You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
305 lines
9.5 KiB
305 lines
9.5 KiB
#!/bin/sh |
|
## |
|
## ssh-keyman -- authentication key agent management |
|
## Copyright (c) 2002-2003 Ralf S. Engelschall <rse@engelschall.com> |
|
## |
|
## Permission to use, copy, modify, and distribute this software for |
|
## any purpose with or without fee is hereby granted, provided that |
|
## the above copyright notice and this permission notice appear in all |
|
## copies. |
|
## |
|
## THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED |
|
## WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF |
|
## MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
|
## IN NO EVENT SHALL THE AUTHORS AND COPYRIGHT HOLDERS AND THEIR |
|
## CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
|
## SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
|
## LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF |
|
## USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
|
## ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, |
|
## OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT |
|
## OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
|
## SUCH DAMAGE. |
|
## |
|
## ssh-keyman: program implementation (language: Bourne-Shell) |
|
## |
|
|
|
# program information |
|
prog_name="ssh-keyman" |
|
prog_vers="1.0.1" |
|
prog_date="31-May-2002" |
|
|
|
# OpenSSH programs |
|
ssh_agent="@l_prefix@/bin/ssh-agent" |
|
ssh_add="@l_prefix@/bin/ssh-add" |
|
ssh="@l_prefix@/bin/ssh" |
|
|
|
# parse command line options |
|
opt_q=no; alias_quiet=q |
|
opt_c=no; alias_cluster=c |
|
opt_e=no; alias_env=e |
|
opt_s=no; alias_start=s |
|
opt_k=no; alias_kill=k |
|
opt_a=no; alias_add=a |
|
opt_d=no; alias_delete=d |
|
opt_l=no; alias_list=l |
|
opt_i=no; alias_install=i |
|
opt_h=no; alias_help=h |
|
opt_v=no; alias_version=v |
|
if [ $# -eq 0 ]; then |
|
opt_h=yes |
|
fi |
|
while [ $# -gt 0 ]; do |
|
if [ ".$1" = ".--" ]; then |
|
shift |
|
break |
|
fi |
|
case $1 in |
|
--quiet|--cluster|--env|--start|--kill|--add|--delete|--list|--help|--version ) |
|
name=`echo x$1 | sed -e 's;^x--;;'` |
|
eval "name=\$alias_${name}" |
|
eval "opt_${name}=yes" |
|
;; |
|
-[qceskadlihv] ) |
|
name=`echo x$1 | sed -e 's;^x-;;'` |
|
eval "opt_${name}=yes" |
|
;; |
|
-* ) |
|
echo "$prog_name:ERROR: unknown option \"$opt\"" 1>&2 |
|
exit 1 |
|
;; |
|
* ) |
|
break |
|
;; |
|
esac |
|
shift |
|
done |
|
|
|
# stand-alone operation: display help information |
|
if [ ".$opt_h" = .yes ]; then |
|
echo "Usage: $prog_name [-h] [-v] [-q] [-c] [-e] [-s] [-k] [-a] [-d] [-l] [-i] [keyfile ...]" |
|
exit 0 |
|
fi |
|
|
|
# stand-alone operation: display version information |
|
if [ ".$opt_v" = .yes ]; then |
|
echo "$prog_name $prog_vers ($prog_date)" |
|
exit 0 |
|
fi |
|
|
|
# determine agent information filename |
|
hostname=`hostname` |
|
agentfile="$HOME/.ssh/agent-$hostname" |
|
if [ ".$opt_c" = .no ]; then |
|
if [ ! -f $agentfile ]; then |
|
agentfile="$HOME/.ssh/agent" |
|
fi |
|
fi |
|
|
|
# export agent configuration |
|
export SSH_AUTH_SOCK |
|
export SSH_AGENT_PID |
|
|
|
# perform agent information sanity check |
|
check_agent_info () { |
|
context="$1" |
|
invalid1="" |
|
invalid2="" |
|
if [ ".$SSH_AUTH_SOCK" != . ]; then |
|
# make sure the agent socket is (still) working |
|
if [ ! -r $SSH_AUTH_SOCK ]; then |
|
invalid1="agent socket $SSH_AUTH_SOCK no longer exists" |
|
else |
|
$ssh_add -l >/dev/null 2>&1 |
|
if [ $? -eq 2 ]; then |
|
invalid1="agent socket $SSH_AUTH_SOCK no longer valid" |
|
fi |
|
fi |
|
fi |
|
if [ ".$SSH_AGENT_PID" != . ]; then |
|
# make sure the agent process is (still) running |
|
kill -0 $SSH_AGENT_PID >/dev/null 2>&1 |
|
if [ $? -ne 0 ]; then |
|
invalid2="agent process $SSH_AGENT_PID no longer exists" |
|
fi |
|
fi |
|
if [ ".$invalid1" != . -o ".$invalid2" != . ]; then |
|
if [ ".$opt_e" = .no ]; then |
|
echo "$prog_name:WARNING: invalid agent setup found in $context." 1>&2 |
|
if [ ".$invalid1" != . ]; then |
|
echo "$prog_name:WARNING: reason: $invalid1." 1>&2 |
|
fi |
|
if [ ".$invalid2" != . ]; then |
|
echo "$prog_name:WARNING: reason: $invalid2." 1>&2 |
|
fi |
|
if [ ".$context" = ".your shell environment" ]; then |
|
echo "$prog_name:HINT: run \"eval \`$prog_name -q -s -e\`\" to fix." 1>&2 |
|
fi |
|
fi |
|
unset SSH_AUTH_SOCK |
|
unset SSH_AGENT_PID |
|
fi |
|
} |
|
check_agent_info "your shell environment" |
|
if [ -f $agentfile ]; then |
|
. $agentfile |
|
check_agent_info "in saved agent state" |
|
if [ ".$SSH_AUTH_SOCK" = . -o ".$SSH_AGENT_PID" = . ]; then |
|
rm -f $agentfile |
|
fi |
|
fi |
|
|
|
# if (now guarrantied to be correct) agent state is in |
|
# environment, but it is (no longer?) saved, save it now to fix situation. |
|
if [ ! -f $agentfile ]; then |
|
if [ ".$SSH_AUTH_SOCK" != . -a ".$SSH_AGENT_PID" != . ]; then |
|
( echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" |
|
echo "SSH_AGENT_PID=$SSH_AGENT_PID" |
|
) >$agentfile && chmod 600 $agentfile |
|
echo "$prog_name:WARNING: valid agent information in your environment" 1>&2 |
|
echo "$prog_name:WARNING: but no saved agent state file -- fixed" 1>&2 |
|
fi |
|
fi |
|
|
|
# stop the agent |
|
if [ ".$opt_k" = .yes ]; then |
|
# stop the agent |
|
kill=yes |
|
|
|
if [ ".$SSH_AUTH_SOCK" != . -a ".$SSH_AGENT_PID" != . ]; then |
|
kill $SSH_AGENT_PID >/dev/null 2>&1 || true |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: stopped agent (pid $SSH_AGENT_PID)" 1>&2 |
|
fi |
|
rm -f $agentfile |
|
unset SSH_AUTH_SOCK |
|
unset SSH_AGENT_PID |
|
elif [ ".$SSH_AUTH_SOCK" != . -a ".$SSH_AGENT_PID" = . ]; then |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: agent running remotely - cannot kill locally" 1>&2 |
|
fi |
|
else |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: agent not running" 1>&2 |
|
fi |
|
fi |
|
fi |
|
|
|
# start the agent |
|
if [ ".$opt_s" = .yes ]; then |
|
if [ ".$SSH_AUTH_SOCK" = . -a ".$SSH_AGENT_PID" = . ]; then |
|
eval `nohup $ssh_agent -s </dev/null 2>/dev/null | grep -v 'Agent pid'` |
|
if [ ".$opt_q" != .yes ]; then |
|
echo "$prog_name: spawned agent (pid $SSH_AGENT_PID)" 1>&2 |
|
fi |
|
( echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" |
|
echo "SSH_AGENT_PID=$SSH_AGENT_PID" |
|
) >$agentfile && chmod 600 $agentfile |
|
elif [ ".$SSH_AUTH_SOCK" != . -a ".$SSH_AGENT_PID" = . ]; then |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: agent already running remotely - no need to start locally" 1>&2 |
|
fi |
|
else |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: agent already running" 1>&2 |
|
fi |
|
fi |
|
fi |
|
|
|
# setup environment |
|
if [ ".$opt_e" = .yes ]; then |
|
if [ -r $agentfile ]; then |
|
sed -e 's/$/;/g' <$agentfile |
|
echo "export SSH_AUTH_SOCK;" |
|
echo "export SSH_AGENT_PID;" |
|
else |
|
echo "$prog_name:WARNING: agent not (or no longer) available" 1>&2 |
|
echo "unset SSH_AUTH_SOCK;" |
|
echo "unset SSH_AGENT_PID;" |
|
fi |
|
fi |
|
|
|
# delete key(s) from agent |
|
if [ ".$opt_d" = .yes ]; then |
|
if [ ".$SSH_AUTH_SOCK" = . ]; then |
|
echo "$prog_name:WARNING: agent not available" 1>&2 |
|
else |
|
if [ $# -eq 0 ]; then |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: deleting all keys" 1>&2 |
|
fi |
|
$ssh_add -D |
|
else |
|
if [ ".$opt_q" = .no ]; then |
|
for key in "$@"; do |
|
echo "$prog_name: deleting key $key" 1>&2 |
|
done |
|
fi |
|
$ssh_add -d "$@" |
|
fi |
|
fi |
|
fi |
|
|
|
# add key(s) into agent |
|
if [ ".$opt_a" = .yes ]; then |
|
if [ ".$SSH_AUTH_SOCK" = . ]; then |
|
echo "$prog_name:WARNING: agent not available" 1>&2 |
|
else |
|
if [ $# -eq 0 ]; then |
|
echo "$prog_name:ERROR: no keys specified on command line" 1>&2 |
|
exit 1 |
|
fi |
|
key_loaded=`$ssh_add -l | awk '{ print $2; }'` |
|
key_missing="" |
|
for key_file in "$@"; do |
|
if [ -f "${key_file}.pub" ]; then |
|
key_this=`ssh-keygen -l -f ${key_file}.pub 2>&1 | awk '{ print $2; }'` |
|
else |
|
key_this=`ssh-keygen -l -f ${key_file} 2>&1 | awk '{ print $2; }'` |
|
fi |
|
load=yes |
|
for key in $key_loaded; do |
|
if [ ".$key" = ".$key_this" ]; then |
|
load=no |
|
break |
|
fi |
|
done |
|
if [ ".$load" = .yes ]; then |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: loading key $key_file" 1>&2 |
|
fi |
|
key_missing="$key_missing $key_file" |
|
else |
|
if [ ".$opt_q" = .no ]; then |
|
echo "$prog_name: skipping key $key_file (already loaded)" 1>&2 |
|
fi |
|
fi |
|
done |
|
if [ ".$key_missing" != . ]; then |
|
$ssh_add $key_missing |
|
fi |
|
fi |
|
fi |
|
|
|
# list key(s) available in agent |
|
if [ ".$opt_l" = .yes ]; then |
|
if [ ".$SSH_AUTH_SOCK" = . ]; then |
|
echo "$prog_name:WARNING: agent not available" 1>&2 |
|
else |
|
$ssh_add -l |
|
fi |
|
fi |
|
|
|
# install key(s) into remote account |
|
if [ ".$opt_i" = .yes ]; then |
|
if [ ".$SSH_AUTH_SOCK" = . ]; then |
|
echo "$prog_name:WARNING: agent not available" 1>&2 |
|
else |
|
for remote in "$@"; do |
|
echo "$prog_name: installing public keys into $remote" |
|
$ssh_add -L |\ |
|
$ssh $remote "umask 077; test -d ~/.ssh || mkdir ~/.ssh; cat >>~/.ssh/authorized_keys" |
|
done |
|
fi |
|
fi |
|
|
|
|