From 17a9a865880f4c37ed776bb1be627d98d4e57c85 Mon Sep 17 00:00:00 2001 From: Darko Poljak Date: Wed, 17 Mar 2021 22:32:26 +0100 Subject: [PATCH] Cleanup ssh authorized keys types Merge __ssh_authorized_key into __ssh_authorized_keys type. Reimplement authorized_keys file processing logic. Deprecate __ssh_authorized_key file in favor of __ssh_authorized_keys. Resolve #829. --- .../conf/type/__ssh_authorized_key/deprecated | 1 + .../type/__ssh_authorized_keys/gencode-remote | 129 ++++++++++++++++++ cdist/conf/type/__ssh_authorized_keys/man.rst | 9 +- .../conf/type/__ssh_authorized_keys/manifest | 91 +++--------- 4 files changed, 157 insertions(+), 73 deletions(-) create mode 100644 cdist/conf/type/__ssh_authorized_key/deprecated create mode 100755 cdist/conf/type/__ssh_authorized_keys/gencode-remote diff --git a/cdist/conf/type/__ssh_authorized_key/deprecated b/cdist/conf/type/__ssh_authorized_key/deprecated new file mode 100644 index 00000000..bf72faaa --- /dev/null +++ b/cdist/conf/type/__ssh_authorized_key/deprecated @@ -0,0 +1 @@ +This type is deprecated. Please use __ssh_authorized_keys instead. diff --git a/cdist/conf/type/__ssh_authorized_keys/gencode-remote b/cdist/conf/type/__ssh_authorized_keys/gencode-remote new file mode 100755 index 00000000..2fb1895a --- /dev/null +++ b/cdist/conf/type/__ssh_authorized_keys/gencode-remote @@ -0,0 +1,129 @@ +#!/bin/sh -e +# +# 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc) +# 2014 Nico Schottelius (nico-cdist at schottelius.org) +# 2021 Darko Poljak (darko.poljak at gmail.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# + +state="$(cat "$__object/parameter/state" 2>/dev/null)" +file="$(cat "$__object/explorer/file")" +keys_file="$__object/explorer/keys" + +temp_file="${file}.tmp" +work_file="${temp_file}.work" + +_type_and_key() { + echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }' +} + +_gen_key_entry() { + _the_key="$1" + # generate the key entry as it should be + if [ -f "$__object/parameter/option" ]; then + # comma seperated list of options + options="$(tr '\n' ',' < "$__object/parameter/option")" + printf '%s ' "${options%*,}" + fi + if [ -f "$__object/parameter/comment" ]; then + # extract the keytype and base64 encoded key ignoring any options and comment + printf '%s ' "$(echo "${_the_key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')" + # override the comment with the one explicitly given + printf '%s' "$(cat "$__object/parameter/comment")" + else + printf '%s' "${_the_key}" + fi + printf '\n' +} + +cat << DONE +cp -f "${file}" "${temp_file}" +DONE + +while read -r key; do + # validate key + validated_key="$(echo "${key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')" + if [ -z "${validated_key}" ] + then + echo "Key is invalid: \"${key}\"" >&2 + exit 1 + fi + + type_and_key="$(_type_and_key "${key}")" + + # remove conflicting entries + cat << DONE + grep -v "${type_and_key}\\([ \\n].*\\)*\$" "${temp_file}" > "${work_file}" || true +DONE + + entry="$(_gen_key_entry "${key}")" + + case "${state}" in + present) + # escape single quotes + _line_sanitised=$(echo "${entry}" | sed -e "s/'/'\"'\"'/g") + cat << DONE + printf "%s\\n" "${_line_sanitised}" >> "${work_file}" + mv -f "${work_file}" "${temp_file}" +DONE + echo "added to ${file} (${entry})" >> "$__messages_out" + ;; + absent) + cat << DONE + grep -v "${entry}" "${work_file}" > "${temp_file}" || true + rm -f "${work_file}" +DONE + echo "removed from ${file} (${entry})" >> "$__messages_out" + ;; + esac +done < "$__object/parameter/key" + +set -- +cat << DONE +set -- +DONE +if [ -f "$__object/parameter/remove-unknown" ] && [ -s "${keys_file}" ] +then + while read -r key + do + type_and_key="$( _type_and_key "${key}" )" + + if grep -Fq "${type_and_key}" "$__object/parameter/key" + then + continue + fi + + # build grep -e patterns + set -- "\$@" "-e" "${key}" + cat << DONE + set -- "\$@" "-e" "${key}" +DONE + done < "${keys_file}" + + # if no pattern then nothing to remove + if [ $# -gt 0 ] + then + cat << DONE + grep -v -F -x "\$@" "${temp_file}" > "${work_file}" || true + mv -f "${work_file}" "${temp_file}" +DONE + fi +fi + +cat << DONE +mv -f "${temp_file}" "${file}" +DONE diff --git a/cdist/conf/type/__ssh_authorized_keys/man.rst b/cdist/conf/type/__ssh_authorized_keys/man.rst index dac6adeb..a2f7c1af 100644 --- a/cdist/conf/type/__ssh_authorized_keys/man.rst +++ b/cdist/conf/type/__ssh_authorized_keys/man.rst @@ -122,12 +122,13 @@ SEE ALSO AUTHORS ------- -Steven Armstrong +| Steven Armstrong +| Darko Poljak COPYING ------- -Copyright \(C) 2012-2014 Steven Armstrong. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the +Copyright \(C) 2012-2021 Steven Armstrong and Darko Poljak. You can +redistribute it and/or modify it under the terms of the GNU General Public +License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. diff --git a/cdist/conf/type/__ssh_authorized_keys/manifest b/cdist/conf/type/__ssh_authorized_keys/manifest index b319316b..57056bd5 100755 --- a/cdist/conf/type/__ssh_authorized_keys/manifest +++ b/cdist/conf/type/__ssh_authorized_keys/manifest @@ -2,6 +2,7 @@ # # 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc) # 2014 Nico Schottelius (nico-cdist at schottelius.org) +# 2021 Darko Poljak (darko.poljak at gmail.com) # # This file is part of cdist. # @@ -20,80 +21,32 @@ # owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")" -state="$(cat "$__object/parameter/state" 2>/dev/null)" file="$(cat "$__object/explorer/file")" -if [ ! -f "$__object/parameter/nofile" ] && [ -z "$file" ] +if [ ! -f "$__object/parameter/nofile" ] && [ -z "${file}" ] then - echo "Cannot determine path of authorized_keys file" >&2 - exit 1 + printf "Cannot determine path of authorized_keys file\\n" >&2 + exit 1 fi if [ ! -f "$__object/parameter/noparent" ] || [ ! -f "$__object/parameter/nofile" ]; then - group="$(cut -d':' -f 1 "$__object/explorer/group")" - if [ -z "$group" ]; then - echo "Failed to get owners group from explorer." >&2 - exit 1 - fi + group="$(cut -d':' -f 1 "$__object/explorer/group")" + if [ -z "${group}" ]; then + printf "Failed to get owners group from explorer\\n" >&2 + exit 1 + fi - if [ ! -f "$__object/parameter/noparent" ]; then - __ssh_dot_ssh "$owner" - export require="__ssh_dot_ssh/$owner" - fi - if [ ! -f "$__object/parameter/nofile" ]; then - # Ensure that authorized_keys file exists and has the right permissions. - __file "$file" \ - --owner "$owner" \ - --group "$group" \ - --mode 0600 \ - --state exists - export require="__file/$file" - fi -fi - -_cksum() { - echo "$1" | cksum | cut -d' ' -f 1 -} - -_type_and_key() { - echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }' -} - -while read -r key; do - type_and_key="$( _type_and_key "$key" )" - object_id="$(_cksum "$file")-$(_cksum "$type_and_key")" - set -- "$object_id" - set -- "$@" --file "$file" - set -- "$@" --key "$key" - set -- "$@" --state "$state" - if [ -f "$__object/parameter/option" ]; then - # shellcheck disable=SC2046 - set -- "$@" $(printf -- '--option %s ' $(cat "$__object/parameter/option")) - fi - if [ -f "$__object/parameter/comment" ]; then - set -- "$@" --comment "$(cat "$__object/parameter/comment")" - fi - # Ensure __ssh_authorized_key does not read stdin - __ssh_authorized_key "$@" < /dev/null -done < "$__object/parameter/key" - -if [ -f "$__object/parameter/remove-unknown" ] && - [ -s "$__object/explorer/keys" ] -then - while read -r key - do - type_and_key="$( _type_and_key "$key" )" - - if grep -Fq "$type_and_key" "$__object/parameter/key" - then - continue - fi - - __ssh_authorized_key "remove-$( _cksum "$file$key" )" \ - --file "$file" \ - --key "$key" \ - --state absent \ - < /dev/null - done \ - < "$__object/explorer/keys" + if [ ! -f "$__object/parameter/noparent" ]; then + __ssh_dot_ssh "${owner}" + export require="__ssh_dot_ssh/${owner}" + fi + if [ ! -f "$__object/parameter/nofile" ]; then + # Ensure that authorized_keys file exists and has the right permissions. + __file "${file}" \ + --owner "${owner}" \ + --group "${group}" \ + --mode 0600 \ + --state exists + export require="__file/${file}" + fi fi