mirror of
https://github.com/ovh/the-bastion.git
synced 2025-01-06 07:22:14 +08:00
1676979913
A new global option 'ingressRequirePIV' was added, to enable or disable a bastion-wide policy forcing everybody to use only PIV keys.
97 lines
3.7 KiB
Perl
Executable file
97 lines
3.7 KiB
Perl
Executable file
#! /usr/bin/env perl
|
|
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
|
|
use common::sense;
|
|
|
|
use File::Basename;
|
|
use lib dirname(__FILE__) . '/../../../lib/perl';
|
|
use OVH::Result;
|
|
use OVH::Bastion;
|
|
use OVH::Bastion::Plugin qw( :DEFAULT help );
|
|
|
|
my ($indexToDelete);
|
|
my $remainingOptions = OVH::Bastion::Plugin::begin(
|
|
argv => \@ARGV,
|
|
header => "Here are the public keys that allow you to connect to the bastion",
|
|
options => {
|
|
"line-number-to-delete=i" => \$indexToDelete, # legacy name, keep for compatibility
|
|
"id-to-delete|l=i" => \$indexToDelete,
|
|
"fingerprint-to-delete|f=s" => \my $fingerprintToDelete,
|
|
},
|
|
helptext => <<"EOF",
|
|
Remove an ingress public key from your account
|
|
|
|
Usage: --osh SCRIPT_NAME [--id-to-delete|-l ID] [--fingerprint-to-delete|-f FP]
|
|
|
|
-l, --id-to-delete ID Directly specify key id to delete (CAUTION!), you can get id with selfListIngressKeys
|
|
-f, --fingerprint-to-delete FP Directly specify the fingerprint of the key to delete (CAUTION!)
|
|
|
|
If none of these options are specified, you'll be prompted interactively.
|
|
EOF
|
|
);
|
|
|
|
#
|
|
# code
|
|
#
|
|
my $fnret;
|
|
|
|
if ($fingerprintToDelete and defined $indexToDelete) {
|
|
help();
|
|
osh_exit 'ERR_INCOMPATIBLE_PARAMETERS', "You can't specify a line to delete AND a fingerprint to delete at the same time";
|
|
}
|
|
|
|
# first, get all the authorized_keys present in the file
|
|
my $allowedKeyFile = $HOME . '/' . OVH::Bastion::AK_FILE;
|
|
$fnret = OVH::Bastion::get_authorized_keys_from_file(file => $allowedKeyFile, includeInvalid => 1, includePivDisabled => 1);
|
|
$fnret or osh_exit $fnret;
|
|
|
|
my %fingerprint2index;
|
|
my %validKeys;
|
|
|
|
# FIXME check cases with piv disabled keys, RSA keys not respecting the config (too small), and fully invalid keylines
|
|
foreach my $key (@{$fnret->value || []}) {
|
|
OVH::Bastion::print_public_key(key => $key, id => $key->{'index'}, err => $key->{'err'});
|
|
$fingerprint2index{$key->{'fingerprint'}} = $key->{'index'} if (OVH::Bastion::is_valid_fingerprint(fingerprint => $key->{'fingerprint'}));
|
|
$validKeys{$key->{'index'}} = $key if $key->{'err'} eq 'OK';
|
|
}
|
|
|
|
# Do we have anything to delete ?
|
|
if (!%validKeys) {
|
|
warn_syslog("User $self has no valid keys, but somehow connected succcessfully, this shouldn't happen");
|
|
osh_exit 'ERR_NO_KEY', "You have no key to delete (wait, how did you connect in the first place?!)";
|
|
}
|
|
elsif (keys %validKeys == 1) {
|
|
osh_exit 'ERR_ONLY_ONE_KEY', "You can't delete the only valid key you have!";
|
|
}
|
|
elsif (not defined $indexToDelete and not defined $fingerprintToDelete) {
|
|
osh_info "Type the key ID you want to delete then press ENTER (" . (join(',', sort { $a <=> $b } keys %validKeys)) . "):";
|
|
$indexToDelete = <STDIN>;
|
|
chomp $indexToDelete;
|
|
}
|
|
|
|
if (defined $fingerprintToDelete) {
|
|
if (not exists($fingerprint2index{$fingerprintToDelete})) {
|
|
osh_exit 'ERR_NO_MATCH', "Couldn't find any key matching this fingerprint";
|
|
}
|
|
$indexToDelete = $fingerprint2index{$fingerprintToDelete};
|
|
}
|
|
|
|
if ($indexToDelete =~ /^(\d+)$/) {
|
|
$indexToDelete = $1; # untaint
|
|
}
|
|
else {
|
|
osh_exit 'ERR_INVALID_PARAMETER', "Invalid number specified";
|
|
}
|
|
|
|
# here, either indexToDelete has been specified or we just got it from STDIN
|
|
|
|
if (not exists $validKeys{$indexToDelete}) {
|
|
osh_exit 'ERR_INVALID_ID', "Bad key ID";
|
|
}
|
|
|
|
my $deletedKey = delete $validKeys{$indexToDelete};
|
|
|
|
# data: keep the keys order in the new file, instead of having it randomized
|
|
$fnret = OVH::Bastion::put_authorized_keys_to_file(file => $allowedKeyFile, data => [map { $validKeys{$_} } sort keys %validKeys]);
|
|
$fnret or osh_exit $fnret;
|
|
|
|
osh_exit R('OK', msg => "Key ID $indexToDelete successfully deleted", value => {deleted_key => $deletedKey});
|