Volans has submitted this change and it was merged.
Change subject: keyholder: add support for SHA256 key fingerprints
......................................................................
keyholder: add support for SHA256 key fingerprints
The SHA256 key digest, as defined and recommended in RFC 6668, is the
default fingerprint hash for OpenSSH >= 6.8.
This change add support for it to keyholder while maintaining backward
compatibility with MD5 fingerprints.
Bug: T148273
Change-Id: I11fef8e5fb7173729e3be352246a0a95a66099ad
---
M modules/keyholder/files/ssh-agent-proxy
1 file changed, 6 insertions(+), 2 deletions(-)
Approvals:
Faidon Liambotis: Looks good to me, approved
jenkins-bot: Verified
diff --git a/modules/keyholder/files/ssh-agent-proxy
b/modules/keyholder/files/ssh-agent-proxy
index 3c129ee..e87eeda 100644
--- a/modules/keyholder/files/ssh-agent-proxy
+++ b/modules/keyholder/files/ssh-agent-proxy
@@ -40,6 +40,7 @@
"""
import argparse
+import base64
import glob
import grp
import hashlib
@@ -176,9 +177,12 @@
if code == SSH2_AGENTC_SIGN_REQUEST:
key_blob, *_ = self.parse_sign_request(message)
- key_digest = hashlib.md5(key_blob).hexdigest()
+ key_digest_md5 = hashlib.md5(key_blob).hexdigest()
+ key_digest_sha256 = (b'SHA256' + base64.b64encode(hashlib.sha256(
+ key_blob).digest()).rstrip(b'=')).decode('utf-8')
user, groups = self.get_peer_credentials(self.request)
- if groups & self.server.key_perms.get(key_digest, set()):
+ if groups & self.server.key_perms.get(key_digest_md5, set()).union(
+ self.server.key_perms.get(key_digest_sha256, set())):
return self.send_message(self.backend, code, message)
return self.send_message(self.request, SSH_AGENT_FAILURE)
--
To view, visit https://gerrit.wikimedia.org/r/318943
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I11fef8e5fb7173729e3be352246a0a95a66099ad
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Volans <[email protected]>
Gerrit-Reviewer: Faidon Liambotis <[email protected]>
Gerrit-Reviewer: Muehlenhoff <[email protected]>
Gerrit-Reviewer: Volans <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
