diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2015-10-29 08:05:18 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2015-10-29 08:05:18 +0000 |
| commit | 5ac23c8fb9a2cf3c1fbfde37469c21817fe94ec1 (patch) | |
| tree | abadab71f618394d7c115afce5318bc42653790c /regress | |
| parent | 3a057be6941d3f825782702bbbe16d36207e2ee3 (diff) | |
regress test for "PubkeyAcceptedKeyTypes +..." inside a Match block
Diffstat (limited to 'regress')
| -rw-r--r-- | regress/usr.bin/ssh/limit-keytype.sh | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/regress/usr.bin/ssh/limit-keytype.sh b/regress/usr.bin/ssh/limit-keytype.sh index 71781b26ea1..c0cf2fed6d8 100644 --- a/regress/usr.bin/ssh/limit-keytype.sh +++ b/regress/usr.bin/ssh/limit-keytype.sh @@ -1,4 +1,4 @@ -# $OpenBSD: limit-keytype.sh,v 1.3 2015/10/26 02:50:58 dtucker Exp $ +# $OpenBSD: limit-keytype.sh,v 1.4 2015/10/29 08:05:17 djm Exp $ # Placed in the Public Domain. tid="restrict pubkey type" @@ -20,6 +20,8 @@ ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key2 || \ fatal "ssh-keygen failed" ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key3 || \ fatal "ssh-keygen failed" +${SSHKEYGEN} -q -N '' -t dsa -f $OBJ/user_key4 || \ + fatal "ssh-keygen failed" ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \ -z $$ -n ${USER},mekmitasdigoat $OBJ/user_key3 || fatal "couldn't sign user_key1" @@ -77,3 +79,19 @@ ${SSH} $certopts proxy true || fatal "cert failed" ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded" ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded" +# Allow RSA in main config, Ed25519 for non-existent user. +verbose "match w/ no match" +prepare_config "PubkeyAcceptedKeyTypes ssh-rsa" \ + "Match user x$USER" "PubkeyAcceptedKeyTypes +ssh-ed25519" +${SSH} $certopts proxy true && fatal "cert succeeded" +${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded" +${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" + +# Allow only DSA in main config, Ed25519 for user. +verbose "match w/ matching" +prepare_config "PubkeyAcceptedKeyTypes ssh-dss" \ + "Match user $USER" "PubkeyAcceptedKeyTypes +ssh-ed25519" +${SSH} $certopts proxy true || fatal "cert failed" +${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed" +${SSH} $opts -i $OBJ/user_key4 proxy true && fatal "key4 succeeded" + |