keytemp

#!/usr/bin/env bash

#   keytemp V0.0.1 -- Add Temporary SSH Public Key to user account.
#   Copyright (C) 2017 Mark Coccimiglio <mcoccimiglio@rice.edu>
#
#   This program is free software: you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation, either version 3 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program.  If not, see <https://www.gnu.org/licenses/>.

#   This file is used to push an admin's Public SSH Key to a user's account
#   to enable diagnostic login as the user.  It also schedules an 'at' job to
#   remove the admin key after 1 hour.

#   Required packages for this script:
#   BASH, PERL, AT

export DEBUG=0
export _VERSION='0.9.0'
export _authorized_keys='/root/.ssh/authorized_keys'
export _userAuthFile='./DumpFile.txt'

if (($DEBUG))
then
 export _authorized_keys='./authorized_keys'
 echo; echo
 echo "<DEBUG HEADER>"
 echo "\$0 : $0"
 echo "\$1 : $1"
 echo "\$2 : $2"
 echo "\$3 : $3"
 echo
 echo "\$_VERSION : $_VERSION"
 echo "\$_authorized_keys : $_authorized_keys"
 echo "</DEBUG Header>"; echo
fi

function die
{
    local message=$1
    [ -z "$message" ] && message="Died"
    echo "$message at ${BASH_SOURCE[1]}:${FUNCNAME[1]} line ${BASH_LINENO[0]}." >&2
    exit 1
}

function usage
{
        echo "keytemp: Temporarily add SSHKEY to a user's account."
        echo "Usage: keytemp <set|unset|showkey> <username> <keyID>"
        exit 1
}

export _action=$1
export _userName=$2
export _keyID=$3

### First level Sanity checks.
##
# unset is dependent on perl being installed.
which perl > /dev/null || die "perl missing.  Please install perl"
which sed > /dev/null  || die "sed missing.  Please install sed"

if [ $1 == 'showkey' ]
 then
  egrep -v '^#|^$' $_authorized_keys | cut -d' ' -f3
  exit 1
fi

# Test for proper usage.
if [ $# -lt 3 ]; then usage ; fi
test $_userName || usage
test $_action || usage
test $_keyID || usage

# We may NOT keytemp "root"
test $_userName == 'root' && die "Cannot keytemp root"
test $_userName == '0' && die "Cannot keytemp root"

# We must be "root" in order to run!!!
(($DEBUG)) || if [ $USER != 'root' ]; then die "Must be root to use this program." ; fi

# system must acknowledge user is valid and has accessible home directory.
getent passwd $_userName > /dev/null || die "User $_userName not valid."
export _homeDir=$(getent passwd ${_userName} | cut -d: -f6)

(($DEBUG)) || export _userAuthFile="${_homeDir}/.ssh/authorized_keys"

test $_homeDir || die "User \$HOME is set to NULL"
test -d $_homeDir || die "User $_userName home directory does not exist."

# Test keyID is present in source (/root/.ssh/authorized_keys)
test -s $_authorized_keys || die "${_authorized_keys} not found or ZERO Length"
(($DEBUG)) && echo "${_keyID}\$" "${_authorized_keys}"
egrep -q " ${_keyID}\$" "${_authorized_keys}"  || die "keyID not found in $_authorized_keys"

#
##
### /First level Sanity checks.

### MAIN Body of work
##
#

#------------------------------------------------------------
case "$_action" in
    set)
      (($DEBUG)) && echo "set:: $_action : $_userName : $_keyID"
#     Another Sanity Check
      test -d "$_homeDir/.ssh" || { \
        mkdir "${_homeDir}/.ssh" && \
        chmod 700 ${_homeDir}/.ssh && \
        touch ${_userAuthFile} && \
        chown -R ${_userName}. ${_homeDir}/.ssh
       }
#     Add SSH Key to user authorized_keys file.
      egrep "^.* ${_keyID}\$" "${_authorized_keys}" >> ${_userAuthFile}
#     Add AT Job to remove key from user authorized_keys file.
      (($DEBUG)) || echo "$0 unset ${_userName} ${_keyID}" | at now+1hour
      (($DEBUG)) && echo "$0 unset ${_userName} ${_keyID}" | at now+2minutes
      exit 0
    ;;
#------------------------------------------------------------
    unset)
      _keyID=$( sed 's/@/./g' <<< "${_keyID}" )
      (($DEBUG)) && echo "unset:: $_action : $_userName : $_keyID"
      perl -i -pe "s/^ssh.* ${_keyID}\n\$//" ${_userAuthFile}
      exit 0
    ;;
#------------------------------------------------------------
*)
    (($DEBUG)) && echo "::keytemp: unknown command: $_action \nfor: $_person \nkeyID: $_keyID\n\n"
    echo "Unknown Command: $_action"
    usage
    exit 1
;;
esac
#------------------------------------------------------------

#
##
### /MAIN Body of work.