Skip to content

Commit 95352e6

Browse files
zeripathtechknowlogick
zeripath
and
techknowlogick
authored
Make command in authorized keys a template (#16003)
Fix #15595 Replaces #15978 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
1 parent ebf253b commit 95352e6

File tree

3 files changed

+60
-43
lines changed

3 files changed

+60
-43
lines changed

‎docs/content/doc/advanced/config-cheat-sheet.en-us.md

+1
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a
270270
- `SSH_AUTHORIZED_PRINCIPALS_ALLOW`: **off** or **username, email**: \[off, username, email, anything\]: Specify the principals values that users are allowed to use as principal. When set to `anything` no checks are done on the principal string. When set to `off` authorized principal are not allowed to be set.
271271
- `SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE`: **false/true**: Gitea will create a authorized_principals file by default when it is not using the internal ssh server and `SSH_AUTHORIZED_PRINCIPALS_ALLOW` is not `off`.
272272
- `SSH_AUTHORIZED_PRINCIPALS_BACKUP`: **false/true**: Enable SSH Authorized Principals Backup when rewriting all keys, default is true if `SSH_AUTHORIZED_PRINCIPALS_ALLOW` is not `off`.
273+
- `SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE`: **{{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}**: Set the template for the command to passed on authorized keys. Possible keys are: AppPath, AppWorkPath, CustomConf, CustomPath, Key - where Key is a `models.PublicKey` and the others are strings which are shellquoted.
273274
- `SSH_SERVER_CIPHERS`: **aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, arcfour256, arcfour128**: For the built-in SSH server, choose the ciphers to support for SSH connections, for system SSH this setting has no effect.
274275
- `SSH_SERVER_KEY_EXCHANGES`: **diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, curve25519-sha256@libssh.org**: For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, for system SSH this setting has no effect.
275276
- `SSH_SERVER_MACS`: **hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1, hmac-sha1-96**: For the built-in SSH server, choose the MACs to support for SSH connections, for system SSH this setting has no effect

‎models/ssh_key.go

+10-2
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ import (
3838

3939
const (
4040
tplCommentPrefix = `# gitea public key`
41-
tplCommand = "%s --config=%s serv key-%d"
4241
tplPublicKey = tplCommentPrefix + "\n" + `command=%s,no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty %s` + "\n"
4342

4443
authorizedPrincipalsFile = "authorized_principals"
@@ -88,7 +87,16 @@ func (key *PublicKey) OmitEmail() string {
8887

8988
// AuthorizedString returns formatted public key string for authorized_keys file.
9089
func (key *PublicKey) AuthorizedString() string {
91-
return fmt.Sprintf(tplPublicKey, util.ShellEscape(fmt.Sprintf(tplCommand, util.ShellEscape(setting.AppPath), util.ShellEscape(setting.CustomConf), key.ID)), key.Content)
90+
sb := &strings.Builder{}
91+
_ = setting.SSH.AuthorizedKeysCommandTemplateTemplate.Execute(sb, map[string]interface{}{
92+
"AppPath": util.ShellEscape(setting.AppPath),
93+
"AppWorkPath": util.ShellEscape(setting.AppWorkPath),
94+
"CustomConf": util.ShellEscape(setting.CustomConf),
95+
"CustomPath": util.ShellEscape(setting.CustomPath),
96+
"Key": key,
97+
})
98+
99+
return fmt.Sprintf(tplPublicKey, util.ShellEscape(sb.String()), key.Content)
92100
}
93101

94102
func extractTypeFromBase64Key(key string) (string, error) {

‎modules/setting/setting.go

+49-41
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"runtime"
2121
"strconv"
2222
"strings"
23+
"text/template"
2324
"time"
2425

2526
"code.gitea.io/gitea/modules/generate"
@@ -123,48 +124,51 @@ var (
123124
AbsoluteAssetURL string
124125

125126
SSH = struct {
126-
Disabled bool `ini:"DISABLE_SSH"`
127-
StartBuiltinServer bool `ini:"START_SSH_SERVER"`
128-
BuiltinServerUser string `ini:"BUILTIN_SSH_SERVER_USER"`
129-
Domain string `ini:"SSH_DOMAIN"`
130-
Port int `ini:"SSH_PORT"`
131-
ListenHost string `ini:"SSH_LISTEN_HOST"`
132-
ListenPort int `ini:"SSH_LISTEN_PORT"`
133-
RootPath string `ini:"SSH_ROOT_PATH"`
134-
ServerCiphers []string `ini:"SSH_SERVER_CIPHERS"`
135-
ServerKeyExchanges []string `ini:"SSH_SERVER_KEY_EXCHANGES"`
136-
ServerMACs []string `ini:"SSH_SERVER_MACS"`
137-
ServerHostKeys []string `ini:"SSH_SERVER_HOST_KEYS"`
138-
KeyTestPath string `ini:"SSH_KEY_TEST_PATH"`
139-
KeygenPath string `ini:"SSH_KEYGEN_PATH"`
140-
AuthorizedKeysBackup bool `ini:"SSH_AUTHORIZED_KEYS_BACKUP"`
141-
AuthorizedPrincipalsBackup bool `ini:"SSH_AUTHORIZED_PRINCIPALS_BACKUP"`
142-
MinimumKeySizeCheck bool `ini:"-"`
143-
MinimumKeySizes map[string]int `ini:"-"`
144-
CreateAuthorizedKeysFile bool `ini:"SSH_CREATE_AUTHORIZED_KEYS_FILE"`
145-
CreateAuthorizedPrincipalsFile bool `ini:"SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE"`
146-
ExposeAnonymous bool `ini:"SSH_EXPOSE_ANONYMOUS"`
147-
AuthorizedPrincipalsAllow []string `ini:"SSH_AUTHORIZED_PRINCIPALS_ALLOW"`
148-
AuthorizedPrincipalsEnabled bool `ini:"-"`
149-
TrustedUserCAKeys []string `ini:"SSH_TRUSTED_USER_CA_KEYS"`
150-
TrustedUserCAKeysFile string `ini:"SSH_TRUSTED_USER_CA_KEYS_FILENAME"`
151-
TrustedUserCAKeysParsed []gossh.PublicKey `ini:"-"`
152-
PerWriteTimeout time.Duration `ini:"SSH_PER_WRITE_TIMEOUT"`
153-
PerWritePerKbTimeout time.Duration `ini:"SSH_PER_WRITE_PER_KB_TIMEOUT"`
127+
Disabled bool `ini:"DISABLE_SSH"`
128+
StartBuiltinServer bool `ini:"START_SSH_SERVER"`
129+
BuiltinServerUser string `ini:"BUILTIN_SSH_SERVER_USER"`
130+
Domain string `ini:"SSH_DOMAIN"`
131+
Port int `ini:"SSH_PORT"`
132+
ListenHost string `ini:"SSH_LISTEN_HOST"`
133+
ListenPort int `ini:"SSH_LISTEN_PORT"`
134+
RootPath string `ini:"SSH_ROOT_PATH"`
135+
ServerCiphers []string `ini:"SSH_SERVER_CIPHERS"`
136+
ServerKeyExchanges []string `ini:"SSH_SERVER_KEY_EXCHANGES"`
137+
ServerMACs []string `ini:"SSH_SERVER_MACS"`
138+
ServerHostKeys []string `ini:"SSH_SERVER_HOST_KEYS"`
139+
KeyTestPath string `ini:"SSH_KEY_TEST_PATH"`
140+
KeygenPath string `ini:"SSH_KEYGEN_PATH"`
141+
AuthorizedKeysBackup bool `ini:"SSH_AUTHORIZED_KEYS_BACKUP"`
142+
AuthorizedPrincipalsBackup bool `ini:"SSH_AUTHORIZED_PRINCIPALS_BACKUP"`
143+
AuthorizedKeysCommandTemplate string `ini:"SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE"`
144+
AuthorizedKeysCommandTemplateTemplate *template.Template `ini:"-"`
145+
MinimumKeySizeCheck bool `ini:"-"`
146+
MinimumKeySizes map[string]int `ini:"-"`
147+
CreateAuthorizedKeysFile bool `ini:"SSH_CREATE_AUTHORIZED_KEYS_FILE"`
148+
CreateAuthorizedPrincipalsFile bool `ini:"SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE"`
149+
ExposeAnonymous bool `ini:"SSH_EXPOSE_ANONYMOUS"`
150+
AuthorizedPrincipalsAllow []string `ini:"SSH_AUTHORIZED_PRINCIPALS_ALLOW"`
151+
AuthorizedPrincipalsEnabled bool `ini:"-"`
152+
TrustedUserCAKeys []string `ini:"SSH_TRUSTED_USER_CA_KEYS"`
153+
TrustedUserCAKeysFile string `ini:"SSH_TRUSTED_USER_CA_KEYS_FILENAME"`
154+
TrustedUserCAKeysParsed []gossh.PublicKey `ini:"-"`
155+
PerWriteTimeout time.Duration `ini:"SSH_PER_WRITE_TIMEOUT"`
156+
PerWritePerKbTimeout time.Duration `ini:"SSH_PER_WRITE_PER_KB_TIMEOUT"`
154157
}{
155-
Disabled: false,
156-
StartBuiltinServer: false,
157-
Domain: "",
158-
Port: 22,
159-
ServerCiphers: []string{"aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "arcfour256", "arcfour128"},
160-
ServerKeyExchanges: []string{"diffie-hellman-group1-sha1", "diffie-hellman-group14-sha1", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "curve25519-sha256@libssh.org"},
161-
ServerMACs: []string{"hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"},
162-
KeygenPath: "ssh-keygen",
163-
MinimumKeySizeCheck: true,
164-
MinimumKeySizes: map[string]int{"ed25519": 256, "ed25519-sk": 256, "ecdsa": 256, "ecdsa-sk": 256, "rsa": 2048},
165-
ServerHostKeys: []string{"ssh/gitea.rsa", "ssh/gogs.rsa"},
166-
PerWriteTimeout: PerWriteTimeout,
167-
PerWritePerKbTimeout: PerWritePerKbTimeout,
158+
Disabled: false,
159+
StartBuiltinServer: false,
160+
Domain: "",
161+
Port: 22,
162+
ServerCiphers: []string{"aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "arcfour256", "arcfour128"},
163+
ServerKeyExchanges: []string{"diffie-hellman-group1-sha1", "diffie-hellman-group14-sha1", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "curve25519-sha256@libssh.org"},
164+
ServerMACs: []string{"hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96"},
165+
KeygenPath: "ssh-keygen",
166+
MinimumKeySizeCheck: true,
167+
MinimumKeySizes: map[string]int{"ed25519": 256, "ed25519-sk": 256, "ecdsa": 256, "ecdsa-sk": 256, "rsa": 2048},
168+
ServerHostKeys: []string{"ssh/gitea.rsa", "ssh/gogs.rsa"},
169+
AuthorizedKeysCommandTemplate: "{{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}",
170+
PerWriteTimeout: PerWriteTimeout,
171+
PerWritePerKbTimeout: PerWritePerKbTimeout,
168172
}
169173

170174
// Security settings
@@ -785,6 +789,10 @@ func NewContext() {
785789
}
786790

787791
SSH.ExposeAnonymous = sec.Key("SSH_EXPOSE_ANONYMOUS").MustBool(false)
792+
SSH.AuthorizedKeysCommandTemplate = sec.Key("SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE").MustString(SSH.AuthorizedKeysCommandTemplate)
793+
794+
SSH.AuthorizedKeysCommandTemplateTemplate = template.Must(template.New("").Parse(SSH.AuthorizedKeysCommandTemplate))
795+
788796
SSH.PerWriteTimeout = sec.Key("SSH_PER_WRITE_TIMEOUT").MustDuration(PerWriteTimeout)
789797
SSH.PerWritePerKbTimeout = sec.Key("SSH_PER_WRITE_PER_KB_TIMEOUT").MustDuration(PerWritePerKbTimeout)
790798

0 commit comments

Comments
 (0)