-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
upstream: add some tests of forced commands overriding Subsystem
directives OpenBSD-Regress-ID: eb48610282f6371672bdf2a8b5d2aa33cfbd322b
- Loading branch information
Showing
1 changed file
with
44 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,67 @@ | ||
| # $OpenBSD: forcecommand.sh,v 1.5 2023/05/12 06:36:27 djm Exp $ | ||
| # $OpenBSD: forcecommand.sh,v 1.6 2023/11/01 00:29:46 djm Exp $ | ||
| # Placed in the Public Domain. | ||
|
|
||
| tid="forced command" | ||
|
|
||
| cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak | ||
|
|
||
| cp /dev/null $OBJ/authorized_keys_$USER | ||
| for t in ${SSH_KEYTYPES}; do | ||
| printf 'command="true" ' >>$OBJ/authorized_keys_$USER | ||
| cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER | ||
| done | ||
| authorized_keys() { | ||
| cmd=$1 | ||
| cp /dev/null $OBJ/authorized_keys_$USER | ||
| for t in ${SSH_KEYTYPES}; do | ||
| test -z "$cmd" || \ | ||
| printf "command=\"$cmd\" " >>$OBJ/authorized_keys_$USER | ||
| cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER | ||
| done | ||
| } | ||
|
|
||
| trace "test config with sftp" | ||
| authorized_keys | ||
| rm -f $OBJ/ssh_proxy.tmp | ||
| echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ | ||
| ${SFTP} -b - -qF $OBJ/ssh_proxy somehost 2>/dev/null || \ | ||
| fail "sftp failed" | ||
| test -f "$OBJ/ssh_proxy.tmp" || fail "sftp did not download file" | ||
| rm -f $OBJ/ssh_proxy.tmp | ||
|
|
||
| trace "forced command in key option" | ||
| authorized_keys true | ||
| ${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key option" | ||
|
|
||
| cp /dev/null $OBJ/authorized_keys_$USER | ||
| for t in ${SSH_KEYTYPES}; do | ||
| printf 'command="false" ' >> $OBJ/authorized_keys_$USER | ||
| cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER | ||
| done | ||
|
|
||
| authorized_keys false | ||
| cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy | ||
| echo "ForceCommand true" >> $OBJ/sshd_proxy | ||
|
|
||
| trace "forced command in sshd_config overrides key option" | ||
| ${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command config" | ||
|
|
||
| authorized_keys | ||
| cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy | ||
| echo "ForceCommand false" >> $OBJ/sshd_proxy | ||
|
|
||
| trace "force command overriding subsystem" | ||
| echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ | ||
| ${SFTP} -F $OBJ/ssh_proxy -oLoglevel=quiet somehost && \ | ||
| fail "sftp succeeded" | ||
|
|
||
| echo "Match User $USER" >> $OBJ/sshd_proxy | ||
| echo " ForceCommand true" >> $OBJ/sshd_proxy | ||
|
|
||
| trace "forced command with match" | ||
| ${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command match" | ||
|
|
||
| trace "force command in match overriding subsystem" | ||
| echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ | ||
| ${SFTP} -F $OBJ/ssh_proxy -oLoglevel=quiet somehost && \ | ||
| fail "sftp succeeded" | ||
|
|
||
| trace "force command to sftpserver" | ||
| grep -vi subsystem $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy | ||
| echo "Subsystem sftp /bin/false" >> $OBJ/sshd_proxy | ||
| echo "ForceCommand ${SFTPSERVER}" >> $OBJ/sshd_proxy | ||
| rm -f $OBJ/ssh_proxy.tmp | ||
| echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \ | ||
| ${SFTP} -b - -qF $OBJ/ssh_proxy somehost 2>/dev/null || \ | ||
| fail "sftp failed" | ||
| test -f "$OBJ/ssh_proxy.tmp" || fail "sftp did not download file" | ||
| rm -f $OBJ/ssh_proxy.tmp |