version 1.325, 2019/01/23 04:16:22 |
version 1.334, 2019/07/05 04:55:40 |
|
|
#include "xmalloc.h" |
#include "xmalloc.h" |
#include "sshkey.h" |
#include "sshkey.h" |
#include "authfile.h" |
#include "authfile.h" |
#include "uuencode.h" |
|
#include "sshbuf.h" |
#include "sshbuf.h" |
#include "pathnames.h" |
#include "pathnames.h" |
#include "log.h" |
#include "log.h" |
|
|
# define DEFAULT_KEY_TYPE_NAME "ed25519" |
# define DEFAULT_KEY_TYPE_NAME "ed25519" |
#endif |
#endif |
|
|
/* Number of bits in the RSA/DSA key. This value can be set on the command line. */ |
/* |
#define DEFAULT_BITS 2048 |
* Default number of bits in the RSA, DSA and ECDSA keys. These value can be |
|
* overridden on the command line. |
|
* |
|
* These values, with the exception of DSA, provide security equivalent to at |
|
* least 128 bits of security according to NIST Special Publication 800-57: |
|
* Recommendation for Key Management Part 1 rev 4 section 5.6.1. |
|
* For DSA it (and FIPS-186-4 section 4.2) specifies that the only size for |
|
* which a 160bit hash is acceptable is 1kbit, and since ssh-dss specifies only |
|
* SHA1 we limit the DSA key size 1k bits. |
|
*/ |
|
#define DEFAULT_BITS 3072 |
#define DEFAULT_BITS_DSA 1024 |
#define DEFAULT_BITS_DSA 1024 |
#define DEFAULT_BITS_ECDSA 256 |
#define DEFAULT_BITS_ECDSA 256 |
|
|
|
|
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
if (stat(identity_file, &st) < 0) |
if (stat(identity_file, &st) == -1) |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
if ((r = sshkey_load_public(identity_file, &k, NULL)) != 0) |
if ((r = sshkey_load_public(identity_file, &k, NULL)) != 0) |
k = load_identity(identity_file); |
k = load_identity(identity_file); |
|
|
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
if (stat(identity_file, &st) < 0) |
if (stat(identity_file, &st) == -1) |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
|
|
switch (convert_format) { |
switch (convert_format) { |
|
|
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
if (stat(identity_file, &st) < 0) |
if (stat(identity_file, &st) == -1) |
fatal("%s: %s", identity_file, strerror(errno)); |
fatal("%s: %s", identity_file, strerror(errno)); |
prv = load_identity(identity_file); |
prv = load_identity(identity_file); |
if ((r = sshkey_write(prv, stdout)) != 0) |
if ((r = sshkey_write(prv, stdout)) != 0) |
|
|
fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash; |
fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash; |
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT; |
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT; |
|
|
pkcs11_init(0); |
pkcs11_init(1); |
nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys); |
nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys); |
if (nkeys <= 0) |
if (nkeys <= 0) |
fatal("cannot read public key from pkcs11"); |
fatal("cannot read public key from pkcs11"); |
|
|
struct sshkey *public = NULL; |
struct sshkey *public = NULL; |
int r; |
int r; |
|
|
if (stat(identity_file, &st) < 0) |
if (stat(identity_file, &st) == -1) |
fatal("%s: %s", path, strerror(errno)); |
fatal("%s: %s", path, strerror(errno)); |
if ((r = sshkey_load_public(path, &public, &comment)) != 0) { |
if ((r = sshkey_load_public(path, &public, &comment)) != 0) { |
debug("load public \"%s\": %s", path, ssh_err(r)); |
debug("load public \"%s\": %s", path, ssh_err(r)); |
|
|
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
if (stat(identity_file, &st) < 0) |
if (stat(identity_file, &st) == -1) |
fatal("%s: %s", identity_file, strerror(errno)); |
fatal("%s: %s", identity_file, strerror(errno)); |
/* Try to load the file with empty passphrase. */ |
/* Try to load the file with empty passphrase. */ |
r = sshkey_load_private(identity_file, "", &private, &comment); |
r = sshkey_load_private(identity_file, "", &private, &comment); |
|
|
|
|
if (fname == NULL) |
if (fname == NULL) |
fatal("%s: no filename", __func__); |
fatal("%s: no filename", __func__); |
if (stat(fname, &st) < 0) { |
if (stat(fname, &st) == -1) { |
if (errno == ENOENT) |
if (errno == ENOENT) |
return 0; |
return 0; |
fatal("%s: %s", fname, strerror(errno)); |
fatal("%s: %s", fname, strerror(errno)); |
|
|
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
if (stat(identity_file, &st) < 0) |
if (stat(identity_file, &st) == -1) |
fatal("%s: %s", identity_file, strerror(errno)); |
fatal("%s: %s", identity_file, strerror(errno)); |
if ((r = sshkey_load_private(identity_file, "", |
if ((r = sshkey_load_private(identity_file, "", |
&private, &comment)) == 0) |
&private, &comment)) == 0) |
|
|
exit(1); |
exit(1); |
} |
} |
if (comment) |
if (comment) |
printf("Key now has comment '%s'\n", comment); |
printf("Old comment: %s\n", comment); |
else |
else |
printf("Key now has no comment\n"); |
printf("No existing comment\n"); |
|
|
if (identity_comment) { |
if (identity_comment) { |
strlcpy(new_comment, identity_comment, sizeof(new_comment)); |
strlcpy(new_comment, identity_comment, sizeof(new_comment)); |
} else { |
} else { |
printf("Enter new comment: "); |
printf("New comment: "); |
fflush(stdout); |
fflush(stdout); |
if (!fgets(new_comment, sizeof(new_comment), stdin)) { |
if (!fgets(new_comment, sizeof(new_comment), stdin)) { |
explicit_bzero(passphrase, strlen(passphrase)); |
explicit_bzero(passphrase, strlen(passphrase)); |
|
|
} |
} |
new_comment[strcspn(new_comment, "\n")] = '\0'; |
new_comment[strcspn(new_comment, "\n")] = '\0'; |
} |
} |
|
if (comment != NULL && strcmp(comment, new_comment) == 0) { |
|
printf("No change to comment\n"); |
|
free(passphrase); |
|
sshkey_free(private); |
|
free(comment); |
|
exit(0); |
|
} |
|
|
/* Save the file using the new passphrase. */ |
/* Save the file using the new passphrase. */ |
if ((r = sshkey_save_private(private, identity_file, passphrase, |
if ((r = sshkey_save_private(private, identity_file, passphrase, |
|
|
|
|
free(comment); |
free(comment); |
|
|
printf("The comment in your key file has been changed.\n"); |
if (strlen(new_comment) > 0) |
|
printf("Comment '%s' applied\n", new_comment); |
|
else |
|
printf("Comment removed\n"); |
|
|
exit(0); |
exit(0); |
} |
} |
|
|
|
|
|
|
/* Signer for sshkey_certify_custom that uses the agent */ |
/* Signer for sshkey_certify_custom that uses the agent */ |
static int |
static int |
agent_signer(const struct sshkey *key, u_char **sigp, size_t *lenp, |
agent_signer(struct sshkey *key, u_char **sigp, size_t *lenp, |
const u_char *data, size_t datalen, |
const u_char *data, size_t datalen, |
const char *alg, u_int compat, void *ctx) |
const char *alg, u_int compat, void *ctx) |
{ |
{ |
|
|
|
|
static void |
static void |
do_ca_sign(struct passwd *pw, const char *ca_key_path, int prefer_agent, |
do_ca_sign(struct passwd *pw, const char *ca_key_path, int prefer_agent, |
unsigned long long cert_serial, int argc, char **argv) |
unsigned long long cert_serial, int cert_serial_autoinc, |
|
int argc, char **argv) |
{ |
{ |
int r, i, fd, found, agent_fd = -1; |
int r, i, fd, found, agent_fd = -1; |
u_int n; |
u_int n; |
|
|
|
|
sshkey_free(public); |
sshkey_free(public); |
free(out); |
free(out); |
|
if (cert_serial_autoinc) |
|
cert_serial++; |
} |
} |
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
pkcs11_terminate(); |
pkcs11_terminate(); |
|
|
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) < 0) |
if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) == -1) |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
|
|
path = identity_file; |
path = identity_file; |
|
|
int find_host = 0, delete_host = 0, hash_hosts = 0; |
int find_host = 0, delete_host = 0, hash_hosts = 0; |
int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0; |
int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0; |
int prefer_agent = 0, convert_to = 0, convert_from = 0; |
int prefer_agent = 0, convert_to = 0, convert_from = 0; |
int print_public = 0, print_generic = 0; |
int print_public = 0, print_generic = 0, cert_serial_autoinc = 0; |
unsigned long long cert_serial = 0; |
unsigned long long cert_serial = 0; |
char *identity_comment = NULL, *ca_key_path = NULL; |
char *identity_comment = NULL, *ca_key_path = NULL; |
u_int bits = 0; |
u_int bits = 0; |
|
|
extern int optind; |
extern int optind; |
extern char *optarg; |
extern char *optarg; |
|
|
ssh_malloc_init(); /* must be called before any mallocs */ |
|
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ |
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ |
sanitise_stdfd(); |
sanitise_stdfd(); |
|
|
|
|
pw = getpwuid(getuid()); |
pw = getpwuid(getuid()); |
if (!pw) |
if (!pw) |
fatal("No user exists for uid %lu", (u_long)getuid()); |
fatal("No user exists for uid %lu", (u_long)getuid()); |
if (gethostname(hostname, sizeof(hostname)) < 0) |
if (gethostname(hostname, sizeof(hostname)) == -1) |
fatal("gethostname: %s", strerror(errno)); |
fatal("gethostname: %s", strerror(errno)); |
|
|
/* Remaining characters: Ydw */ |
/* Remaining characters: Ydw */ |
|
|
break; |
break; |
case 'z': |
case 'z': |
errno = 0; |
errno = 0; |
|
if (*optarg == '+') { |
|
cert_serial_autoinc = 1; |
|
optarg++; |
|
} |
cert_serial = strtoull(optarg, &ep, 10); |
cert_serial = strtoull(optarg, &ep, 10); |
if (*optarg < '0' || *optarg > '9' || *ep != '\0' || |
if (*optarg < '0' || *optarg > '9' || *ep != '\0' || |
(errno == ERANGE && cert_serial == ULLONG_MAX)) |
(errno == ERANGE && cert_serial == ULLONG_MAX)) |
|
|
if (ca_key_path != NULL) { |
if (ca_key_path != NULL) { |
if (cert_key_id == NULL) |
if (cert_key_id == NULL) |
fatal("Must specify key id (-I) when certifying"); |
fatal("Must specify key id (-I) when certifying"); |
do_ca_sign(pw, ca_key_path, prefer_agent, cert_serial, |
do_ca_sign(pw, ca_key_path, prefer_agent, |
argc, argv); |
cert_serial, cert_serial_autoinc, argc, argv); |
} |
} |
if (show_cert) |
if (show_cert) |
do_show_cert(pw); |
do_show_cert(pw); |
|
|
snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", |
snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", |
pw->pw_dir, _PATH_SSH_USER_DIR); |
pw->pw_dir, _PATH_SSH_USER_DIR); |
if (strstr(identity_file, dotsshdir) != NULL) { |
if (strstr(identity_file, dotsshdir) != NULL) { |
if (stat(dotsshdir, &st) < 0) { |
if (stat(dotsshdir, &st) == -1) { |
if (errno != ENOENT) { |
if (errno != ENOENT) { |
error("Could not stat %s: %s", dotsshdir, |
error("Could not stat %s: %s", dotsshdir, |
strerror(errno)); |
strerror(errno)); |
} else if (mkdir(dotsshdir, 0700) < 0) { |
} else if (mkdir(dotsshdir, 0700) == -1) { |
error("Could not create directory '%s': %s", |
error("Could not create directory '%s': %s", |
dotsshdir, strerror(errno)); |
dotsshdir, strerror(errno)); |
} else if (!quiet) |
} else if (!quiet) |