external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update the OpenSSH patch

Browse source 
Use the latest version of Damien Miller's patch to extend the parameters
to the AuthorizedKeysCommand.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
This commit is contained in:
Lukas Fleischer 2015-04-11 13:25:59 +02:00
parent 4f4cfff620
commit ef1f3798a0
5 changed files with 1063 additions and 119 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
INSTALL
View file

@ -28,7 +28,7 @@ Setup on Arch Linux
$ cd /srv/http/aurweb/ $ cd /srv/http/aurweb/
$ git clone git://anongit.mindrot.org/openssh.git $ git clone git://anongit.mindrot.org/openssh.git
$ cd openssh $ cd openssh
$ git checkout V_6_7_P1 $ git checkout V_6_8_P1
$ git am ../scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch $ git am ../scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch
$ autoreconf $ autoreconf
$ ./configure $ ./configure

2
conf/config.proto
View file

@ -28,7 +28,7 @@ auto_orphan_age = 15552000
auto_delete_age = 86400 auto_delete_age = 86400
[auth] [auth]
key-prefixes = ssh-rsa ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 valid-keytypes = ssh-rsa ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519
username-regex = [a-zA-Z0-9]+[.\-_]?[a-zA-Z0-9]+$ username-regex = [a-zA-Z0-9]+[.\-_]?[a-zA-Z0-9]+$
git-serve-cmd = /srv/http/aurweb/scripts/git-integration/git-serve.py git-serve-cmd = /srv/http/aurweb/scripts/git-integration/git-serve.py
ssh-options = no-port-forwarding,no-X11-forwarding,no-pty ssh-options = no-port-forwarding,no-X11-forwarding,no-pty

1162
scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch
View file

File diff suppressed because it is too large Load diff

14
scripts/git-integration/git-auth.py
View file

@ -4,6 +4,7 @@ import configparser
import mysql.connector import mysql.connector
import os import os
import re import re
import sys
config = configparser.RawConfigParser() config = configparser.RawConfigParser()
config.read(os.path.dirname(os.path.realpath(__file__)) + "/../../conf/config") config.read(os.path.dirname(os.path.realpath(__file__)) + "/../../conf/config")
@ -14,14 +15,14 @@ aur_db_user = config.get('database', 'user')
aur_db_pass = config.get('database', 'password') aur_db_pass = config.get('database', 'password')
aur_db_socket = config.get('database', 'socket') aur_db_socket = config.get('database', 'socket')
key_prefixes = config.get('auth', 'key-prefixes').split() valid_keytypes = config.get('auth', 'valid-keytypes').split()
username_regex = config.get('auth', 'username-regex') username_regex = config.get('auth', 'username-regex')
git_serve_cmd = config.get('auth', 'git-serve-cmd') git_serve_cmd = config.get('auth', 'git-serve-cmd')
ssh_opts = config.get('auth', 'ssh-options') ssh_opts = config.get('auth', 'ssh-options')
pubkey = os.environ.get("SSH_KEY") keytype = sys.argv[1]
valid_prefixes = tuple(p + " " for p in key_prefixes) keytext = sys.argv[2]
if pubkey is None or not pubkey.startswith(valid_prefixes): if not keytype in valid_keytypes:
exit(1) exit(1)
db = mysql.connector.connect(host=aur_db_host, user=aur_db_user, db = mysql.connector.connect(host=aur_db_host, user=aur_db_user,
@ -30,7 +31,7 @@ db = mysql.connector.connect(host=aur_db_host, user=aur_db_user,
cur = db.cursor() cur = db.cursor()
cur.execute("SELECT Username FROM Users WHERE SSHPubKey = %s " + cur.execute("SELECT Username FROM Users WHERE SSHPubKey = %s " +
"AND Suspended = 0", (pubkey,)) "AND Suspended = 0", (keytype + " " + keytext,))
if cur.rowcount != 1: if cur.rowcount != 1:
exit(1) exit(1)
@ -39,4 +40,5 @@ user = cur.fetchone()[0]
if not re.match(username_regex, user): if not re.match(username_regex, user):
exit(1) exit(1)
print('command="%s %s",%s %s' % (git_serve_cmd, user, ssh_opts, pubkey)) print('command="%s %s",%s %s' % (git_serve_cmd, user, ssh_opts,
keytype + " " + keytext))

2
scripts/git-integration/sshd_config
View file

@ -2,5 +2,5 @@ Port 2222
HostKey ~/.ssh/ssh_host_rsa_key HostKey ~/.ssh/ssh_host_rsa_key
PasswordAuthentication no PasswordAuthentication no
UsePrivilegeSeparation no UsePrivilegeSeparation no
AuthorizedKeysCommand /srv/http/aurweb/scripts/git-integration/git-auth.py AuthorizedKeysCommand /srv/http/aurweb/scripts/git-integration/git-auth.py "%t" "%k"
AuthorizedKeysCommandUser aur AuthorizedKeysCommandUser aur