Hi Matt, No problem, that solution is even better....
I was also thinking about another option for hostkey checking One of the problems I have with logical hostnames, is that you get a selected number of different hostkeys back. On a 2 node cluster I can get 2 different hostkeys for the same logical hostname. So it would be nice to have a way that I can say that it should not abort on the 1st hostname match if the key does not match, but continue to look for a matching hostname AND hostkey. Any ideas on how we could still use a hostkey check with that, instead of being forced to ignore them ? I was thinking about parsing the known_hosts until a match was done with the hostname AND the hostkey So not aborting if the first hostkey of a hostname did not match. Should not be to difficult in making a patch for that... Its more difficult to think of a way of how a user would provide that on the cmdline... Something else....the TODO file is not up to date... I took a look to see if I could help out with something, and I saw the authorized_keys restrictions.... But you already done that :) Cheers, Hans On Thu, Apr 11, 2013 at 2:16 AM, Matt Johnston <[email protected]> wrote: > Hi, > > Thanks for the patch. I think I'll change it slightly to use > "-y -y" rather than "-Y" - saves using another letter. > > Cheers, > Matt > > On Sun, Apr 07, 2013 at 04:03:37PM +0200, Hans Harder wrote: >> Underneath some modifications against a stock 2013.56 version >> >> - Added -Y option to completely ignore check for hostkeys >> Needed this for connections to logical hosts, same as openssh -o >> StrictHostKeychecking=no >> >> - Added -y and -Y in function multihop_passthrough_args >> >> - fix: in function multihop_passthrough_args there was no space kept >> between the -W and -i args >> so added always a space after each added arg >> after last addition the last space is removed. >> >> I am new to the dropbear sources, so perhaps I didn't see it >> correctly....if so please correct me... >> Overall nice sourcecode, very clean. >> >> Hans >> --- >> Quote: ech`echo xiun|tr nu oc|sed 'sx\([sx]\)\([xoi]\)xo un\2\1 is xg'`ol >> >> >> diff -ruBpN dropbear-2013.56/cli-kex.c work/cli-kex.c >> --- dropbear-2013.56/cli-kex.c 2013-03-21 08:29:34.000000000 -0700 >> +++ work/cli-kex.c 2013-04-07 03:01:31.000000000 -0600 >> @@ -217,6 +217,11 @@ static void checkhostkey(unsigned char* >> buffer * line = NULL; >> int ret; >> >> + if (!cli_opts.strict_hostkey) { >> + TRACE(("strict_hostkey disabled, ignoring hostkey check")); >> + return; >> + } >> + >> hostsfile = open_known_hosts_file(&readonly); >> if (!hostsfile) { >> ask_to_confirm(keyblob, keybloblen); >> diff -ruBpN dropbear-2013.56/cli-runopts.c work/cli-runopts.c >> --- dropbear-2013.56/cli-runopts.c 2013-03-21 08:29:34.000000000 -0700 >> +++ work/cli-runopts.c 2013-04-07 03:08:59.000000000 -0600 >> @@ -62,6 +62,7 @@ static void printhelp() { >> "-N Don't run a remote command\n" >> "-f Run in background after >> auth\n" >> "-y Always accept remote >> host key if unknown\n" >> + "-Y Always ignore the >> remote host key\n" >> "-s Request a subsystem >> (use by external sftp)\n" >> #ifdef ENABLE_CLI_PUBKEY_AUTH >> "-i <identityfile> (multiple >> allowed)\n" >> @@ -130,6 +131,7 @@ void cli_getopts(int argc, char ** argv) >> cli_opts.backgrounded = 0; >> cli_opts.wantpty = 9; /* 9 means "it hasn't been touched", >> gets set later */ >> cli_opts.always_accept_key = 0; >> + cli_opts.strict_hostkey = 1; >> cli_opts.is_subsystem = 0; >> #ifdef ENABLE_CLI_PUBKEY_AUTH >> cli_opts.privkeys = list_new(); >> @@ -215,6 +217,9 @@ void cli_getopts(int argc, char ** argv) >> case 'y': /* always accept the remote >> hostkey */ >> cli_opts.always_accept_key = 1; >> break; >> + case 'Y': /* always ignore the remote >> hostkey */ >> + cli_opts.strict_hostkey = 0; >> + break; >> case 'p': /* remoteport */ >> next = &cli_opts.remoteport; >> break; >> @@ -461,20 +466,32 @@ multihop_passthrough_args() { >> int total; >> unsigned int len = 0; >> m_list_elem *iter; >> - /* Fill out -i and -W options that make sense for all >> + /* Fill out -i , -W, -y and -Y options that make sense for all >> * the intermediate processes */ >> for (iter = cli_opts.privkeys->first; iter; iter = iter->next) >> { >> sign_key * key = (sign_key*)iter->item; >> len += 3 + strlen(key->filename); >> } >> - len += 20; // space for -W <size>, terminator. >> + len += 30; // space for -W <size>, terminator. >> ret = m_malloc(len); >> total = 0; >> >> + if (cli_opts.always_accept_key) >> + { >> + int written = snprintf(ret+total, len-total, "-y "); >> + total += written; >> + } >> + >> + if (cli_opts.strict_hostkey == 0) >> + { >> + int written = snprintf(ret+total, len-total, "-Y "); >> + total += written; >> + } >> + >> if (opts.recv_window != DEFAULT_RECV_WINDOW) >> { >> - int written = snprintf(ret+total, len-total, "-W %d", >> opts.recv_window); >> + int written = snprintf(ret+total, len-total, "-W %d ", >> opts.recv_window); >> total += written; >> } >> >> @@ -482,11 +499,17 @@ multihop_passthrough_args() { >> { >> sign_key * key = (sign_key*)iter->item; >> const size_t size = len - total; >> - int written = snprintf(ret+total, size, "-i %s", >> key->filename); >> + int written = snprintf(ret+total, size, "-i %s ", >> key->filename); >> dropbear_assert((unsigned int)written < size); >> total += written; >> } >> - >> + >> + /* if args where passed, total will be not zero, and it will >> have a space at the end, so remove that */ >> + if (total) total--; >> + >> + /* make sure arg string is ended, especially if no args were passed. >> */ >> + ret[total]='\0'; >> + >> return ret; >> } >> >> diff -ruBpN dropbear-2013.56/runopts.h work/runopts.h >> --- dropbear-2013.56/runopts.h 2013-03-21 08:29:35.000000000 -0700 >> +++ work/runopts.h 2013-04-07 01:55:25.000000000 -0700 >> @@ -121,6 +121,7 @@ typedef struct cli_runopts { >> char *cmd; >> int wantpty; >> int always_accept_key; >> + int strict_hostkey; >> int no_cmd; >> int backgrounded; >> int is_subsystem;
