From 558998ce664055a75595371118f818084d8f2b23 Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Fri, 3 Feb 2012 22:55:33 +0100 Subject: SSH: OpenSSH authorized_keys client --- Makefile.am | 16 ++++ contrib/sssd.spec.in | 4 + src/man/Makefile.am | 3 +- src/man/sss_ssh_authorizedkeys.1.xml | 110 +++++++++++++++++++++++ src/sss_client/ssh/sss_ssh_authorizedkeys.c | 130 ++++++++++++++++++++++++++++ 5 files changed, 262 insertions(+), 1 deletion(-) create mode 100644 src/man/sss_ssh_authorizedkeys.1.xml create mode 100644 src/sss_client/ssh/sss_ssh_authorizedkeys.c diff --git a/Makefile.am b/Makefile.am index 1bc620926..908c4acc8 100644 --- a/Makefile.am +++ b/Makefile.am @@ -61,6 +61,11 @@ dist_pkgconfig_DATA = ACLOCAL_AMFLAGS = -I m4 -I . +if BUILD_SSH +bin_PROGRAMS = \ + sss_ssh_authorizedkeys +endif + sbin_PROGRAMS = \ sssd \ sss_useradd \ @@ -639,6 +644,16 @@ sss_sudo_cli_LDADD = \ libsss_sudo.la endif +if BUILD_SSH +sss_ssh_authorizedkeys_SOURCES = \ + src/sss_client/common.c \ + src/sss_client/ssh/sss_ssh.c \ + src/sss_client/ssh/sss_ssh_authorizedkeys.c +sss_ssh_authorizedkeys_CFLAGS = $(AM_CFLAGS) +sss_ssh_authorizedkeys_LDADD = \ + libsss_util.la +endif + ################# # Feature Tests # ################# @@ -1321,6 +1336,7 @@ installsssddirs:: mkdir -p \ $(DESTDIR)$(includedir) \ $(DESTDIR)$(libdir) \ + $(DESTDIR)$(bindir) \ $(DESTDIR)$(sbindir) \ $(DESTDIR)$(mandir) \ $(DESTDIR)$(pluginpath) \ diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index bd94f8bb1..86aaef37e 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -314,6 +314,10 @@ rm -rf $RPM_BUILD_ROOT /%{_lib}/libnss_sss.so.2 /%{_lib}/security/pam_sss.so %{_libdir}/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so +%if (0%{?enable_experimental} == 1) +%{_bindir}/sss_ssh_authorizedkeys +%endif +%{_mandir}/man1/sss_ssh_authorizedkeys.1* %{_mandir}/man8/pam_sss.8* %{_mandir}/man8/sssd_krb5_locator_plugin.8* diff --git a/src/man/Makefile.am b/src/man/Makefile.am index 31b5652fd..f6307715e 100644 --- a/src/man/Makefile.am +++ b/src/man/Makefile.am @@ -38,7 +38,8 @@ man_MANS = \ sssd.8 sssd.conf.5 sssd-ldap.5 \ sssd-krb5.5 sssd-ipa.5 sssd-simple.5 \ sssd_krb5_locator_plugin.8 sss_groupshow.8 \ - pam_sss.8 sss_obfuscate.8 sss_cache.8 sss_debuglevel.8 + pam_sss.8 sss_obfuscate.8 sss_cache.8 sss_debuglevel.8 \ + sss_ssh_authorizedkeys.1 EXTRA_DIST = $(man_MANS:%=%.xml) $(wildcard $(srcdir)/include/*.xml) SUFFIXES = .1.xml .1 .3.xml .3 .5.xml .5 .8.xml .8 diff --git a/src/man/sss_ssh_authorizedkeys.1.xml b/src/man/sss_ssh_authorizedkeys.1.xml new file mode 100644 index 000000000..c6315eebc --- /dev/null +++ b/src/man/sss_ssh_authorizedkeys.1.xml @@ -0,0 +1,110 @@ + + + +SSSD Manual pages + + + + + sss_ssh_authorizedkeys + 1 + + + + sss_ssh_authorizedkeys + get OpenSSH authorized keys + + + + + sss_ssh_authorizedkeys + + options + + USER + + + + + DESCRIPTION + + sss_ssh_authorizedkeys acquires SSH + public keys for user USER and + outputs them in OpenSSH authorized_keys format (see the + AUTHORIZED_KEYS FILE FORMAT section of + sshd + 8 for more + information). + + + sshd + 8 can be configured + to use sss_ssh_authorizedkeys for public + key user authentication if it is compiled with support for + either AuthorizedKeysCommand or + PubkeyAgent + sshd_config + 5 options. + + + If AuthorizedKeysCommand is supported, + sshd + 8 can be configured to + use it by putting the following directive in + sshd_config + 5: + +AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys + + + + If PubkeyAgent is supported, + sshd + 8 can be configured to + use it by using the following directive for + sshd + 8 configuration: + +PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u + + + + + + + + + OPTIONS + + + + , + DOMAIN + + + + Search for user public keys in SSSD domain DOMAIN. + + + + + + + + + SEE ALSO + + + sshd8 + , + + sshd_config5 + , + + sss_ssh_knownhostsproxy1 + . + + + + diff --git a/src/sss_client/ssh/sss_ssh_authorizedkeys.c b/src/sss_client/ssh/sss_ssh_authorizedkeys.c new file mode 100644 index 000000000..c8aa45c30 --- /dev/null +++ b/src/sss_client/ssh/sss_ssh_authorizedkeys.c @@ -0,0 +1,130 @@ +/* + Authors: + Jan Cholasta + + Copyright (C) 2012 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include +#include +#include + +#include "util/util.h" +#include "util/crypto/sss_crypto.h" +#include "sss_client/sss_cli.h" +#include "sss_client/ssh/sss_ssh.h" + +int main(int argc, const char **argv) +{ + TALLOC_CTX *mem_ctx; + int pc_debug = SSSDBG_DEFAULT; + const char *pc_domain = NULL; + const char *pc_user = NULL; + struct poptOption long_options[] = { + POPT_AUTOHELP + { "debug", '\0', POPT_ARG_INT | POPT_ARGFLAG_DOC_HIDDEN, &pc_debug, 0, + _("The debug level to run with"), NULL }, + { "domain", 'd', POPT_ARG_STRING, &pc_domain, 0, + _("The SSSD domain to use"), NULL }, + POPT_TABLEEND + }; + poptContext pc = NULL; + const char *user; + struct sss_ssh_pubkey *pubkeys; + size_t num_pubkeys, i; + char *repr; + int ret; + + debug_prg_name = argv[0]; + + ret = set_locale(); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, + ("set_locale() failed (%d): %s\n", ret, strerror(ret))); + ERROR("Error setting the locale\n"); + ret = EXIT_FAILURE; + goto fini; + } + + mem_ctx = talloc_new(NULL); + if (!mem_ctx) { + ERROR("Not enough memory\n"); + ret = EXIT_FAILURE; + goto fini; + } + + /* parse parameters */ + pc = poptGetContext(NULL, argc, argv, long_options, 0); + poptSetOtherOptionHelp(pc, "USER"); + while ((ret = poptGetNextOpt(pc)) > 0) + ; + + debug_level = debug_convert_old_level(pc_debug); + + if (ret != -1) { + BAD_POPT_PARAMS(pc, poptStrerror(ret), ret, fini); + } + + pc_user = poptGetArg(pc); + if (pc_user == NULL) { + BAD_POPT_PARAMS(pc, _("User not specified\n"), ret, fini); + } + + /* append domain to username if domain is specified */ + if (pc_domain) { + user = talloc_asprintf(mem_ctx, "%s@%s", pc_user, pc_domain); + if (!user) { + ERROR("Not enough memory\n"); + ret = EXIT_FAILURE; + goto fini; + } + } else { + user = pc_user; + } + + /* look up public keys */ + ret = sss_ssh_get_pubkeys(mem_ctx, SSS_SSH_GET_USER_PUBKEYS, user, + &pubkeys, &num_pubkeys); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, + ("sss_ssh_get_pubkeys() failed (%d): %s\n", ret, strerror(ret))); + ERROR("Error looking up public keys\n"); + ret = EXIT_FAILURE; + goto fini; + } + + /* print results */ + for (i = 0; i < num_pubkeys; i++) { + ret = sss_ssh_format_pubkey(mem_ctx, &pubkeys[i], + SSS_SSH_FORMAT_OPENSSH, &repr); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + ("sss_ssh_format_pubkey() failed (%d): %s\n", + ret, strerror(ret))); + continue; + } + + printf("%s\n", repr); + } + + ret = EXIT_SUCCESS; + +fini: + poptFreeContext(pc); + talloc_free(mem_ctx); + + return ret; +} -- cgit