[Da-tools-commits] ./da-tools/userdir-ldap-common r386: Merge sshkeys check with the alioth userdir-ldap-common
Joerg Jaspert
joerg at ganneff.de
Wed May 14 14:56:04 UTC 2008
------------------------------------------------------------
revno: 386
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: userdir-ldap-common
timestamp: Wed 2008-05-14 16:56:04 +0200
message:
Merge sshkeys check with the alioth userdir-ldap-common
modified:
debian/changelog
ud-mailgate
ud-replicate
------------------------------------------------------------
revno: 349.4.42
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Tue 2008-05-13 22:09:02 +0200
message:
* ud-replicate: use the host key to sync stuff from the db server,
that is, call ssh with ii /etc/ssh/ssh_host_rsa_key.
* ud-replicate: Call ssh with -o PreferredAuthentications=publickey
so that it does not even try password authentication.
modified:
debian/changelog
ud-replicate
------------------------------------------------------------
revno: 349.4.43
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: ud-ldap-sshkey
timestamp: Wed 2008-05-14 16:43:40 +0200
message:
Check ssh keys:
- reject all DSA keys, similar to RSA1 keys.
- reject and mail the admins for broken keys, ie keys
- of size below 1024 or
- known to be bad (fingerprintlist)
modified:
ud-mailgate
userdir-ldap.conf
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2008-04-21 11:31:04 +0000
+++ b/debian/changelog 2008-05-13 20:09:02 +0000
@@ -1,3 +1,12 @@
+userdir-ldap (0.3.21) unstable; urgency=low
+
+ * ud-replicate: use the host key to sync stuff from the db server,
+ that is, call ssh with ii /etc/ssh/ssh_host_rsa_key.
+ * ud-replicate: Call ssh with -o PreferredAuthentications=publickey
+ so that it does not even try password authentication.
+
+ -- Peter Palfrader <weasel at debian.org> Tue, 13 May 2008 22:06:23 +0200
+
userdir-ldap (0.3.20) unstable; urgency=low
* Teach ud-mailgate about ipv6 addresses (RT#193).
=== modified file 'ud-mailgate'
--- a/ud-mailgate 2008-05-12 22:12:56 +0000
+++ b/ud-mailgate 2008-05-14 14:56:04 +0000
@@ -6,7 +6,7 @@
# Copyright (c) 2008 Joerg Jaspert <joerg at debian.org>
import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands
-import pwd, tmpfile
+import pwd, tempfile
from userdir_gpg import *
from userdir_ldap import *
@@ -236,31 +236,72 @@
# Handle an SSH authentication key, the line format is:
# [options] 1024 35 13188913666680[..] [comment]
-def DoSSH(Str,Attrs, badkeys):
+def DoSSH(Str, Attrs, badkeys, uid):
Match = SSH2AuthSplit.match(Str);
+ g = Match.groups()
+ typekey = g[1]
if Match == None:
Match = re.compile('^1024 (\d+) ').match(Str)
if Match is not None:
return "SSH1 keys not supported anymore"
return None;
- (fd, path) = tempfile.mkstemp("", "sshkeytry")
+ (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp")
f = open(path, "w")
- f.write(Str)
- f.close
- (result, output) = commands.getstatusoutput("ssh-keygen -f %s -l" % (path))
+ f.write("%s\n" % (Str))
+ f.close()
+ cmd = "/usr/bin/ssh-keygen -l -f %s < /dev/null" % (path)
+ (result, output) = commands.getstatusoutput(cmd)
os.remove(path)
if (result != 0):
- sys.stderr.write("ssh-keygen -l invocation failed!\n%s\n" % (output))
- sys.exit(result)
+ raise Error, "ssh-keygen -l invocation failed!\n%s\n" % (output)
+
+
+ # Head
+ Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time()))
+ ErrReplyHead = "From: %s\nCc: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'],os.environ['SENDER'],ReplyTo,Date)
+ Subst = {}
+ Subst["__ADMIN__"] = ReplyTo
+ Subst["__USER__"] = uid
Match = SSHFingerprint.match(output)
-
g = Match.groups()
- if (g[0] < 1024):
- return "SSH keys must have at least 1024 bits, not added"
- elif g[0] in badkeys:
- return "Submitted SSH Key known to be bad and insecure, not added"
+
+ if int(g[0]) < 1024:
+ try:
+ # Body
+ Subst["__ERROR__"] = "SSH keysize %s is below limit 1024" % (g[0])
+ ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+ Child = os.popen("/usr/sbin/sendmail -t","w")
+ Child.write(ErrReplyHead)
+ Child.write(ErrReply)
+ if Child.close() != None:
+ raise Error, "Sendmail gave a non-zero return code"
+ except:
+ sys.exit(EX_TEMPFAIL)
+
+ # And now break and stop processing input, which sends a reply to the user.
+ raise Error, "SSH keys must have at least 1024 bits, processing halted, NOTHING MODIFIED AT ALL"
+ elif g[1] in badkeys:
+ try:
+ # Body
+ Subst["__ERROR__"] = "SSH key with fingerprint %s known as bad key" % (g[1])
+ ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+ Child = os.popen("/usr/sbin/sendmail -t","w")
+ Child.write(ErrReplyHead)
+ Child.write(ErrReply)
+ if Child.close() != None:
+ raise Error, "Sendmail gave a non-zero return code"
+ except:
+ sys.exit(EX_TEMPFAIL)
+
+ # And now break and stop processing input, which sends a reply to the user.
+ raise Error, "Submitted SSH Key known to be bad and insecure, processing halted, NOTHING MODIFIED AT ALL"
+
+ if (typekey == "dss"):
+ return "DSA keys not accepted anymore"
global SeenKey;
if SeenKey:
@@ -404,12 +445,12 @@
Result = Result + "> "+Line+"\n";
try:
if Line == "show":
- Show = 1;
- Res = "OK";
+ Show = 1;
+ Res = "OK";
else:
badkeys = LoadBadSSH()
Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
- DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys) or \
+ DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys,GetAttr(DnRecord,"uid")) or \
DoDel(Line,Attrs) or DoRBL(Line,Attrs)
except:
Res = None;
=== modified file 'ud-replicate'
--- a/ud-replicate 2008-04-21 22:18:09 +0000
+++ b/ud-replicate 2008-05-13 20:09:02 +0000
@@ -49,7 +49,7 @@
;;
esac
-rsync ${verbose} -e ssh -rp "${udhost}/var/cache/userdir-ldap/hosts/$HOST" .
+rsync ${verbose} -e 'ssh -i /etc/ssh/ssh_host_rsa_key -o PreferredAuthentications=publickey' -rp "${udhost}/var/cache/userdir-ldap/hosts/$HOST" .
makedb "$HOST/passwd.tdb" -o passwd.db.t
if [ -s "$HOST/shadow.tdb" ]
More information about the Da-tools-commits
mailing list