| # $OpenBSD: keytype.sh,v 1.9 2019/11/26 23:43:10 djm Exp $ |
| # Placed in the Public Domain. |
| |
| tid="login with different key types" |
| |
| cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak |
| cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak |
| |
| # Construct list of key types based on what the built binaries support. |
| ktypes="" |
| for i in ${SSH_KEYTYPES}; do |
| case "$i" in |
| ssh-dss) ktypes="$ktypes dsa-1024" ;; |
| ssh-rsa) ktypes="$ktypes rsa-2048 rsa-3072" ;; |
| ssh-ed25519) ktypes="$ktypes ed25519-512" ;; |
| ecdsa-sha2-nistp256) ktypes="$ktypes ecdsa-256" ;; |
| ecdsa-sha2-nistp384) ktypes="$ktypes ecdsa-384" ;; |
| ecdsa-sha2-nistp521) ktypes="$ktypes ecdsa-521" ;; |
| sk-ssh-ed25519*) ktypes="$ktypes ed25519-sk" ;; |
| sk-ecdsa-sha2-nistp256*) ktypes="$ktypes ecdsa-sk" ;; |
| esac |
| done |
| |
| for kt in $ktypes; do |
| rm -f $OBJ/key.$kt |
| xbits=`echo ${kt} | awk -F- '{print $2}'` |
| xtype=`echo ${kt} | awk -F- '{print $1}'` |
| case "$kt" in |
| *sk) type="$kt"; bits="n/a"; bits_arg="";; |
| *) type=$xtype; bits=$xbits; bits_arg="-b $bits";; |
| esac |
| verbose "keygen $type, $bits bits" |
| ${SSHKEYGEN} $bits_arg -q -N '' -t $type -f $OBJ/key.$kt || \ |
| fail "ssh-keygen for type $type, $bits bits failed" |
| done |
| |
| kname_to_ktype() { |
| case $1 in |
| dsa-1024) echo ssh-dss;; |
| ecdsa-256) echo ecdsa-sha2-nistp256;; |
| ecdsa-384) echo ecdsa-sha2-nistp384;; |
| ecdsa-521) echo ecdsa-sha2-nistp521;; |
| ed25519-512) echo ssh-ed25519;; |
| rsa-*) echo rsa-sha2-512,rsa-sha2-256,ssh-rsa;; |
| ed25519-sk) echo sk-ssh-ed25519@openssh.com;; |
| ecdsa-sk) echo sk-ecdsa-sha2-nistp256@openssh.com;; |
| esac |
| } |
| |
| tries="1 2 3" |
| for ut in $ktypes; do |
| user_type=`kname_to_ktype "$ut"` |
| # SK keys are not supported for hostkeys. |
| case "$ut" in |
| *sk) htypes=ed25519-512;; |
| *) htypes="$ut";; |
| esac |
| #htypes=$ktypes |
| for ht in $htypes; do |
| host_type=`kname_to_ktype "$ht"` |
| trace "ssh connect, userkey $ut, hostkey $ht" |
| ( |
| grep -v HostKey $OBJ/sshd_proxy_bak |
| echo HostKey $OBJ/key.$ht |
| echo PubkeyAcceptedKeyTypes $user_type |
| echo HostKeyAlgorithms $host_type |
| ) > $OBJ/sshd_proxy |
| ( |
| grep -v IdentityFile $OBJ/ssh_proxy_bak |
| echo IdentityFile $OBJ/key.$ut |
| echo PubkeyAcceptedKeyTypes $user_type |
| echo HostKeyAlgorithms $host_type |
| ) > $OBJ/ssh_proxy |
| ( |
| printf 'localhost-with-alias,127.0.0.1,::1 ' |
| cat $OBJ/key.$ht.pub |
| ) > $OBJ/known_hosts |
| cat $OBJ/key.$ut.pub > $OBJ/authorized_keys_$USER |
| for i in $tries; do |
| verbose "userkey $ut, hostkey ${ht}" |
| ${SSH} -F $OBJ/ssh_proxy 999.999.999.999 true |
| if [ $? -ne 0 ]; then |
| fail "ssh userkey $ut, hostkey $ht failed" |
| fi |
| done |
| done |
| done |