Alien vergewaltigt: SSH Keys verwalten mit RPM und Debian Paketen

Sascha hatte vor einiger Zeit beschrieben, wie man mit Hilfe von RPM Paketen die authorized_keys auf Servern verwalten kann. Das ganze ist wirklich angenehm und macht die Verwaltung von Zugängen um einiges einfacher. Wird ein neuer Admin eingestellt, so wird einfach das RPM mit dem public Key auf den Servern installiert, wo er Zugriff haben sol – fertig. Verlässt er das Unternehmen wieder, so wird das RPM deinstalliert – wieder fertig.

Nun arbeite ich in einer “Welt”, in der RPMs und Debian Pakete genutzt werden. Blöd, wenn man dann zwei Pakete bauen muss. Aber es geht recht einfach und braucht auch gar nicht viel

Prerequisites

Die Pakete werden auf einem Debian System gebaut. Des Weiteren wird alien benötigt. Der Rest sollte standardmäßig vorhanden sein.

Ordnerstruktur

Erstellt euch ein Verzeichnis, in dem ihr die Keys verwalten/erstellen möchtet. Darunter wird folgende Struktur erstellt:

./ssh-rootkey-template
./ssh-rootkey-template/DEBIAN
./packages

Das war es schon.

Dateien

Folgende Dateien legen wir an:

./ssh-rootkey-template/DEBIAN/copyright
./ssh-rootkey-template/DEBIAN/postrm
./ssh-rootkey-template/DEBIAN/rules
./ssh-rootkey-template/DEBIAN/control
./ssh-rootkey-template/DEBIAN/changelog
./ssh-rootkey-template/DEBIAN/postinst

copyright

This package provides authorized_keys management

Copyright: 

Information from the binary package:
Name        : ssh-rootkey-<username>
Packager    : Ronny Becker <ronny.becker@linux-aha.de>
URL         : http://www.linux-aha.de
Summary     : root access over ssh for <full_username> (<username>)
Description :
This package adds access for direct root-login for:
<full_username> (<username>)

postrm

#!/bin/bash
RPM_INSTALL_PREFIX=
export RPM_INSTALL_PREFIX
HOMEDIR=/root
umask 077

timestamp=`date +%Y%m%d-%H%M%''S`
echo "Deinstallation of package 1.0.0-1 started on $timestamp" >>/var/log/rpm_ssh-rootkey-#username#.log

# finding out authkeyfile
if grep -q ^AuthorizedKeysFile /etc/ssh/sshd_config; then
        AUTHFILE=$(grep ^AuthorizedKeysFile /etc/ssh/sshd_config | awk {'print $2'})
else
        AUTHFILE=".ssh/authorized_keys"
fi
echo "Using authorized keys file: $AUTHFILE" >>/var/log/rpm_ssh-rootkey-#username#.log

# remove key from config file
echo "Removing key for #full_username# (#username#)" >>/var/log/rpm_ssh-rootkey-#username#.log
mv $HOMEDIR/$AUTHFILE $HOMEDIR/$AUTHFILE.tmp_ssh-rootkey-#username#
grep -v " #ssh_key# " $HOMEDIR/$AUTHFILE.tmp_ssh-rootkey-#username# >$HOMEDIR/$AUTHFILE
rm -f $HOMEDIR/$AUTHFILE.tmp_ssh-rootkey-#username#
echo "Deinstallation of package 1.0.0-1 completed" >>/var/log/rpm_ssh-rootkey-#username#.log
echo "" >>/var/log/rpm_ssh-rootkey-#username#.log

rules

#!/usr/bin/make -f
# debian/rules for alien

# Uncomment this to turn on verbose mode.
#export DH_VERBOSE=1

# Use v4 compatability mode, so ldconfig gets added to maint scripts.
export DH_COMPAT=4

PACKAGE=$(shell dh_listpackages)

build:
	dh_testdir

clean:
	dh_testdir
	dh_testroot
	dh_clean -d

binary-indep: build

binary-arch: build
	dh_testdir
	dh_testroot
	dh_clean -k -d
	dh_installdirs

	dh_installdocs
	dh_installchangelogs

# Copy the packages's files.
	find . -maxdepth 1 -mindepth 1 -not -name debian -print0 | \
		xargs -0 -r -i cp -a {} debian/$(PACKAGE)

#
# If you need to move files around in debian/$(PACKAGE) or do some
# binary patching, do it here
#

# This has been known to break on some wacky binaries.
#	dh_strip
	dh_compress
#	dh_fixperms
	dh_makeshlibs
	dh_installdeb
	-dh_shlibdeps
	dh_gencontrol
	dh_md5sums
	dh_builddeb

binary: binary-indep binary-arch
.PHONY: build clean binary-indep binary-arch binary

control

Source: ssh-rootkey-#username#
Section: alien
Priority: extra
Maintainer: Ronny Becker <ronny.becker@linux-aha.de>
Package: ssh-rootkey-#username#
Architecture: all
Depends: coreutils
Version: 1.0
Description: root access over ssh for #full_username# (#username#)
 This package adds access for direct root-login for:
 #full_username# (#username#)

changelog

ssh-rootkey-<username> (1.0.0-2) experimental; urgency=low

  * Initial release

 -- Ronny Becker <ronny.becker@linux-aha.de>  Wed, 01 Sep 2010 10:42:36 +0200

postinst

#!/bin/bash
RPM_INSTALL_PREFIX=
export RPM_INSTALL_PREFIX

HOMEDIR=/root
umask 077 

timestamp=`date +%Y%m%d-%H%M%''S`
echo "Installation package ssh-rootkey-#username#-1.0.0-1 started on $timestamp" >>/var/log/rpm_ssh-rootkey-#username#.log

# finding out authkeyfile
if grep -q ^AuthorizedKeysFile /etc/ssh/sshd_config; then
        AUTHFILE=$(grep ^AuthorizedKeysFile /etc/ssh/sshd_config | awk {'print $2'})
else
        AUTHFILE=".ssh/authorized_keys"
fi
echo "Using authorized keys file: $HOMEDIR/$AUTHFILE" >>/var/log/rpm_ssh-rootkey-#username#.log

# creating dir
[ -d $(dirname $HOMEDIR/$AUTHFILE) ] || mkdir -p $(dirname $HOMEDIR/$AUTHFILE) 

# checking key
if [ -f $HOMEDIR/$AUTHFILE ] ; then
    echo "Removing older sshkey from #full_username# (#username#)" >>/var/log/rpm_ssh-rootkey-#username#.log
    mv -f $HOMEDIR/$AUTHFILE $HOMEDIR/$AUTHFILE.tmp_ssh-rootkey-#username#
    grep -v " #ssh_key# " $HOMEDIR/$AUTHFILE.tmp_ssh-rootkey-#username# >$HOMEDIR/$AUTHFILE
    rm -f $HOMEDIR/$AUTHFILE.tmp_ssh-rootkey-#username#
fi

# adding key
echo "Adding sshkey for #full_username# (#username#)" >>/var/log/rpm_ssh-rootkey-#username#.log
cat >>$HOMEDIR/$AUTHFILE <<!EOFAUTHFILE!
ssh-rsa #ssh_key# #full_username# (#username#)
!EOFAUTHFILE!

echo "Installation package 1.0.0-1 ended with Exit Code $1" >>/var/log/rpm_ssh-rootkey-#username#.log
echo "" >>/var/log/rpm_ssh-rootkey-#username#.log

Variablen/Build

#!/bin/bash
#
# Script to create .deb and .rpm SSH-rootkey Packages
#
# You must provide:
# - unique username
# - full username
# - rsa Key (only the key, without comment and ssh-rsa!)
#
#set -x
echo -n "username: "
read KEY_USERNAME
echo -n "full name: "
read KEY_FULL_USERNAME
echo -n "ssh key (ssh-rsa): "
read KEY_SSH_KEY

echo ""
echo "  copying ${KEY_USERNAME} ..."
cp -a ssh-rootkey-template ssh-rootkey-${KEY_USERNAME}

echo ""
echo "  working on ${KEY_USERNAME} ..."
for I in ssh-rootkey-${KEY_USERNAME}/DEBIAN/postrm ssh-rootkey-${KEY_USERNAME}/DEBIAN/control ssh-rootkey-${KEY_USERNAME}/DEBIAN/postinst
do
 sed -i "s/#username#/${KEY_USERNAME}/g" $I
 sed -i "s/#full_username#/${KEY_FULL_USERNAME}/g" $I
 sed -i "s#\#ssh_key\##${KEY_SSH_KEY}#g" $I
done

echo ""
echo "  creating .deb package ..."
dpkg -b ssh-rootkey-${KEY_USERNAME}

echo ""
echo "  creating .rpm package ..."
alien -c -r ssh-rootkey-${KEY_USERNAME}.deb
mv ssh-rootkey-${KEY_USERNAME}-1.0-2.noarch.rpm ssh-rootkey-${KEY_USERNAME}.rpm

mv *.deb packages/
mv *.rpm packages/

echo ""
echo "Done"
echo ""