From patchwork Thu Jun 10 17:39:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steven Guikal X-Patchwork-Id: 1930 Return-Path: Delivered-To: patchwork@archlinux.org Received: from mail.archlinux.org [95.216.189.61] by patchwork.archlinux.org with IMAP (fetchmail-6.4.19) for (single-drop); Thu, 10 Jun 2021 17:39:37 +0000 (UTC) Received: from mail.archlinux.org by mail.archlinux.org with LMTP id QKI5IFhOwmDOJwMAK+/4rw (envelope-from ) for ; Thu, 10 Jun 2021 17:39:36 +0000 Received: from luna.archlinux.org (luna.archlinux.org [IPv6:2a01:4f8:160:3033::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by mail.archlinux.org (Postfix) with ESMTPS id 6BB4E655ED2; Thu, 10 Jun 2021 17:39:35 +0000 (UTC) Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id 257B923A73; Thu, 10 Jun 2021 17:39:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=lists.archlinux.org; s=luna; t=1623346775; bh=3lwc8UA1nHvbZ7JZaST22H4A12kpIYIb466ef0wvrok=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc; b=Ax8TruvN5NHse4tb5dZPlj3XRun/GECJYCQtHN6BAFaZ1VltQalJZd6WGQhvrc4uF APGEujb60gQN/tYvkUn91ZvddydVgP/UF/lM0FRkMLf/BK1gPN9gUbiQQ/RFRDqF8E h8Cz1ecQUkQjmqB1QO9qtYyU1bDR/RfMeqXwo/F+/TwqcuL28MRrxbHjyarr9kUwMH G8+J3BBLS9FkDWC1Jz1JyHPrrMqOhl02nUqv+DEE3Gf/+VXN7WTVQRc06dR/PBJLme wgRvVapD7VL8A6qdT7uwR/aQrpaTzzLtGbK11P0YJ8FnuSGtBdNS6lUr953z60Frwd nrStmn/+9EcAqNZfIxW1jB3cXXOdt1LF3zCNZf3DQziqM/87YF7Nf9X1rtDR9wVZ3T Y6kOBn/S3ikbsX3J6i8GTEnJVIyMzOqgKb03QhN9P+L3+MCuNNReLPS85dgLbVmCk3 snlVwBEoWz4oAsp4gT9mAJ9Pq9aL3fJKK0Htps4GMdCMm5zu4biRtk7azMskiV9dRg +PA7GKSTkLLgolY5aTdbEnsV9B2xKXZnqxscWB4vJI6iKCbhBAsqw0ELpHhcIu4TFZ nIhUGcZyVcRvDyEK7E7Dw5XOkC9MjuYSObNZLN0/fC1tD9/XcC/aBc/GNj20PQZ4xA sVrnv7FTYplY6QWJQlzLaGQ8= Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id 6891323A6B for ; Thu, 10 Jun 2021 17:39:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on luna.archlinux.org X-Spam-Level: X-Spam-Status: No, score=-0.1 required=5.0 tests=DKIM_SIGNED=0.1, DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,SPF_HELO_NONE=0.001, T_DMARC_POLICY_QUAR=0.01 autolearn=failed autolearn_force=no version=3.4.6 X-Spam-BL-Results: Received: from out2.migadu.com (out2.migadu.com [IPv6:2001:41d0:2:aacc::]) by luna.archlinux.org (Postfix) with ESMTPS for ; Thu, 10 Jun 2021 17:39:32 +0000 (UTC) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. To: aur-dev@lists.archlinux.org Subject: [PATCH aurweb] Allow FIDO/U2F SSH security keys Date: Thu, 10 Jun 2021 13:39:11 -0400 Message-Id: <20210610173910.511809-1-void@fluix.one> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: void@fluix.one X-BeenThere: aur-dev@lists.archlinux.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "Arch User Repository \(AUR\) Development" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Steven Guikal via aur-dev From: Steven Guikal Reply-To: "Arch User Repository \(AUR\) Development" Cc: Steven Guikal Errors-To: aur-dev-bounces@lists.archlinux.org Sender: "aur-dev" Authentication-Results: mail.archlinux.org; dkim=pass header.d=lists.archlinux.org header.s=luna header.b=Ax8TruvN; dmarc=pass (policy=none) header.from=archlinux.org; spf=pass (mail.archlinux.org: domain of aur-dev-bounces@lists.archlinux.org designates 2a01:4f8:160:3033::2 as permitted sender) smtp.mailfrom=aur-dev-bounces@lists.archlinux.org X-Rspamd-Queue-Id: 6BB4E655ED2 X-Spamd-Result: default: False [0.09 / 15.00]; HAS_REPLYTO(0.00)[aur-dev@lists.archlinux.org]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2a01:4f8:160:3033::2:c]; R_MISSING_CHARSET(2.50)[]; REPLYTO_ADDR_EQ_FROM(0.00)[]; BROKEN_CONTENT_TYPE(1.50)[]; RCVD_DKIM_ARC_DNSWL_MED(-0.50)[]; RCVD_COUNT_THREE(0.00)[4]; DKIM_TRACE(0.00)[lists.archlinux.org:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[archlinux.org,none]; RCVD_IN_DNSWL_MED(-0.20)[2a01:4f8:160:3033::2:from]; MAILLIST(-0.20)[mailman]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:24940, ipnet:2a01:4f8::/32, country:DE]; FROM_NEQ_ENVFROM(0.00)[aur-dev@lists.archlinux.org,aur-dev-bounces@lists.archlinux.org]; ARC_NA(0.00)[]; R_DKIM_ALLOW(-0.20)[lists.archlinux.org:s=luna]; FROM_HAS_DN(0.00)[]; DWL_DNSWL_MED(-2.00)[archlinux.org:dkim]; TAGGED_RCPT(0.00)[aur-dev]; PREVIOUSLY_DELIVERED(0.00)[aur-dev@lists.archlinux.org]; MIME_GOOD(-0.10)[text/plain]; HAS_LIST_UNSUB(-0.01)[]; NEURAL_HAM(-0.00)[-1.000]; FORGED_SENDER_MAILLIST(0.00)[] X-Rspamd-Server: mail.archlinux.org These were added in OpenSSH bersion 8.2[1]. Fixes #36 [1]: https://www.openssh.com/txt/release-8.2 --- Just a heads up that I haven't tested this and aren't sure if the keys are used anywhere else that may be affected (though a grep makes me think they aren't). web/lib/acctfuncs.inc.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index df016c6d..efc08331 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -877,7 +877,8 @@ function valid_pgp_fingerprint($fingerprint) { function valid_ssh_pubkey($pubkey) { $valid_prefixes = array( "ssh-rsa", "ssh-dss", "ecdsa-sha2-nistp256", - "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-ed25519" + "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-ed25519", + "sk-ssh-ecdsa@openssh.com", "sk-ssh-ed25519@openssh.com" ); $has_valid_prefix = false;