471 lines
12 KiB
Bash
Executable file
471 lines
12 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
|
|
# Handles indexing and SSH keys of machines I
|
|
# have access on
|
|
|
|
MACHINES_HOME=$HOME
|
|
MACHINES_CONFIG=$HOME/.config/machines
|
|
MACHINES_API=https://machines.frogeye.fr
|
|
|
|
mkdir -p $MACHINES_HOME &> /dev/null
|
|
mkdir -p $MACHINES_CONFIG &> /dev/null
|
|
|
|
# COMMON
|
|
|
|
function prompt { # text
|
|
while true; do
|
|
read -p "$1 [yn] " yn
|
|
case $yn in
|
|
[Yy]* ) return 1;;
|
|
[Nn]* ) return 0;;
|
|
* ) echo "Please answer y or n.";;
|
|
esac
|
|
done
|
|
}
|
|
|
|
# From https://gist.github.com/cdown/1163649
|
|
|
|
urlencode() { # string
|
|
old_lc_collate=$LC_COLLATE
|
|
LC_COLLATE=C
|
|
local length="${#1}"
|
|
for (( i = 0; i < length; i++ )); do
|
|
local c="${1:i:1}"
|
|
case $c in
|
|
[a-zA-Z0-9.~_-]) printf "$c" ;;
|
|
*) printf '%%%02X' "'$c" ;;
|
|
esac
|
|
done
|
|
LC_COLLATE=$old_lc_collate
|
|
}
|
|
|
|
urldecode() { # string
|
|
local url_encoded="${1//+/ }"
|
|
printf '%b' "${url_encoded//%/\\x}"
|
|
}
|
|
|
|
# API ACCESS
|
|
|
|
function _machines-api {
|
|
route=$1
|
|
shift
|
|
wget $MACHINES_API/$route --content-on-error --quiet --output-document=- "$@"
|
|
result=$?
|
|
if [ $result != 0 ]; then
|
|
echo "[ERROR] wget returned $result..."
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
function _machines-apiToken {
|
|
read -p 'TOTP token: ' token
|
|
_machines-api "$@" --header="X-TOTP: $token"
|
|
}
|
|
|
|
function _machines-apiSigned {
|
|
_machines-ensureAdmin
|
|
_machines-api "$@" --certificate=$MACHINES_CONFIG/machines.crt --private-key=$MACHINES_CONFIG/machines.key
|
|
}
|
|
|
|
function _machines-getQR {
|
|
_machines-apiSigned totp | qrencode -o - | feh -
|
|
}
|
|
|
|
# APPLICATION KEYS & CERTIFICATE
|
|
|
|
function _machines-pubFromCrt {
|
|
openssl x509 -in $MACHINES_CONFIG/machines.crt -pubkey -noout > $MACHINES_CONFIG/machines.pub
|
|
}
|
|
|
|
function _machines-verifyCertificate {
|
|
return
|
|
if openssl verify $MACHINES_CONFIG/machines.crt | grep -v 'error 18' | grep 'error' --quiet; then
|
|
echo "[ERROR] Invalid certificate"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
function _machines-ensurePub {
|
|
if [ ! -f $MACHINES_CONFIG/machines.crt ]; then
|
|
CERT_FILE=$(mktemp)
|
|
echo "[INFO] Downloading certificate..."
|
|
_machines-api cert > $CERT_FILE
|
|
openssl x509 -fingerprint -in $CERT_FILE | grep Fingerprint --color=never
|
|
prompt "Is this correct ?"
|
|
if [ $? == 1 ]; then
|
|
mv $CERT_FILE $MACHINES_CONFIG/machines.crt &> /dev/null
|
|
else
|
|
echo "[ERROR] Certificate rejected."
|
|
exit 1
|
|
fi
|
|
fi
|
|
_machines-verifyCertificate
|
|
if [ ! -f $MACHINES_CONFIG/machines.pub ]; then
|
|
_machines-pubFromCrt
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
function _machines-ensureAdmin {
|
|
if [ ! -f $MACHINES_CONFIG/machines.key ]; then
|
|
echo "[ERROR] You need have to have the private key to do that"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# SSH ACCESS KEYS
|
|
|
|
function _machines-signAkey { # network
|
|
KEY_FILE=$(mktemp)
|
|
SIGN_FILE=$(mktemp)
|
|
_machines-apiSigned akey/$1?unsigned > $KEY_FILE
|
|
openssl dgst -sha256 -sign $MACHINES_CONFIG/machines.key -out $SIGN_FILE $KEY_FILE
|
|
_machines-apiSigned akey/$1 --method=PUT --body-file=$SIGN_FILE
|
|
rm $KEY_FILE $SIGN_FILE &> /dev/null
|
|
}
|
|
|
|
function _machines-getAkey { # network
|
|
_machines-ensurePub
|
|
KEY_FILE=$(mktemp)
|
|
SIGN_FILE=$(mktemp)
|
|
_machines-api akey/$1 > $KEY_FILE
|
|
_machines-api akey/$1?signature > $SIGN_FILE
|
|
openssl dgst -sha256 -verify $MACHINES_CONFIG/machines.pub -signature $SIGN_FILE $KEY_FILE &> /dev/null
|
|
if [ $? == 0 ]; then
|
|
cat $KEY_FILE
|
|
rm $KEY_FILE $SIGN_FILE &> /dev/null
|
|
return 0
|
|
else
|
|
rm $KEY_FILE $SIGN_FILE &> /dev/null
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
function _machines-updateAkey {
|
|
KEY_FILE=$(mktemp)
|
|
network=$(cat $MACHINES_CONFIG/this | grep '^network=' | cut -d '=' -f 2)
|
|
_machines-getAkey $network > $KEY_FILE
|
|
if [ $? == 0 ]; then
|
|
yes | mv $KEY_FILE $MACHINES_HOME/.ssh/authorized_keys &> /dev/null
|
|
return 0
|
|
else
|
|
cat $KEY_FILE
|
|
echo "[ERROR] Authorized keys are not properly signed"
|
|
rm $KEY_FILE
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
function _machines-postFile { # filename
|
|
cat $1 | while read line; do
|
|
parameter=$(echo $line | cut -d '=' -f 1)
|
|
value="$(echo $line | sed 's/^[a-zA-Z0-9]\+\(\[\]\)\?=//')"
|
|
echo -n "&$parameter=$(urlencode "$value")"
|
|
done
|
|
}
|
|
|
|
|
|
function _machines-addElement { # element elementType default
|
|
FILE=$(mktemp)
|
|
echo -e $3 > $FILE
|
|
$EDITOR $FILE
|
|
data=$(_machines-postFile $FILE)
|
|
rm $FILE &> /dev/null
|
|
machines-apiSigned $2 --post-data "name=$1$data"
|
|
}
|
|
|
|
function _machines-editElement { # element elementType
|
|
FILE=$(mktemp)
|
|
_machines-apiSigned $2/$1
|
|
$EDITOR $FILE
|
|
data=$(_machines-postFile $FILE)
|
|
rm $FILE &> /dev/null
|
|
err=$(_machines-apiSigned $2/$1 --post-data "$data")
|
|
}
|
|
|
|
function _machines-deleteElement { # element elementType
|
|
err=$(_machines-apiSigned $2/$1 --method=DELETE)
|
|
}
|
|
|
|
|
|
# USER ADMIN FUNCTIONS
|
|
|
|
function machines_history {
|
|
if [ -f $MACHINES_CONFIG/lastVerifiedLog ]; then
|
|
from=$(<"$MACHINES_CONFIG/lastVerifiedLog")
|
|
else
|
|
from=0
|
|
fi
|
|
d=$(date +%s)
|
|
_machines-apiSigned log?from=$from | less
|
|
prompt "Is this OK?"
|
|
if [ $? == 1 ]; then
|
|
echo $d > $MACHINES_CONFIG/lastVerifiedLog
|
|
return 0
|
|
else
|
|
echo "Houston, we have a problem..."
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
function machines_sign {
|
|
machines_history
|
|
echo "Signing default network authorized_keys..."
|
|
_machines-signAkey
|
|
_machines-apiSigned network | while read network; do
|
|
echo "Signing network $network authorized_keys..."
|
|
_machines-signAkey $network
|
|
done
|
|
}
|
|
|
|
function machines_machine_list {
|
|
_machines-apiSigned machine
|
|
}
|
|
|
|
function machines_network_list {
|
|
_machines-apiSigned network
|
|
}
|
|
|
|
function machines_machine_add_help {
|
|
echo "Usage: $0 machine|mac|m add MACHINE"
|
|
echo
|
|
echo "Arguments:"
|
|
echo " MACHINE machine to add"
|
|
return 0
|
|
}
|
|
function machines_machine_add { # machine
|
|
if [ -z $1 ]; then
|
|
machines_machine_add_help
|
|
exit 1
|
|
fi
|
|
_machines-addElement $1 machine "allowed[]=\nsecure=false"
|
|
_machines-addElement $1 machine "host[]=\nnetwork=\nuserkey=\nhostkey=\nuser="
|
|
}
|
|
|
|
function machines_network_add_help {
|
|
echo "Usage: $0 network|net|n add NETWORK"
|
|
echo
|
|
echo "Arguments:"
|
|
echo " NETWORK Network to add"
|
|
return 0
|
|
}
|
|
function machines_network_add { # network
|
|
if [ -z $1 ]; then
|
|
machines_network_add_help
|
|
exit 1
|
|
fi
|
|
_machines-addElement $1 network "allowed[]=\nsecure=false"
|
|
}
|
|
|
|
function machines_machine_edit_help {
|
|
echo "Usage: $0 machine|mac|m edit MACHINE"
|
|
echo
|
|
echo "Arguments:"
|
|
echo " MACHINE machine to remove"
|
|
return 0
|
|
}
|
|
function machines_machine_edit { # machine
|
|
if [ -z $1 ]; then
|
|
machines_machine_edit_help
|
|
exit 1
|
|
fi
|
|
_machines-editElement $1 machine
|
|
}
|
|
|
|
function machines_network_edit_help {
|
|
echo "Usage: $0 network|net|n edit NETWORK"
|
|
echo
|
|
echo "Arguments:"
|
|
echo " NETWORK Network to remove"
|
|
return 0
|
|
}
|
|
function machines_network_edit { # network
|
|
if [ -z $1 ]; then
|
|
machines_network_edit_help
|
|
exit 1
|
|
fi
|
|
_machines-editElement $1 network
|
|
}
|
|
|
|
function machines_machine_delete_help {
|
|
echo "Usage: $0 machine|mac|m delete machine"
|
|
echo
|
|
echo "Arguments:"
|
|
echo " MACHINE machine to remove"
|
|
return 0
|
|
}
|
|
function machines_machine_delete { # machine
|
|
if [ -z $1 ]; then
|
|
machines_machine_delete_help
|
|
exit 1
|
|
fi
|
|
_machines-deleteElement $1 machine
|
|
}
|
|
|
|
function machines_network_delete_help {
|
|
echo "Usage: $0 network|net|n delete NETWORK"
|
|
echo
|
|
echo "Arguments:"
|
|
echo " NETWORK Network to remove"
|
|
return 0
|
|
}
|
|
function machines_network_delete { # network
|
|
if [ -z $1 ]; then
|
|
machines_network_delete_help
|
|
exit 1
|
|
fi
|
|
_machines-deleteElement $1 network
|
|
}
|
|
|
|
function machines_machine_help {
|
|
echo "Usage: $0 machine|mac|m COMMAND"
|
|
echo
|
|
echo "Commands:"
|
|
echo " list List all machines"
|
|
echo " add Interactively add a machine"
|
|
echo " edit Interactively edit a specified machine"
|
|
echo " delete Remove a specified machine"
|
|
echo " help Get help with commands"
|
|
return 0
|
|
}
|
|
function machines_machine {
|
|
command="$1"
|
|
shift
|
|
if type "machines_machine_$command" &> /dev/null; then
|
|
"machines_machine_$command" "$@"
|
|
else
|
|
machines_machine_help
|
|
fi
|
|
}
|
|
|
|
function machines_network_help {
|
|
echo "Usage: $0 network|net|n COMMAND"
|
|
echo
|
|
echo "Commands:"
|
|
echo " list List all networks"
|
|
echo " add Interactively add a network"
|
|
echo " edit Interactively edit a specified network"
|
|
echo " delete Remove a specified network"
|
|
echo " help Get help with commands"
|
|
return 0
|
|
}
|
|
function machines_network {
|
|
command="$1"
|
|
shift
|
|
if type "machines_network_$command" &> /dev/null; then
|
|
"machines_network_$command" "$@"
|
|
else
|
|
machines_network_help
|
|
fi
|
|
}
|
|
|
|
machines_mac() { machines_machine "$@"; }
|
|
machines_m() { machines_machine "$@"; }
|
|
machines_net() { machines_network "$@"; }
|
|
machines_n() { machines_network "$@"; }
|
|
machines_mac_help() { machines_machine_help "$@"; }
|
|
machines_m_help() { machines_machine_help "$@"; }
|
|
machines_net_help() { machines_network_help "$@"; }
|
|
machines_n_help() { machines_network_help "$@"; }
|
|
|
|
function machines_update-all {
|
|
machines_list | while read machine; do
|
|
echo "Updating $machine..."
|
|
ssh $machine 'machines-update' &
|
|
done
|
|
}
|
|
|
|
function machines_regen-keys {
|
|
if [[ -e $MACHINES_CONFIG/machines.key || -e $MACHINES_CONFIG/machines.pub || -e $MACHINES_CONFIG/machines.crt ]]; then
|
|
echo "[ERROR] Please delete the pem files manually to prove you know what you're doing."
|
|
exit 1
|
|
else
|
|
openssl genrsa -out $MACHINES_CONFIG/machines.key 4096
|
|
chmod 600 $MACHINES_CONFIG/machines.key
|
|
openssl req -key $MACHINES_CONFIG/machines.key -new -out $MACHINES_CONFIG/machines.csr
|
|
openssl x509 -req -days 1826 -in $MACHINES_CONFIG/machines.csr -signkey $MACHINES_CONFIG/machines.key -out $MACHINES_CONFIG/machines.crt
|
|
_machines-pubFromCrt
|
|
fi
|
|
}
|
|
|
|
|
|
# USER FUNCTIONS
|
|
|
|
function machines_setup {
|
|
if [ -e $MACHINES_CONFIG/this.name ]; then
|
|
echo "[ERROR] This machine is already set up"
|
|
exit 1
|
|
fi
|
|
|
|
_machines-ensurePub
|
|
|
|
# Variables
|
|
read -p 'Machine name? ' name
|
|
read -p 'Hosts (separated by spaces)? ' hosts
|
|
|
|
# User key
|
|
mkdir -p $MACHINES_HOME/.ssh &> /dev/null
|
|
if [[ ! -f $MACHINES_HOME/.ssh/id_rsa || ! -f $MACHINES_HOME/.ssh/id_rsa.pub ]]; then
|
|
ssh-keygen -b 4096 -C "$name@machines.frogeye.fr" -f $MACHINES_HOME/.ssh/id_rsa -t rsa
|
|
fi
|
|
userkey=$(<"$MACHINES_HOME/.ssh/id_rsa.pub")
|
|
|
|
# Host key
|
|
for type in ecdsa ed25519 rsa dsa; do
|
|
if [ -f "/etc/ssh/ssh_host_${type}_key.pub" ]; then
|
|
hostkey=$(<"/etc/ssh/ssh_host_${type}_key.pub")
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Subscription
|
|
data="name=$(urlencode "$name")&userkey=$(urlencode "$userkey")&hostkey=$(urlencode "$hostkey")&user=$(urlencode "$USER")"
|
|
for host in $hosts; do
|
|
data="$data&host[]=$(urlencode "$host")"
|
|
done
|
|
|
|
_machines-apiToken machine --post-data "$data"
|
|
|
|
echo $name > $MACHINES_CONFIG/this.name
|
|
machines_update
|
|
}
|
|
|
|
function machines_update {
|
|
_machines-api machine/$(cat $MACHINES_CONFIG/this.name) > $MACHINES_CONFIG/this
|
|
_machines-updateAkey
|
|
}
|
|
|
|
|
|
function machines_help {
|
|
command="$1"
|
|
if [ -n "$command" ]; then
|
|
if type "machines_${command}_help" &> /dev/null; then
|
|
shift
|
|
"machines_${command}_help" "$@"
|
|
return $?
|
|
fi
|
|
fi
|
|
echo "Usage: $0 COMMAND"
|
|
echo
|
|
echo "User commands:"
|
|
echo " setup Interactive initial setup for new machine"
|
|
echo " update Update this machine"
|
|
echo " help Get help with commands"
|
|
echo
|
|
echo "Admin commands:"
|
|
echo " machine|mac|m Modify machines"
|
|
echo " network|net|n Modify networks"
|
|
echo " update-all Update all machines available via SSH"
|
|
echo " regen-keys Regenerate system keys"
|
|
return 0
|
|
}
|
|
|
|
# MAIN
|
|
command="$1"
|
|
shift
|
|
if type "machines_$command" &> /dev/null; then
|
|
"machines_$command" "$@"
|
|
else
|
|
machines_help
|
|
fi
|