key-options.sh revision 295367 
1#	$OpenBSD: key-options.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
2#	Placed in the Public Domain.
3
4tid="key options"
5
6origkeys="$OBJ/authkeys_orig"
7authkeys="$OBJ/authorized_keys_${USER}"
8cp $authkeys $origkeys
9
10# Test command= forced command
11for p in ${SSH_PROTOCOLS}; do
12    for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
13	sed "s/.*/$c &/" $origkeys >$authkeys
14	verbose "key option proto $p $c"
15	r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost echo foo`
16	if [ "$r" = "foo" ]; then
17		fail "key option forced command not restricted"
18	fi
19	if [ "$r" != "bar" ]; then
20		fail "key option forced command not executed"
21	fi
22    done
23done
24
25# Test no-pty
26sed 's/.*/no-pty &/' $origkeys >$authkeys
27for p in ${SSH_PROTOCOLS}; do
28	verbose "key option proto $p no-pty"
29	r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty`
30	if [ -f "$r" ]; then
31		fail "key option failed proto $p no-pty (pty $r)"
32	fi
33done
34
35# Test environment=
36echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy
37sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys
38for p in ${SSH_PROTOCOLS}; do
39	verbose "key option proto $p environment"
40	r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
41	if [ "$r" != "bar" ]; then
42		fail "key option environment not set"
43	fi
44done
45
46# Test from= restriction
47start_sshd
48for p in ${SSH_PROTOCOLS}; do
49    for f in 127.0.0.1 '127.0.0.0\/8'; do
50	cat  $origkeys >$authkeys
51	${SSH} -$p -q -F $OBJ/ssh_proxy somehost true
52	if [ $? -ne 0 ]; then
53		fail "key option proto $p failed without restriction"
54	fi
55
56	sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys
57	from=`head -1 $authkeys | cut -f1 -d ' '`
58	verbose "key option proto $p $from"
59	r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'`
60	if [ "$r" = "true" ]; then
61		fail "key option proto $p $from not restricted"
62	fi
63
64	r=`${SSH} -$p -q -F $OBJ/ssh_config somehost 'echo true'`
65	if [ "$r" != "true" ]; then
66		fail "key option proto $p $from not allowed but should be"
67	fi
68    done
69done
70
71rm -f "$origkeys"
72