1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
#!/usr/bin/env bash
LDAPSEARCH=ldapsearch
KEY="immaeSshKey"
LDAP_BIND="cn=ssh,ou=services,dc=immae,dc=eu"
LDAP_PASS=$(cat /etc/ssh/ldap_password)
LDAP_HOST="ldap.immae.eu"
LDAP_MEMBER="cn=users,cn=ssh,ou=services,dc=immae,dc=eu"
LDAP_GITOLITE_MEMBER="cn=users,cn=gitolite,ou=services,dc=immae,dc=eu"
LDAP_PUB_RESTRICT_MEMBER="cn=restrict,cn=pub,ou=services,dc=immae,dc=eu"
LDAP_PUB_FORWARD_MEMBER="cn=forward,cn=pub,ou=services,dc=immae,dc=eu"
LDAP_BASE="dc=immae,dc=eu"
GITOLITE_SHELL=$(which gitolite-shell)
ECHO=$(which echo)
suitable_for() {
type_for="$1"
key="$2"
if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then
echo "$key"
else
key_type=$(cut -d " " -f 1 <<< "$key")
if grep -q "\b-$type_for\b" <<< "$key_type"; then
echo ""
elif grep -q "\b$type_for\b" <<< "$key_type"; then
echo $(sed -e "s/^[^ ]* //g" <<< "$key")
else
echo ""
fi
fi
}
clean_key_line() {
type_for="$1"
line="$2"
if [[ "$line" == $KEY::* ]]; then
# base64 keys should't happen, unless wrong copy-pasting
key=""
else
key=$(sed -e "s/^$KEY: *//" -e "s/ *$//" <<< "$line")
fi
suitable_for "$type_for" "$key"
}
ldap_search() {
$LDAPSEARCH -h $LDAP_HOST -ZZ -b $LDAP_BASE -D $LDAP_BIND -w "$LDAP_PASS" -x -o ldif-wrap=no -LLL "$@"
}
ldap_keys() {
user=$1;
if [[ $user == gitolite ]]; then
ldap_search '(&(memberOf='$LDAP_GITOLITE_MEMBER')('$KEY'=*))' $KEY | \
while read line ;
do
if [ ! -z "$line" ]; then
if [[ $line == dn* ]]; then
user=$(sed -n 's/.*uid=\([^,]*\).*/\1/p' <<< "$line")
if [ -n "$user" ]; then
if [[ $user == "immae" ]] || [[ $user == "denise" ]]; then
# Capitalize first letter (backward compatibility)
user=$(sed -r 's/^([a-z])/\U\1/' <<< "$user")
fi
else
# Service fake user
user=$(sed -n 's/.*cn=\([^,]*\).*/\1/p' <<< "$line")
fi
elif [[ $line == $KEY* ]]; then
key=$(clean_key_line git "$line")
if [ ! -z "$key" ]; then
if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then
echo -n 'command="'$GITOLITE_SHELL' '$user'",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty '
echo $key
fi
fi
fi
fi
done
exit 0
elif [[ $user == pub ]]; then
ldap_search '(&(memberOf='$LDAP_PUB_RESTRICT_MEMBER')('$KEY'=*))' $KEY | \
while read line ;
do
if [ ! -z "$line" ]; then
if [[ $line == dn* ]]; then
echo ""
user=$(sed -n 's/.*uid=\([^,]*\).*/\1/p' <<< "$line")
echo "# $user"
elif [[ $line == $KEY* ]]; then
key=$(clean_key_line pub "$line")
key_forward=$(clean_key_line forward "$line")
if [ ! -z "$key" ]; then
if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then
echo -n 'command="/etc/profiles/per-user/pub/bin/restrict '$user'" '
echo $key
fi
elif [ ! -z "$key_forward" ]; then
if [[ $key_forward != *$'\n'* ]] && [[ $key_forward == ssh-* ]]; then
echo "# forward only"
echo -n 'no-pty,no-X11-forwarding,command="'$ECHO' forward only" '
echo $key_forward
fi
fi
fi
fi
done
echo ""
ldap_search '(&(memberOf='$LDAP_PUB_FORWARD_MEMBER')('$KEY'=*))' $KEY | \
while read line ;
do
if [ ! -z "$line" ]; then
if [[ $line == dn* ]]; then
echo ""
user=$(sed -n 's/.*uid=\([^,]*\).*/\1/p' <<< "$line")
echo "# $user"
elif [[ $line == $KEY* ]]; then
key=$(clean_key_line forward "$line")
if [ ! -z "$key" ]; then
if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then
echo -n 'no-pty,no-X11-forwarding,command="'$ECHO' forward only" '
echo $key
fi
fi
fi
fi
done
exit 0
else
ldap_search '(&(memberOf='$LDAP_MEMBER')('$KEY'=*)(uid='$user'))' $KEY | \
while read line ;
do
if [ ! -z "$line" ]; then
if [[ $line == dn* ]]; then
user=$(sed -n 's/.*uid=\([^,]*\).*/\1/p' <<< "$line")
elif [[ $line == $KEY* ]]; then
key=$(clean_key_line ssh "$line")
if [ ! -z "$key" ]; then
if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then
echo $key
fi
fi
fi
fi
done
fi
}
ldap_keys $@
|
