1#	$OpenBSD: forcecommand.sh,v 1.7 2023/11/01 02:08:38 dtucker Exp $
2#	Placed in the Public Domain.
3
4tid="forced command"
5
6cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
7
8authorized_keys() {
9	cmd=$1
10	cp /dev/null $OBJ/authorized_keys_$USER
11	for t in ${SSH_KEYTYPES}; do
12		test -z "$cmd" || \
13			printf "command=\"$cmd\" " >>$OBJ/authorized_keys_$USER
14		cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
15	done
16}
17
18trace "test config with sftp"
19authorized_keys
20rm -f $OBJ/ssh_proxy.tmp
21echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \
22	${SFTP} -S ${SSH} -b - -qF $OBJ/ssh_proxy somehost 2>/dev/null || \
23	fail "sftp failed"
24test -f "$OBJ/ssh_proxy.tmp" || fail "sftp did not download file"
25rm -f $OBJ/ssh_proxy.tmp
26
27trace "forced command in key option"
28authorized_keys true
29${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key option"
30
31authorized_keys false
32cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
33echo "ForceCommand true" >> $OBJ/sshd_proxy
34
35trace "forced command in sshd_config overrides key option"
36${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command config"
37
38authorized_keys
39cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
40echo "ForceCommand false" >> $OBJ/sshd_proxy
41
42trace "force command overriding subsystem"
43echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \
44	${SFTP} -S ${SSH} -F $OBJ/ssh_proxy -oLoglevel=quiet somehost && \
45	fail "sftp succeeded"
46
47echo "Match User $USER" >> $OBJ/sshd_proxy
48echo "    ForceCommand true" >> $OBJ/sshd_proxy
49
50trace "forced command with match"
51${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command match"
52
53trace "force command in match overriding subsystem"
54echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \
55	${SFTP} -S ${SSH} -F $OBJ/ssh_proxy -oLoglevel=quiet somehost && \
56	fail "sftp succeeded"
57
58trace "force command to sftpserver"
59grep -vi subsystem $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
60echo "Subsystem sftp /bin/false" >> $OBJ/sshd_proxy
61echo "ForceCommand ${SFTPSERVER}" >> $OBJ/sshd_proxy
62rm -f $OBJ/ssh_proxy.tmp
63echo "@get $OBJ/ssh_proxy $OBJ/ssh_proxy.tmp" | \
64	${SFTP} -S ${SSH} -b - -qF $OBJ/ssh_proxy somehost 2>/dev/null || \
65	fail "sftp failed"
66test -f "$OBJ/ssh_proxy.tmp" || fail "sftp did not download file"
67rm -f $OBJ/ssh_proxy.tmp
68