From: Joerg Jaspert Date: Wed, 14 May 2008 14:56:04 +0000 (+0200) Subject: Merge sshkeys check with the alioth userdir-ldap-common X-Git-Tag: userdir-ldap-0.3.22~1^2~1 X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fuserdir-ldap.git;a=commitdiff_plain;h=e8944811d4183fe053b2d22f0d89f91e5812253a;hp=0159c3e12f39119617f4c93319a1500284f8958a Merge sshkeys check with the alioth userdir-ldap-common --- diff --git a/debian/changelog b/debian/changelog index 8716d70..4d936b8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +userdir-ldap (0.3.21) unstable; urgency=low + + * ud-replicate: use the host key to sync stuff from the db server, + that is, call ssh with ii /etc/ssh/ssh_host_rsa_key. + * ud-replicate: Call ssh with -o PreferredAuthentications=publickey + so that it does not even try password authentication. + + -- Peter Palfrader Tue, 13 May 2008 22:06:23 +0200 + userdir-ldap (0.3.20) unstable; urgency=low * Teach ud-mailgate about ipv6 addresses (RT#193). diff --git a/ud-mailgate b/ud-mailgate index 94a4a71..51942f1 100755 --- a/ud-mailgate +++ b/ud-mailgate @@ -6,7 +6,7 @@ # Copyright (c) 2008 Joerg Jaspert import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands -import pwd, tmpfile +import pwd, tempfile from userdir_gpg import * from userdir_ldap import * @@ -236,31 +236,72 @@ def LoadBadSSH(): # Handle an SSH authentication key, the line format is: # [options] 1024 35 13188913666680[..] [comment] -def DoSSH(Str,Attrs, badkeys): +def DoSSH(Str, Attrs, badkeys, uid): Match = SSH2AuthSplit.match(Str); + g = Match.groups() + typekey = g[1] if Match == None: Match = re.compile('^1024 (\d+) ').match(Str) if Match is not None: return "SSH1 keys not supported anymore" return None; - (fd, path) = tempfile.mkstemp("", "sshkeytry") + (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp") f = open(path, "w") - f.write(Str) - f.close - (result, output) = commands.getstatusoutput("ssh-keygen -f %s -l" % (path)) + f.write("%s\n" % (Str)) + f.close() + cmd = "/usr/bin/ssh-keygen -l -f %s < /dev/null" % (path) + (result, output) = commands.getstatusoutput(cmd) os.remove(path) if (result != 0): - sys.stderr.write("ssh-keygen -l invocation failed!\n%s\n" % (output)) - sys.exit(result) + raise Error, "ssh-keygen -l invocation failed!\n%s\n" % (output) - Match = SSHFingerprint.match(output) + # Head + Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time())) + ErrReplyHead = "From: %s\nCc: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'],os.environ['SENDER'],ReplyTo,Date) + Subst = {} + Subst["__ADMIN__"] = ReplyTo + Subst["__USER__"] = uid + + Match = SSHFingerprint.match(output) g = Match.groups() - if (g[0] < 1024): - return "SSH keys must have at least 1024 bits, not added" - elif g[0] in badkeys: - return "Submitted SSH Key known to be bad and insecure, not added" + + if int(g[0]) < 1024: + try: + # Body + Subst["__ERROR__"] = "SSH keysize %s is below limit 1024" % (g[0]) + ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read()) + + Child = os.popen("/usr/sbin/sendmail -t","w") + Child.write(ErrReplyHead) + Child.write(ErrReply) + if Child.close() != None: + raise Error, "Sendmail gave a non-zero return code" + except: + sys.exit(EX_TEMPFAIL) + + # And now break and stop processing input, which sends a reply to the user. + raise Error, "SSH keys must have at least 1024 bits, processing halted, NOTHING MODIFIED AT ALL" + elif g[1] in badkeys: + try: + # Body + Subst["__ERROR__"] = "SSH key with fingerprint %s known as bad key" % (g[1]) + ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read()) + + Child = os.popen("/usr/sbin/sendmail -t","w") + Child.write(ErrReplyHead) + Child.write(ErrReply) + if Child.close() != None: + raise Error, "Sendmail gave a non-zero return code" + except: + sys.exit(EX_TEMPFAIL) + + # And now break and stop processing input, which sends a reply to the user. + raise Error, "Submitted SSH Key known to be bad and insecure, processing halted, NOTHING MODIFIED AT ALL" + + if (typekey == "dss"): + return "DSA keys not accepted anymore" global SeenKey; if SeenKey: @@ -404,12 +445,12 @@ def HandleChange(Reply,DnRecord,Key): Result = Result + "> "+Line+"\n"; try: if Line == "show": - Show = 1; - Res = "OK"; + Show = 1; + Res = "OK"; else: badkeys = LoadBadSSH() Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \ - DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys) or \ + DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys,GetAttr(DnRecord,"uid")) or \ DoDel(Line,Attrs) or DoRBL(Line,Attrs) except: Res = None; diff --git a/ud-replicate b/ud-replicate index e0f8fe7..655b263 100755 --- a/ud-replicate +++ b/ud-replicate @@ -49,7 +49,7 @@ $LOCALSYNCON) ;; esac -rsync ${verbose} -e ssh -rp "${udhost}/var/cache/userdir-ldap/hosts/$HOST" . +rsync ${verbose} -e 'ssh -i /etc/ssh/ssh_host_rsa_key -o PreferredAuthentications=publickey' -rp "${udhost}/var/cache/userdir-ldap/hosts/$HOST" . makedb "$HOST/passwd.tdb" -o passwd.db.t if [ -s "$HOST/shadow.tdb" ]