2017-01-31 12:33:47 +00:00
|
|
|
# Public Domain
|
|
|
|
|
# Zev Weiss, 2016
|
2018-08-28 10:47:58 +00:00
|
|
|
# $OpenBSD: allow-deny-users.sh,v 1.5 2018/07/13 02:13:50 djm Exp $
|
2017-01-31 12:33:47 +00:00
|
|
|
|
|
|
|
|
tid="AllowUsers/DenyUsers"
|
|
|
|
|
|
|
|
|
|
me="$LOGNAME"
|
2017-08-03 10:10:20 +00:00
|
|
|
if [ "x$me" = "x" ]; then
|
2017-01-31 12:33:47 +00:00
|
|
|
me=`whoami`
|
|
|
|
|
fi
|
|
|
|
|
other="nobody"
|
|
|
|
|
|
2018-08-28 10:47:58 +00:00
|
|
|
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
|
|
|
|
|
|
2017-01-31 12:33:47 +00:00
|
|
|
test_auth()
|
|
|
|
|
{
|
|
|
|
|
deny="$1"
|
|
|
|
|
allow="$2"
|
|
|
|
|
should_succeed="$3"
|
|
|
|
|
failmsg="$4"
|
|
|
|
|
|
2018-08-28 10:47:58 +00:00
|
|
|
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
|
|
|
|
|
echo DenyUsers="$deny" >> $OBJ/sshd_proxy
|
|
|
|
|
echo AllowUsers="$allow" >> $OBJ/sshd_proxy
|
|
|
|
|
|
2017-01-31 12:33:47 +00:00
|
|
|
start_sshd -oDenyUsers="$deny" -oAllowUsers="$allow"
|
|
|
|
|
|
2018-08-28 10:47:58 +00:00
|
|
|
${SSH} -F $OBJ/ssh_proxy "$me@somehost" true
|
2017-01-31 12:33:47 +00:00
|
|
|
status=$?
|
|
|
|
|
|
|
|
|
|
if (test $status -eq 0 && ! $should_succeed) \
|
|
|
|
|
|| (test $status -ne 0 && $should_succeed); then
|
|
|
|
|
fail "$failmsg"
|
|
|
|
|
fi
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# DenyUsers AllowUsers should_succeed failure_message
|
|
|
|
|
test_auth "" "" true "user in neither DenyUsers nor AllowUsers denied"
|
|
|
|
|
test_auth "$other $me" "" false "user in DenyUsers allowed"
|
|
|
|
|
test_auth "$me $other" "" false "user in DenyUsers allowed"
|
|
|
|
|
test_auth "" "$other" false "user not in AllowUsers allowed"
|
|
|
|
|
test_auth "" "$other $me" true "user in AllowUsers denied"
|
|
|
|
|
test_auth "" "$me $other" true "user in AllowUsers denied"
|
|
|
|
|
test_auth "$me $other" "$me $other" false "user in both DenyUsers and AllowUsers allowed"
|
|
|
|
|
test_auth "$other $me" "$other $me" false "user in both DenyUsers and AllowUsers allowed"
|
