/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen

  • Committer: Teddy Hogeborn
  • Date: 2024-11-15 11:02:39 UTC
  • Revision ID: teddy@recompile.se-20241115110239-1t2yh76c1ap7wlmm
mandos-keygen: Avoid comment lines from ssh-keyscan

In ssh-keyscan from OpenSSH 9.8, comment lines containing the hostname
and SSH protocol banner are emitted by to standard output.  Avoid this
by passing the "-q" (quiet) option to ssh-keyscan.

mandos-keygen: When scanning localhost for keys, try to run
"ssh-keyscan" both with and without the "-q" option.  If the "-q"
option worked, use the option also in the generated checker command.

Reported-By: bb <bb@tsufeki.eu>
Thanks: bb <bb@tsufeki.eu> for analysis

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen
331
331
    esac
332
332
 
333
333
    if [ $SSH -eq 1 ]; then
334
 
        for ssh_keytype in ecdsa-sha2-nistp256 ed25519 rsa; do
335
 
            set +e
336
 
            ssh_fingerprint="`ssh-keyscan -t $ssh_keytype localhost 2>/dev/null`"
337
 
            err=$?
338
 
            set -e
339
 
            if [ $err -ne 0 ]; then
340
 
                ssh_fingerprint=""
341
 
                continue
342
 
            fi
343
 
            if [ -n "$ssh_fingerprint" ]; then
344
 
                ssh_fingerprint="${ssh_fingerprint#localhost }"
345
 
                break
346
 
            fi
 
334
        # The -q option is new in OpenSSH 9.8
 
335
        for ssh_keyscan_quiet in "-q " ""; do
 
336
            for ssh_keytype in ecdsa-sha2-nistp256 ed25519 rsa; do
 
337
                set +e
 
338
                ssh_fingerprint="`ssh-keyscan ${ssh_keyscan_quiet}-t $ssh_keytype localhost 2>/dev/null`"
 
339
                err=$?
 
340
                set -e
 
341
                if [ $err -ne 0 ]; then
 
342
                    ssh_fingerprint=""
 
343
                    continue
 
344
                fi
 
345
                if [ -n "$ssh_fingerprint" ]; then
 
346
                    ssh_fingerprint="${ssh_fingerprint#localhost }"
 
347
                    break 2
 
348
                fi
 
349
            done
347
350
        done
348
351
    fi
349
352
 
434
437
            }
435
438
        }' < "$SECFILE"
436
439
    if [ -n "$ssh_fingerprint" ]; then
437
 
        echo 'checker = ssh-keyscan -t '"$ssh_keytype"' %%(host)s 2>/dev/null | grep --fixed-strings --line-regexp --quiet --regexp=%%(host)s" %(ssh_fingerprint)s"'
 
440
        echo 'checker = ssh-keyscan '"$ssh_keyscan_quiet"'-t '"$ssh_keytype"' %%(host)s 2>/dev/null | grep --fixed-strings --line-regexp --quiet --regexp=%%(host)s" %(ssh_fingerprint)s"'
438
441
        echo "ssh_fingerprint = ${ssh_fingerprint}"
439
442
    fi
440
443
fi