@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Add an optional "--sshd-key" argument to "bin/ssh-auth" for reading "%k" from modern sshd
Summary: Depends on D20873. Ref T13436. Allow callers to configure "bin/ssh-auth --sshd-key %k" as an "AuthorizedKeysCommand"; if they do, and we recognize the key, emit just that key in the output.
Test Plan:
- Used `git pull` locally, still worked fine.
- Instrumented things, saw the public key lookup actually work and emit a single key.
- Ran without "--sshd-key", got a full key list as before.
Maniphest Tasks: T13436
Differential Revision: https://secure.phabricator.com/D20874
+34
+34
scripts/ssh/ssh-auth.php
+34
scripts/ssh/ssh-auth.php
···
4
4
$root = dirname(dirname(dirname(__FILE__)));
5
5
require_once $root.'/scripts/init/init-script.php';
6
6
7
+
// TODO: For now, this is using "parseParital()", not "parse()". This allows
8
+
// the script to accept (and ignore) additional arguments. This preserves
9
+
// backward compatibility until installs have time to migrate to the new
10
+
// syntax.
11
+
12
+
$args = id(new PhutilArgumentParser($argv))
13
+
->parsePartial(
14
+
array(
15
+
array(
16
+
'name' => 'sshd-key',
17
+
'param' => 'k',
18
+
'help' => pht(
19
+
'Accepts the "%%k" parameter from "AuthorizedKeysCommand".'),
20
+
),
21
+
));
22
+
23
+
$sshd_key = $args->getArg('sshd-key');
24
+
7
25
// NOTE: We are caching a datastructure rather than the flat key file because
8
26
// the path on disk to "ssh-exec" is arbitrarily mutable at runtime. See T12397.
9
27
···
83
101
$authstruct_raw = phutil_json_encode($authstruct);
84
102
$ttl = phutil_units('24 hours in seconds');
85
103
$cache->setKey($authstruct_key, $authstruct_raw, $ttl);
104
+
}
105
+
106
+
// If we've received an "--sshd-key" argument and it matches some known key,
107
+
// only emit that key. (For now, if the key doesn't match, we'll fall back to
108
+
// emitting all keys.)
109
+
if ($sshd_key !== null) {
110
+
$matches = array();
111
+
foreach ($authstruct['keys'] as $key => $key_struct) {
112
+
if (phutil_hashes_are_identical($key_struct['key'], $sshd_key)) {
113
+
$matches[$key] = $key_struct;
114
+
}
115
+
}
116
+
117
+
if ($matches) {
118
+
$authstruct['keys'] = $matches;
119
+
}
86
120
}
87
121
88
122
$bin = $root.'/bin/ssh-exec';