From patchwork Thu Jun 10 18:35:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steven Guikal X-Patchwork-Id: 1931 Return-Path: Delivered-To: patchwork@archlinux.org Received: from mail.archlinux.org [95.216.189.61] by patchwork.archlinux.org with IMAP (fetchmail-6.4.19) for (single-drop); Thu, 10 Jun 2021 18:36:45 +0000 (UTC) Received: from mail.archlinux.org by mail.archlinux.org with LMTP id 0JJtJbxbwmAuLgMAK+/4rw (envelope-from ) for ; Thu, 10 Jun 2021 18:36:44 +0000 Received: from luna.archlinux.org (luna.archlinux.org [5.9.250.164]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by mail.archlinux.org (Postfix) with ESMTPS id C3E1A6563C9; Thu, 10 Jun 2021 18:36:43 +0000 (UTC) Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id 7EF8D2B35F; Thu, 10 Jun 2021 18:36:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=lists.archlinux.org; s=luna; t=1623350203; bh=9bJ6JWa7xoJf7qyXlFfC+LNZh/DNR+8zFtP0ZUGHvno=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc; b=LYNAeUbLLccayrzT6qo4I24lrjXCWuYqBbnmleblMFI2H+T6ANVhoycB6/+2rkZiE VLh5vG06lotientWVnrUM18yggq6jdSjBwYN4B+lyUfDss0BHLv0yxdT4joxdZhNS4 CfK2f1kC6pSa23Hqhf18Z6gOYwQ7KIwn8rh3VjKOeyigcmXd2tJ6LvCENAjEcBJleG D4Qqo7G2J6yCUMmZFqTclDXYXc/vEKuDmEJPWDKSHifCLEIHp03JK/DvYC/8BwO08k w/HRglWOc5+dw8ElwbPJcVgw3ElQURyknzTAXqHGqMizAgr5DD72muCMxi0ZX40hT6 AyyDWq3pJrPsWHRvnJHbVPjaiKd/XJ2dRbNxag5J4S/NdZYgq/s6KpaZ5aAnYa5nby QM63W71pvacqKQ5C2xQwI2DOQEWa44qdmdvmSk2hT1556FhwcrNhoKE+J/1BvqCgYj UOG+cv1qFJkv12t9S0X0BGkfHtbDDj31+Wt0czbGcthdFtmcWnLZ/2/EjDlJp9AILF C+0Z+RW+j9Dfa9IM6zOGHa5uZvSENTKYMpQzpJIOGVedey55dQjuJgH93z0Jwq3HpG XWJWvUAfP2P3uhFXDcdjnBNOa1uqbbJ0ltrhxdi8zzCDs4MHVoTGHs9b8C1xW0zQcm c5T63aCDf9AIX4WZHw7JO6ZQ= Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id 66E8923DCA for ; Thu, 10 Jun 2021 18:36:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on luna.archlinux.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED=0.1, DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001,RCVD_IN_MSPIKE_WL=0.001,SPF_HELO_NONE=0.001, T_DMARC_POLICY_QUAR=0.01 autolearn=failed autolearn_force=no version=3.4.6 X-Spam-BL-Results: [127.0.0.19] [127.0.5.1] Received: from out0.migadu.com (out0.migadu.com [94.23.1.103]) by luna.archlinux.org (Postfix) with ESMTPS for ; Thu, 10 Jun 2021 18:36:40 +0000 (UTC) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. To: aur-dev@lists.archlinux.org Subject: [PATCH aurweb 1/2] Source valid ssh prefixes from config Date: Thu, 10 Jun 2021 14:35:12 -0400 Message-Id: <20210610183512.516429-1-void@fluix.one> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: void@fluix.one X-BeenThere: aur-dev@lists.archlinux.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "Arch User Repository \(AUR\) Development" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Steven Guikal via aur-dev From: Steven Guikal Reply-To: "Arch User Repository \(AUR\) Development" Cc: Steven Guikal Errors-To: aur-dev-bounces@lists.archlinux.org Sender: "aur-dev" Authentication-Results: mail.archlinux.org; dkim=pass header.d=lists.archlinux.org header.s=luna header.b=LYNAeUbL; dmarc=pass (policy=none) header.from=archlinux.org; spf=pass (mail.archlinux.org: domain of aur-dev-bounces@lists.archlinux.org designates 5.9.250.164 as permitted sender) smtp.mailfrom=aur-dev-bounces@lists.archlinux.org X-Rspamd-Queue-Id: C3E1A6563C9 X-Spamd-Result: default: False [-0.01 / 15.00]; HAS_REPLYTO(0.00)[aur-dev@lists.archlinux.org]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:5.9.250.164:c]; R_MISSING_CHARSET(2.50)[]; REPLYTO_ADDR_EQ_FROM(0.00)[]; BROKEN_CONTENT_TYPE(1.50)[]; RCVD_DKIM_ARC_DNSWL_MED(-0.50)[]; RCVD_COUNT_THREE(0.00)[4]; DKIM_TRACE(0.00)[lists.archlinux.org:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[archlinux.org,none]; RCVD_IN_DNSWL_MED(-0.20)[5.9.250.164:from]; MAILLIST(-0.20)[mailman]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; RCVD_IN_DNSWL_LOW(-0.10)[94.23.1.103:received]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:24940, ipnet:5.9.0.0/16, country:DE]; FROM_NEQ_ENVFROM(0.00)[aur-dev@lists.archlinux.org,aur-dev-bounces@lists.archlinux.org]; ARC_NA(0.00)[]; R_DKIM_ALLOW(-0.20)[lists.archlinux.org:s=luna]; FROM_HAS_DN(0.00)[]; DWL_DNSWL_MED(-2.00)[archlinux.org:dkim]; TAGGED_RCPT(0.00)[aur-dev]; PREVIOUSLY_DELIVERED(0.00)[aur-dev@lists.archlinux.org]; MIME_GOOD(-0.10)[text/plain]; HAS_LIST_UNSUB(-0.01)[]; NEURAL_HAM(-0.00)[-1.000]; FORGED_SENDER_MAILLIST(0.00)[] X-Rspamd-Server: mail.archlinux.org --- I'm not versed in PHP and this hasn't been tested. web/lib/acctfuncs.inc.php | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index efc08331..0d021f99 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -875,11 +875,7 @@ function valid_pgp_fingerprint($fingerprint) { * @return bool True if the SSH public key is valid, otherwise false */ function valid_ssh_pubkey($pubkey) { - $valid_prefixes = array( - "ssh-rsa", "ssh-dss", "ecdsa-sha2-nistp256", - "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-ed25519", - "sk-ssh-ecdsa@openssh.com", "sk-ssh-ed25519@openssh.com" - ); + $valid_prefixes = explode(' ', config_get('auth', 'valid-keytypes')); $has_valid_prefix = false; foreach ($valid_prefixes as $prefix) { From patchwork Thu Jun 10 18:35:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steven Guikal X-Patchwork-Id: 1932 Return-Path: Delivered-To: patchwork@archlinux.org Received: from mail.archlinux.org [95.216.189.61] by patchwork.archlinux.org with IMAP (fetchmail-6.4.19) for (single-drop); Thu, 10 Jun 2021 18:37:02 +0000 (UTC) Received: from mail.archlinux.org by mail.archlinux.org with LMTP id sEGgJ81bwmAxLgMAK+/4rw (envelope-from ) for ; Thu, 10 Jun 2021 18:37:01 +0000 Received: from luna.archlinux.org (luna.archlinux.org [IPv6:2a01:4f8:160:3033::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by mail.archlinux.org (Postfix) with ESMTPS id 11CF36563DB; Thu, 10 Jun 2021 18:37:01 +0000 (UTC) Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id BBF0C2C2D4; Thu, 10 Jun 2021 18:37:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=lists.archlinux.org; s=luna; t=1623350220; bh=fWnbjLkh8xoiziyqV1SRGF1ErposiYdcA1qmOO4xM90=; h=To:Subject:Date:In-Reply-To:References:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc; b=l69NiMv1moKaAf/bWZC82caWigotSELWdz6o9qvQVBfShNv7T1zqC1v7gsqiX4NIi QeLk+Zddp/TcMoVrH+x53C/7/auwDc3IPTZENfsYxWfIUzhgss82Lsd3fbCsSR8gjf y9yuJNOU1N4JvQVkZLaHzAQfR3/U90tVoLwqBwwkGxV02JsLfSc2fowMbcagNlY8R0 sXVVsmm4TaeT8jWej1igzh9kD9zfuyRx+0obTg1QL2uqh1byJ/WHpO14ly9O3x7lDX UraXdp9+MGiNOoQv6xfMgm7J6fN1G9QgV5u0nipQZi3Zkbek9fbraVQna5zfN8dj4g dU4rANBJXoY8BkwMFGYWvYuHj25y5QA/Ny5J1zR/Y1lvS2n/s3RiHmVd3e3hCmrY14 3oUp/piya+emAyKBec21C3yVZXAHm8+IWPDwleN0DDN2ct7JijKDxvNwtN6PwLzwwA IqOsOnxWVuTX7SZ5i9Mpp4Ulqt+x1oYYZS9djg2l9fPuwFalYwRxdEV9eBoQ/VrBg5 SWeHNyTFLCuxe/XkkRQTMwc0CDbudUq4PQ2mq2Vdm4PYarPMc6VhIqBg+tzPMmIjGr En2Cj5muH0JlQ97NS9ssQ2lry9gk2PXUAhja/9dlzAsp7VvM4nqH85UXnVQTf5xshp 6uOf8oTcx02SoQZHuANDC7r8= Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id CC43C2C2D4 for ; Thu, 10 Jun 2021 18:36:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on luna.archlinux.org X-Spam-Level: X-Spam-Status: No, score=-0.1 required=5.0 tests=DKIM_SIGNED=0.1, DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,SPF_HELO_NONE=0.001, T_DMARC_POLICY_QUAR=0.01 autolearn=failed autolearn_force=no version=3.4.6 X-Spam-BL-Results: Received: from out0.migadu.com (out0.migadu.com [IPv6:2001:41d0:2:267::]) by luna.archlinux.org (Postfix) with ESMTPS for ; Thu, 10 Jun 2021 18:36:57 +0000 (UTC) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. To: aur-dev@lists.archlinux.org Subject: [PATCH aurweb 2/2] Add FIDO/U2F ssh keytypes to default config Date: Thu, 10 Jun 2021 14:35:13 -0400 Message-Id: <20210610183512.516429-2-void@fluix.one> In-Reply-To: <20210610183512.516429-1-void@fluix.one> References: <20210610183512.516429-1-void@fluix.one> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: void@fluix.one X-BeenThere: aur-dev@lists.archlinux.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "Arch User Repository \(AUR\) Development" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Steven Guikal via aur-dev From: Steven Guikal Reply-To: "Arch User Repository \(AUR\) Development" Cc: Steven Guikal Errors-To: aur-dev-bounces@lists.archlinux.org Sender: "aur-dev" Authentication-Results: mail.archlinux.org; dkim=pass header.d=lists.archlinux.org header.s=luna header.b=l69NiMv1; dmarc=pass (policy=none) header.from=archlinux.org; spf=pass (mail.archlinux.org: domain of aur-dev-bounces@lists.archlinux.org designates 2a01:4f8:160:3033::2 as permitted sender) smtp.mailfrom=aur-dev-bounces@lists.archlinux.org X-Rspamd-Queue-Id: 11CF36563DB X-Spamd-Result: default: False [0.09 / 15.00]; HAS_REPLYTO(0.00)[aur-dev@lists.archlinux.org]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2a01:4f8:160:3033::2:c]; R_MISSING_CHARSET(2.50)[]; REPLYTO_ADDR_EQ_FROM(0.00)[]; BROKEN_CONTENT_TYPE(1.50)[]; RCVD_DKIM_ARC_DNSWL_MED(-0.50)[]; RCVD_COUNT_THREE(0.00)[4]; DKIM_TRACE(0.00)[lists.archlinux.org:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[archlinux.org,none]; RCVD_IN_DNSWL_MED(-0.20)[2a01:4f8:160:3033::2:from]; MAILLIST(-0.20)[mailman]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:24940, ipnet:2a01:4f8::/32, country:DE]; FROM_NEQ_ENVFROM(0.00)[aur-dev@lists.archlinux.org,aur-dev-bounces@lists.archlinux.org]; ARC_NA(0.00)[]; R_DKIM_ALLOW(-0.20)[lists.archlinux.org:s=luna]; FROM_HAS_DN(0.00)[]; DWL_DNSWL_MED(-2.00)[archlinux.org:dkim]; TAGGED_RCPT(0.00)[aur-dev]; PREVIOUSLY_DELIVERED(0.00)[aur-dev@lists.archlinux.org]; MIME_GOOD(-0.10)[text/plain]; HAS_LIST_UNSUB(-0.01)[]; NEURAL_HAM(-0.00)[-1.000]; FORGED_SENDER_MAILLIST(0.00)[] X-Rspamd-Server: mail.archlinux.org --- conf/config.defaults | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/config.defaults b/conf/config.defaults index 98e033b7..e6961520 100644 --- a/conf/config.defaults +++ b/conf/config.defaults @@ -62,7 +62,7 @@ ECDSA = SHA256:L71Q91yHwmHPYYkJMDgj0xmUuw16qFOhJbBr1mzsiOI RSA = SHA256:Ju+yWiMb/2O+gKQ9RJCDqvRg7l+Q95KFAeqM5sr6l2s [auth] -valid-keytypes = ssh-rsa ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 +valid-keytypes = ssh-rsa ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 sk-ssh-ecdsa@openssh.com sk-ssh-ed25519@openssh.com username-regex = [a-zA-Z0-9]+[.\-_]?[a-zA-Z0-9]+$ git-serve-cmd = /usr/local/bin/aurweb-git-serve ssh-options = restrict