forked from ungleich-public/cdist
Cleanup ssh authorized keys types
Merge __ssh_authorized_key into __ssh_authorized_keys type. Reimplement authorized_keys file processing logic. Deprecate __ssh_authorized_key file in favor of __ssh_authorized_keys. Resolve #829.
This commit is contained in:
Darko Poljak
parent
10ca1c12fd
commit
17a9a86588
4 changed files with 157 additions and 73 deletions
1
cdist/conf/type/__ssh_authorized_key/deprecated
Normal file
1
cdist/conf/type/__ssh_authorized_key/deprecated
Normal file
|
|
@ -0,0 +1 @@
|
|||
This type is deprecated. Please use __ssh_authorized_keys instead.
|
||||
129
cdist/conf/type/__ssh_authorized_keys/gencode-remote
Executable file
129
cdist/conf/type/__ssh_authorized_keys/gencode-remote
Executable file
|
|
@ -0,0 +1,129 @@
|
|||
#!/bin/sh -e
|
||||
#
|
||||
# 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
|
||||
# 2014 Nico Schottelius (nico-cdist at schottelius.org)
|
||||
# 2021 Darko Poljak (darko.poljak at gmail.com)
|
||||
#
|
||||
# This file is part of cdist.
|
||||
#
|
||||
# cdist is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# cdist is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
state="$(cat "$__object/parameter/state" 2>/dev/null)"
|
||||
file="$(cat "$__object/explorer/file")"
|
||||
keys_file="$__object/explorer/keys"
|
||||
|
||||
temp_file="${file}.tmp"
|
||||
work_file="${temp_file}.work"
|
||||
|
||||
_type_and_key() {
|
||||
echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }'
|
||||
}
|
||||
|
||||
_gen_key_entry() {
|
||||
_the_key="$1"
|
||||
# generate the key entry as it should be
|
||||
if [ -f "$__object/parameter/option" ]; then
|
||||
# comma seperated list of options
|
||||
options="$(tr '\n' ',' < "$__object/parameter/option")"
|
||||
printf '%s ' "${options%*,}"
|
||||
fi
|
||||
if [ -f "$__object/parameter/comment" ]; then
|
||||
# extract the keytype and base64 encoded key ignoring any options and comment
|
||||
printf '%s ' "$(echo "${_the_key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
|
||||
# override the comment with the one explicitly given
|
||||
printf '%s' "$(cat "$__object/parameter/comment")"
|
||||
else
|
||||
printf '%s' "${_the_key}"
|
||||
fi
|
||||
printf '\n'
|
||||
}
|
||||
|
||||
cat << DONE
|
||||
cp -f "${file}" "${temp_file}"
|
||||
DONE
|
||||
|
||||
while read -r key; do
|
||||
# validate key
|
||||
validated_key="$(echo "${key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
|
||||
if [ -z "${validated_key}" ]
|
||||
then
|
||||
echo "Key is invalid: \"${key}\"" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
type_and_key="$(_type_and_key "${key}")"
|
||||
|
||||
# remove conflicting entries
|
||||
cat << DONE
|
||||
grep -v "${type_and_key}\\([ \\n].*\\)*\$" "${temp_file}" > "${work_file}" || true
|
||||
DONE
|
||||
|
||||
entry="$(_gen_key_entry "${key}")"
|
||||
|
||||
case "${state}" in
|
||||
present)
|
||||
# escape single quotes
|
||||
_line_sanitised=$(echo "${entry}" | sed -e "s/'/'\"'\"'/g")
|
||||
cat << DONE
|
||||
printf "%s\\n" "${_line_sanitised}" >> "${work_file}"
|
||||
mv -f "${work_file}" "${temp_file}"
|
||||
DONE
|
||||
echo "added to ${file} (${entry})" >> "$__messages_out"
|
||||
;;
|
||||
absent)
|
||||
cat << DONE
|
||||
grep -v "${entry}" "${work_file}" > "${temp_file}" || true
|
||||
rm -f "${work_file}"
|
||||
DONE
|
||||
echo "removed from ${file} (${entry})" >> "$__messages_out"
|
||||
;;
|
||||
esac
|
||||
done < "$__object/parameter/key"
|
||||
|
||||
set --
|
||||
cat << DONE
|
||||
set --
|
||||
DONE
|
||||
if [ -f "$__object/parameter/remove-unknown" ] && [ -s "${keys_file}" ]
|
||||
then
|
||||
while read -r key
|
||||
do
|
||||
type_and_key="$( _type_and_key "${key}" )"
|
||||
|
||||
if grep -Fq "${type_and_key}" "$__object/parameter/key"
|
||||
then
|
||||
continue
|
||||
fi
|
||||
|
||||
# build grep -e patterns
|
||||
set -- "\$@" "-e" "${key}"
|
||||
cat << DONE
|
||||
set -- "\$@" "-e" "${key}"
|
||||
DONE
|
||||
done < "${keys_file}"
|
||||
|
||||
# if no pattern then nothing to remove
|
||||
if [ $# -gt 0 ]
|
||||
then
|
||||
cat << DONE
|
||||
grep -v -F -x "\$@" "${temp_file}" > "${work_file}" || true
|
||||
mv -f "${work_file}" "${temp_file}"
|
||||
DONE
|
||||
fi
|
||||
fi
|
||||
|
||||
cat << DONE
|
||||
mv -f "${temp_file}" "${file}"
|
||||
DONE
|
||||
|
|
@ -122,12 +122,13 @@ SEE ALSO
|
|||
|
||||
AUTHORS
|
||||
-------
|
||||
Steven Armstrong <steven-cdist--@--armstrong.cc>
|
||||
| Steven Armstrong <steven-cdist--@--armstrong.cc>
|
||||
| Darko Poljak <darko.poljak--@--gmail.com>
|
||||
|
||||
|
||||
COPYING
|
||||
-------
|
||||
Copyright \(C) 2012-2014 Steven Armstrong. You can redistribute it
|
||||
and/or modify it under the terms of the GNU General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
Copyright \(C) 2012-2021 Steven Armstrong and Darko Poljak. You can
|
||||
redistribute it and/or modify it under the terms of the GNU General Public
|
||||
License as published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
#
|
||||
# 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
|
||||
# 2014 Nico Schottelius (nico-cdist at schottelius.org)
|
||||
# 2021 Darko Poljak (darko.poljak at gmail.com)
|
||||
#
|
||||
# This file is part of cdist.
|
||||
#
|
||||
|
|
@ -20,80 +21,32 @@
|
|||
#
|
||||
|
||||
owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
|
||||
state="$(cat "$__object/parameter/state" 2>/dev/null)"
|
||||
file="$(cat "$__object/explorer/file")"
|
||||
|
||||
if [ ! -f "$__object/parameter/nofile" ] && [ -z "$file" ]
|
||||
if [ ! -f "$__object/parameter/nofile" ] && [ -z "${file}" ]
|
||||
then
|
||||
echo "Cannot determine path of authorized_keys file" >&2
|
||||
exit 1
|
||||
printf "Cannot determine path of authorized_keys file\\n" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$__object/parameter/noparent" ] || [ ! -f "$__object/parameter/nofile" ]; then
|
||||
group="$(cut -d':' -f 1 "$__object/explorer/group")"
|
||||
if [ -z "$group" ]; then
|
||||
echo "Failed to get owners group from explorer." >&2
|
||||
exit 1
|
||||
fi
|
||||
group="$(cut -d':' -f 1 "$__object/explorer/group")"
|
||||
if [ -z "${group}" ]; then
|
||||
printf "Failed to get owners group from explorer\\n" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$__object/parameter/noparent" ]; then
|
||||
__ssh_dot_ssh "$owner"
|
||||
export require="__ssh_dot_ssh/$owner"
|
||||
fi
|
||||
if [ ! -f "$__object/parameter/nofile" ]; then
|
||||
# Ensure that authorized_keys file exists and has the right permissions.
|
||||
__file "$file" \
|
||||
--owner "$owner" \
|
||||
--group "$group" \
|
||||
--mode 0600 \
|
||||
--state exists
|
||||
export require="__file/$file"
|
||||
fi
|
||||
fi
|
||||
|
||||
_cksum() {
|
||||
echo "$1" | cksum | cut -d' ' -f 1
|
||||
}
|
||||
|
||||
_type_and_key() {
|
||||
echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }'
|
||||
}
|
||||
|
||||
while read -r key; do
|
||||
type_and_key="$( _type_and_key "$key" )"
|
||||
object_id="$(_cksum "$file")-$(_cksum "$type_and_key")"
|
||||
set -- "$object_id"
|
||||
set -- "$@" --file "$file"
|
||||
set -- "$@" --key "$key"
|
||||
set -- "$@" --state "$state"
|
||||
if [ -f "$__object/parameter/option" ]; then
|
||||
# shellcheck disable=SC2046
|
||||
set -- "$@" $(printf -- '--option %s ' $(cat "$__object/parameter/option"))
|
||||
fi
|
||||
if [ -f "$__object/parameter/comment" ]; then
|
||||
set -- "$@" --comment "$(cat "$__object/parameter/comment")"
|
||||
fi
|
||||
# Ensure __ssh_authorized_key does not read stdin
|
||||
__ssh_authorized_key "$@" < /dev/null
|
||||
done < "$__object/parameter/key"
|
||||
|
||||
if [ -f "$__object/parameter/remove-unknown" ] &&
|
||||
[ -s "$__object/explorer/keys" ]
|
||||
then
|
||||
while read -r key
|
||||
do
|
||||
type_and_key="$( _type_and_key "$key" )"
|
||||
|
||||
if grep -Fq "$type_and_key" "$__object/parameter/key"
|
||||
then
|
||||
continue
|
||||
fi
|
||||
|
||||
__ssh_authorized_key "remove-$( _cksum "$file$key" )" \
|
||||
--file "$file" \
|
||||
--key "$key" \
|
||||
--state absent \
|
||||
< /dev/null
|
||||
done \
|
||||
< "$__object/explorer/keys"
|
||||
if [ ! -f "$__object/parameter/noparent" ]; then
|
||||
__ssh_dot_ssh "${owner}"
|
||||
export require="__ssh_dot_ssh/${owner}"
|
||||
fi
|
||||
if [ ! -f "$__object/parameter/nofile" ]; then
|
||||
# Ensure that authorized_keys file exists and has the right permissions.
|
||||
__file "${file}" \
|
||||
--owner "${owner}" \
|
||||
--group "${group}" \
|
||||
--mode 0600 \
|
||||
--state exists
|
||||
export require="__file/${file}"
|
||||
fi
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in a new issue