8957l1.txt0100664000175300003300000000672710505053612011467 0ustar jillljedit#!/bin/sh # tfssh (two-factor ssh) # # Copyright (c) 2006 by Paul Sery (pgsery@swcp.com) # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # # This script helps separate keys used to authenticate on one machine # from all # other keys. Using this script creates separate ssh-agent intances for each # connection. Dedicating an agent for each machine connection prevents an # intruder on one machine from gaining access to the keys used to authenticate # on other machines. # # (Alternatively, you can use the the ssh-add -c (confirm) option when adding # keys to a single agent. You will be queried whether to allow the # use of a key # every time you log into a machine. Local user confirmation should # provide the # same security function as this script. However, I feel uncomfortable # "putting all my eggs in one basket" and prefer to use one agent # per machine.) # default TTL = 10 minutes TTL=600 ALG=rsa USEAGENT=1 [ -z $1 ] && echo "usage: tfssh [user@]hostname [keydir]" && exit [ $1 == '--help' ] && echo "usage: tfssh [user@]hostname [keydir]" && exit USER=${1%%@*} HOST=${1##*@} # parse user and destination host if [ $USER == $HOST ] ; then DST=$LOGNAME@$HOST else DST=$USER@$HOST fi RDST=root@$HOST # find ssh and ssh-agent [ -f /bin/ssh ] && SSH=/bin/ssh [ -f /usr/bin/ssh ] && SSH=/usr/bin/ssh [ -f /usr/local/bin/ssh ] && SSH=/usr/local/bin/ssh [ -f /opt/bin/ssh ] && SSH=/opt/bin/ssh [ -f /bin/ssh-agent ] && SSHAGENT=/bin/ssh-agent [ -f /usr/bin/ssh-agent ] && SSHAGENT=/usr/bin/ssh-agent [ -f /usr/local/bin/ssh-agent ] && SSHAGENT=/usr/local/bin/ssh-agent [ -f /opt/bin/ssh-agent ] && SSHAGENT=/opt/bin/ssh-agent # set key location directory [ -z $2 ] && KEYDIR=$HOME/.ssh || KEYDIR=$2 #[ -z $2 ] && KEYDIR=/media/usbdisk/keys || KEYDIR=$2 #[ -z $2 ] && KEYDIR=$HOME/keys || KEYDIR=$2 # ask user to create root key if necessary [ ! -r $KEYDIR/key-$ALG-$DST ] && echo "Please create and configure key-$ALG-$DST" [ ! -r $KEYDIR/key-$ALG-$RDST ] && echo "Please create and configure key-$ALG-$RDST" # start ssh-agent if necessary (SSH_AUTH_SOCK gets set either way) [ ! -d $HOME/tmp ] && mkdir $HOME/tmp pgrep -f "$SSHAGENT -a $HOME/tmp/ssh-agent-$HOST" > /dev/null if [ $? -eq 0 ] ; then echo "connect to existing agent" export SSH_AUTH_SOCK=$HOME/tmp/ssh-agent-$HOST else echo "start ssh-agent" rm -f $HOME/tmp/ssh-agent-$HOST eval `$SSHAGENT -a $HOME/tmp/ssh-agent-$HOST` fi # add root's key to ssh-agent if necessary ssh-add -l | grep key-$ALG-$RDST [ $? -eq 1 ] && ssh-add -t $TTL $KEYDIR/key-$ALG-$RDST # add regular acct key to ssh-agent if USEAGENT set # otherwise, ask for key passphrase if [ $USEAGENT ] ; then ssh-add -l | grep key-$ALG-$DST [ $? -ne 0 ] && ssh-add -t $TTL $KEYDIR/key-$ALG-$DST $SSH -A $DST else $SSH -A -i $KEYDIR/key-$ALG-$DST $DST fi # end of tfssh