245 lines
7.2 KiB
Bash
245 lines
7.2 KiB
Bash
function zssh_boot()
|
|
{
|
|
zshlibs_log zssh "zssh is booting up
|
|
----------------------------"
|
|
typeset -g zssh_ssh_dotdir="${HOME}/.ssh"
|
|
typeset -g zssh_private_keys="${zssh_ssh_dotdir}/keystore"
|
|
typeset -g zssh_private_configs="${zssh_ssh_dotdir}/config.d"
|
|
typeset -g zssh_global_configs=${globaldots_path}/config/ssh
|
|
typeset -g zssh_global_pubkeys=${globaldots_path}/keys/ssh
|
|
zssh_configure
|
|
zssh_process
|
|
}
|
|
|
|
function zssh_configure ()
|
|
{
|
|
if [[ -n "$zssh_host" ]]
|
|
then
|
|
zshlibs_log zssh_configure "zssh_host is set"
|
|
zshlibs_ensure -d $zssh_private_keys
|
|
zshlibs_ensure -d $zssh_private_configs
|
|
zshlibs_ensure -d ${zssh_global_configs}
|
|
zshlibs_ensure -d ${zssh_global_pubkeys}
|
|
if ! [[ -d "${zssh_private_configs}" ]]
|
|
then
|
|
echo 'Include config.d/*.sshconf' > "${zssh_ssh_dotdir}/config_d"
|
|
fi
|
|
zssh_enumeratenodes
|
|
if [[ ${#zssh_host_config_accesses} -gt 0 ]]
|
|
then
|
|
zshlibs_log zssh_configure "zssh_host_config_accesses is set"
|
|
zshlibs_log zssh_configure "global our pubkey directory is $(zssh_host_info -K)"
|
|
zshlibs_log zssh_configure "global our config directory is $(zssh_host_info -c)"
|
|
typeset -g zssh_global_config_hostdir="${zssh_global_configs}/${zssh_host}"
|
|
typeset -g zssh_global_pubkey_hostdir="${zssh_global_pubkeys}/${zssh_host}"
|
|
zshlibs_ensure -d $(zssh_host_info -K) #"${zssh_global_pubkey_hostdir}"
|
|
zshlibs_ensure -d $(zssh_host_info -C) # "${zssh_global_config_hostdir}"
|
|
else
|
|
zshlibs_log zssh_configure "zssh_host_config_accesses is NOT set, not going to bother accepting keys"
|
|
fi
|
|
else
|
|
zshlibs_log zssh_configure "zssh_host is NOT set, which means we cannot neither publish keys nor accept them"
|
|
fi
|
|
}
|
|
|
|
function zssh_host_info()
|
|
{
|
|
zssh_node_info ${zssh_host} $@
|
|
}
|
|
|
|
function zssh_node_info()
|
|
{
|
|
local ssh_node=$1
|
|
shift
|
|
while getopts 'kKcCM:E:' opt
|
|
do
|
|
case $opt in
|
|
(s)
|
|
# private privkey
|
|
echo "$zssh_private_keys/${ssh_node}.key"
|
|
;;
|
|
(k)
|
|
# private pubkey
|
|
echo "$zssh_private_keys/${ssh_node}.key.pub"
|
|
;;
|
|
(M)
|
|
# public pubkey mail file
|
|
echo "$zssh_global_pubkeys/${ssh_node}/${OPTARG}.key.pub"
|
|
;;
|
|
(K)
|
|
# public pubkey bucket
|
|
echo "$zssh_global_pubkeys/${ssh_node}"
|
|
;;
|
|
(c)
|
|
# private ssh hostconfig
|
|
echo "$zssh_private_configs/${ssh_node}.sshconf"
|
|
;;
|
|
(C)
|
|
# public config bucket
|
|
echo "$zssh_global_configs/${ssh_node}"
|
|
;;
|
|
(E)
|
|
# public config bucket piece
|
|
echo "$zssh_global_configs/${ssh_node}/${OPTARG}.sshconf"
|
|
;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
function zssh_process()
|
|
{
|
|
if [[ -n "$zssh_host" ]]
|
|
then
|
|
if [[ ${#zssh_host_config_accesses} -gt 0 ]]
|
|
then
|
|
zshlibs_log zssh_server "processing ssh server setup"
|
|
# - if there is no generated ssh config,
|
|
# - if local config not older than (means newer than) generated config
|
|
# then generate ssh config
|
|
if ! [[ "${HOME}/.config/zsh/local.config.zsh" -ot $(zssh_host_info -c) ]]
|
|
then
|
|
zshlibs_log zssh_server "publishing our configs …"
|
|
zssh_publish_configs
|
|
else
|
|
zshlibs_log zssh_server "no need to publish our configs"
|
|
fi
|
|
zssh_check_pubkeys
|
|
fi
|
|
zshlibs_log zssh_client "processing ssh client setup"
|
|
zssh_install_peers
|
|
zssh_publish_pubkeys
|
|
fi
|
|
}
|
|
|
|
function zssh_check_pubkeys()
|
|
{
|
|
[[ ${#zssh_host_config_accesses} -gt 0 ]] || return 62
|
|
zshlibs_log zssh_server "checking received pubkeys …"
|
|
zshlibs_log zssh_server "done checking received pubkeys"
|
|
}
|
|
|
|
function zssh_install_peers()
|
|
{
|
|
[[ -n $zssh_host ]] || return 63
|
|
zshlibs_log zssh_client "installing peers"
|
|
for ssh_node in $zssh_nodes
|
|
do
|
|
zshlibs_log zssh_client "installing peer $ssh_node …"
|
|
zssh_generate_privkey4 $ssh_node
|
|
zssh_generate_config4 $ssh_node
|
|
done
|
|
}
|
|
|
|
function zssh_publish_pubkeys()
|
|
{
|
|
zshlibs_log zssh_client "pushing out pubkey to parties …"
|
|
for ssh_node in $zssh_nodes
|
|
do
|
|
zssh_mail_pubkey2 $ssh_node
|
|
done
|
|
zshlibs_log zssh_client "done pushing out pubkey to parties"
|
|
}
|
|
|
|
function zssh_mail_pubkey2()
|
|
{
|
|
[[ -n $zssh_host ]] || return 63
|
|
ssh_node="$1"
|
|
if ! [[ "$(zssh_node_info ${ssh_node} -k)" -ot "$(zssh_node_info ${ssh_node} -M ${zssh_host})" ]]
|
|
then
|
|
zshlibs_ensure -d "$(zssh_node_info ${ssh_node} -K)"
|
|
zshlibs_log zssh_client "sending '$(zssh_node_info ${ssh_node} -k) to '$(zssh_node_info ${ssh_node} -M ${zssh_host})'"
|
|
cp -T "$(zssh_node_info ${ssh_node} -k)" "$(zssh_node_info ${ssh_node} -M ${zssh_host})"
|
|
else
|
|
zshlibs_log zssh_client "'$(zssh_node_info ${ssh_node} -K ${zssh_host})' already mailed"
|
|
fi
|
|
}
|
|
|
|
function zssh_publish_configs()
|
|
{
|
|
[[ "${#zssh_host_config_accesses}" -gt 0 ]] || return 62
|
|
zshlibs_log zssh_server "generating access configs for parties …"
|
|
for sshmatch in ${(k)zssh_host_config_accesses}
|
|
do
|
|
config_filename="$(zssh_host_info -E ${sshmatch})"
|
|
config_filename=${config_filename//:/_}
|
|
zshlibs_log zssh_server "generating our server access config '${config_filename}'"
|
|
zssh_generate_hostaccessconfig $sshmatch > "${config_filename}"
|
|
done
|
|
zshlibs_log zssh_server "updating mtime for $(zssh_host_info -C)"
|
|
touch "$(zssh_host_info -C)"
|
|
zshlibs_log zssh_server "done generating access configs for parties"
|
|
}
|
|
|
|
function zssh_generate_hostaccessconfig()
|
|
{
|
|
sshmatch="${1}"
|
|
sshcontents=${zssh_host_config_accesses[$sshmatch]}
|
|
sshmatch_user=${sshmatch%%@*}
|
|
sshmatch_host=${sshmatch##*@}
|
|
if [[ "$sshmatch_host" == "$sshmatch_user" ]]
|
|
then
|
|
sshmatch_user=''
|
|
fi
|
|
<< HERE
|
|
Match ${sshmatch_host:+host $sshmatch_host,} ${sshmatch_user:+user $sshmatch_user,}
|
|
${sshcontents}
|
|
${zssh_host_config}
|
|
HERE
|
|
}
|
|
|
|
function zssh_generate_config4
|
|
{
|
|
ssh_node="$1"
|
|
dst="$zssh_private_configs/$ssh_node.sshconf"
|
|
srcs="$zssh_global_configs/$ssh_node"
|
|
zshlibs_log zssh_client "checking configs for $ssh_node …"
|
|
if ! [[ -d "$srcs" ]]
|
|
then
|
|
zshlibs_log zssh_client "$ssh_node does not have config"
|
|
elif ! [[ $dst -nt $srcs ]]
|
|
then
|
|
sshkey="$zssh_private_keys/$ssh_node.key"
|
|
zshlibs_log zssh_client "generating '$dst' with key '$sshkey'"
|
|
rm "$dst" 2> /dev/null
|
|
for src in "$srcs"/*.sshconf(N)
|
|
do
|
|
zshlibs_log zssh_client "sourcing $src"
|
|
cat "$src" >> "$dst"
|
|
printf "\n IdentityFile %s\n\n" "$sshkey" >> "$dst"
|
|
done
|
|
fi
|
|
zshlibs_log zssh_client "done with $ssh_node"
|
|
}
|
|
|
|
function zssh_generate_privkey4
|
|
{
|
|
ssh_node="$1"
|
|
zshlibs_log zssh_client "checking keys for peer $ssh_node …"
|
|
local newkey=$zssh_private_keys/$ssh_node.key
|
|
if ! [[ -s $newkey ]]
|
|
then
|
|
zshlibs_log zssh_client "generate key for $ssh_node"
|
|
ssh-keygen -t ed25519 -N '' -C "$ssh_host($USER@$HOST) for $ssh_node" -f $newkey >> "${HOME}/.log/ssh-keygen.log"
|
|
if [[ "$ssh_node" == "$zssh_host" ]]
|
|
then
|
|
zshlibs_log zssh_client "Self accepting key: $ssh_node"
|
|
cat "$newkey.pub" >> ${HOME}/.ssh/authorized_keys
|
|
fi
|
|
fi
|
|
}
|
|
|
|
|
|
function zssh_enumeratenodes()
|
|
{
|
|
typeset -g -a zssh_nodes;
|
|
zshlibs_log zssh_configure "enumerating nodes"
|
|
if [[ -d $zssh_global_configs ]]
|
|
then
|
|
for __ssh_node in ${zssh_global_configs}/*(/)
|
|
do
|
|
zssh_nodes+=($(basename $__ssh_node))
|
|
done
|
|
fi
|
|
zshlibs_log zssh_configure "got ${#zssh_nodes} nodes"
|
|
}
|