From: Peter Palfrader Date: Sat, 17 May 2008 09:39:20 +0000 (+0200) Subject: ud-replicate, ud-generate: Instead of one big ssh-rsa-shadow file ud-generate X-Git-Tag: userdir-ldap-0.3.24~5 X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fuserdir-ldap.git;a=commitdiff_plain;h=432f864af2347050e3dce2ff7002f04176468206;hp=88a19a6e47a1c577474311d016ae5d26a72a4029 ud-replicate, ud-generate: Instead of one big ssh-rsa-shadow file ud-generate now produces per-user authorized_keys files and tars them up. On the receiving end ud-replicate takes the tar and syncs it to userkeys/. The goal here is to no longer require a patched sshd. Setting AuthorizedKeysFile2 to /var/lib/misc/userkeys/%u is sufficient. For homedir creation we can use pam_mkhomedir. [mhy, sgran] --- diff --git a/debian/changelog b/debian/changelog index ffc9300..e1ec284 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,18 +1,24 @@ -userdir-ldap (0.3.23+common1) unstable; urgency=low - - [ Andreas Barth ] - * Add compatibility to dchroot-dsa to ud-replicate. - * Add (disabled) generation of authorized_keys suiteable for sshdist. - * Add performance optimization by caching IP adresses in ud-generate - (as a precondition for automatically adding aliases) - - [ Stephen Gran ] - * ud-replicate: handle individual ssh keys - - [ Mark Hymers ] - * ud-generate: handle individual ssh keys - - -- Mark Hymers Wed, 14 May 2008 22:09:22 +0100 +userdir-ldap (0.3.XX) Xnstable; urgency=low + + * ud-mailgate: better regex for ssh1 keys, which we reject. [joerg, weasel] + * ud-replicate: Also support the imposter dchroot-dsa from the debian + archive. [aba, weasel] + * ud-generate: Add support for generation of authorized_keys file on + the db host for the sshdist user. This is now possible since + ud-replicate clients use their ssh host key to authenticate to the + db server. The code now supports this but the feature is still + disabled. [aba] + * ud-generate: Add performance optimization by resolving IP adresses + for hosts only once and caching the result. [aba] + * ud-replicate, ud-generate: Instead of one big ssh-rsa-shadow file + ud-generate now produces per-user authorized_keys files and tars + them up. On the receiving end ud-replicate takes the tar and + syncs it to userkeys/. The goal here is to no longer require + a patched sshd. Setting AuthorizedKeysFile2 to + /var/lib/misc/userkeys/%u is sufficient. For homedir creation + we can use pam_mkhomedir. [mhy, sgran] + + -- Peter Palfrader Sat, 17 May 2008 11:34:20 +0200 userdir-ldap (0.3.23) unstable; urgency=low diff --git a/ud-mailgate b/ud-mailgate index b158ba8..4da4382 100755 --- a/ud-mailgate +++ b/ud-mailgate @@ -30,7 +30,7 @@ SeenList = {} DNS = {} SSHFingerprint = re.compile('^(\d+) ([0-9a-f\:]{47}) (.+)$') -SSHRSA1Match = re.compile('^\d+ (\d+) \d+ .*') +SSHRSA1Match = re.compile('^^(.* )?\d+ \d+ \d+') ArbChanges = {"c": "..", "l": ".*", @@ -242,7 +242,7 @@ def DoSSH(Str, Attrs, badkeys, uid): g = Match.groups() typekey = g[1] if Match == None: - Match =SSHRSA1Match.match(Str) + Match = SSHRSA1Match.match(Str) if Match is not None: return "RSA1 keys not supported anymore" return None; diff --git a/ud-replicate b/ud-replicate index d1c0b24..f148bf6 100755 --- a/ud-replicate +++ b/ud-replicate @@ -4,7 +4,7 @@ # Copyright (c) 2002-2003,2006 Ryan Murray # Copyright (c) 2004-2005 Joey Schulze # Copyright (c) 2008 Peter Palfrader -# Copyright (©) 2008 Stephen Gran +# Copyright (c) 2008 Stephen Gran # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -88,11 +88,11 @@ if [ -e ${HOST}/ssh-keys.tar.gz ]; then rsync -a --delete-after $tempdir/ userkeys/ fi +CHROOTS="" if [ -x /usr/bin/dchroot ]; then CHROOTS=`dchroot --listpaths` -fi -if [ -x /usr/bin/dchroot-dsa ]; then - CHROOTS=$(dchroot-dsa -i | grep Location | awk '{print $2}') +elif [ -x /usr/bin/dchroot-dsa ]; then + CHROOTS=$(dchroot-dsa -i | grep Location | awk '{print $2}') fi if [ -n "$CHROOTS" ]; then for c in $CHROOTS; do