 -C ssh-ca@${HOST} -N "" +} + +Sign () +{ + FILE="${1}" + +} + +case "${1}" in + init) + Init + ;; + + sign) + Sign + ;; + + *) + echo "Usage: ${0} {init}" + exit 1 + ;; +esac diff --git a/openssh/bin/ssh-keycheck b/openssh/bin/ssh-keycheck new file mode 100755 index 0000000..67046f1 --- /dev/null +++ b/openssh/bin/ssh-keycheck @@ -0,0 +1,176 @@ +#!/bin/sh + +# Open Infrastructure: service-tools + +# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net> +# +# SPDX-License-Identifier: GPL-3.0+ +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <https://www.gnu.org/licenses/>. + +set -e + +PROJECT="open-infrastructure" +SOFTWARE="service-tools" +PROGRAM="ssh-keycheck" + +Parameters () +{ + GETOPT_LONGOPTIONS="bits:,filename:,help,type:,verbose," + GETOPT_OPTIONS="b:,f:,h,t:,v," + + PARAMETERS="$(getopt --longoptions ${GETOPT_LONGOPTIONS} --name=${PROGRAM} --options ${GETOPT_OPTIONS} --shell sh -- ${@})" + + if [ "${?}" != "0" ] + then + echo "'${PROGRAM}': getopt exit" >&2 + exit 1 + fi + + eval set -- "${PARAMETERS}" + + while true + do + case "${1}" in + -b|--bits) + BITS="${2}" + shift 2 + ;; + + -f|--filename) + FILES="${2}" + shift 2 + ;; + + -h|--help) + HELP="true" + shift 1 + ;; + + -t|--type) + TYPES="${2}" + shift 2 + ;; + + -v|--verbose) + VERBOSE="true" + shift 1 + ;; + + --) + shift 1 + break + ;; + + *) + echo "'${PROGRAM}': getopt error" >&2 + exit 1 + ;; + esac + done +} + +Usage () +{ + echo "Usage: ${PROGRAM} -f KEY_FILE[,KEY_FILE] [-b BITS[,BITS]] [-t TYPE[,TYPE]]" >&2 + echo + echo "See ${PROGRAM}(1) and ${SOFTWARE}(7) for more information." + + exit 1 +} + +Parameters "${@}" + +if [ -z "${FILES}" ] || [ -n "${HELP}" ] +then + Usage +fi + +EXIT="0" + +for FILE in ${FILES} +do + if [ ! -e "${FILE}" ] + then + echo "'${FILE}': no such key file" >&2 + exit 1 + fi + + # Run + SSH_KEYGEN="$(ssh-keygen -l -f "${FILE}" 2>&1 || true)" + + KEY_TYPE="$(echo "${SSH_KEYGEN}" | awk '{ print $NF }' | sed -e 's|(||' -e 's|)||' | tr '[A-Z]' '[a-z]')" + KEY_BITS="$(echo "${SSH_KEYGEN}" | awk '{ print $1 }')" + + case "${KEY_TYPE}" in + dsa|ecdsa|ecdsa-sk|ed25519|ed25519-sk|rsa) + ;; + + *) + case "${VERBOSE}" in + true) + echo "'${FILE}': invalid key file" >&2 + ;; + esac + + KEY_TYPE="unknown" + EXIT="1" + ;; + esac + + if [ "${KEY_TYPE}" != "unknown" ] && [ -n "${TYPES}" ] + then + case "${KEY_TYPE}" in + $(echo ${TYPES} | sed -e 's|,| |g')) + ;; + + *) + echo "'${FILE}': wrong type ('${KEY_TYPE}' instead of '${TYPES}')" >&2 + EXIT="1" + ;; + esac + fi + + if [ "${KEY_TYPE}" != "unknown" ] && [ -n "${BITS}" ] + then + case "${KEY_BITS}" in + $(echo ${BITS} | sed -e 's|,| |g')) + ;; + + *) + echo "'${FILE}': wrong bits ('${KEY_BITS}' instead of '${BITS}')" >&2 + EXIT="1" + ;; + esac + fi + + case "${EXIT}" in + 0) + case "${VERBOSE}" in + true) + +cat << EOF +filename: ${FILE} +bits: ${KEY_BITS} +type: ${KEY_TYPE} +EOF + + ;; + esac + ;; + + esac +done + +exit "${EXIT}" |