ScriptsCollections/SSH-Rotate-Keys
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

First stage for ssh key rotate and remove scripts

Browse Source
This commit is contained in:
Clemens Schwaighofer
2024-05-15 18:41:43 +09:00
parent cba0f964e7
commit 950dc33cb9
5 changed files with 315 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
ReadMe.md
View File

@@ -4,8 +4,26 @@
- copy to server to
- $ADMIN/.ssh (to be ended for admin user)
- /etc/ssh/authorized_keys--master
- /etc/ssh/authorized_keys/$ADMIN
- /etc/ssh/authorized_keys/$USER
Then remove old key
Store ssh key name for current period
## Scripts
### rotate-ssh-keys.sh
Will create a new key and deploy on the server and move the PEM part to the
local SSH folder
### remove-old-ssh-keys.sh
Will check in the previous ssh public key folder and remove this entry from the remote server
### Options
- -h override single host name
- -u override user name for a host
- -f force key change
- -n dry run

124
bin/remove-old-ssh-keys.sh Normal file → Executable file
View File

@@ -6,6 +6,44 @@ BASE_FOLDER=$(dirname "$(readlink -f "$0")")"/";
CONFIG_BASE="${BASE_FOLDER}../config/";
# previous public key
SSH_PUBLIC_KEYS_PREVIOUS="${BASE_FOLDER}../ssh-public-keys/previous/";
# list of admin user names, if username does not match this only update the user entry
ADMIN_USERS=(admin ubuntu ec2-user)
DRY_RUN=0;
FORCE=0;
HOST_ONLY="";
USER_ONLY="";
#
while getopts ":h:u:nf" opt; do
case "${opt}" in
h|hostname)
HOST_ONLY="${OPTARG}";
;;
u|username)
USER_ONLY="${OPTARG}";
;;
n|dry-run)
DRY_RUN=1;
;;
f|force)
FORCE=1;
;;
\?)
echo -e "\n Option does not exist: ${OPTARG}\n";
echo "-h override single host name";
echo "-u override user name for a host";
echo "-f force key change";
echo "-n dry run";
echo ""
exit 1;
;;
esac
done
if [ ! -d "${SSH_PUBLIC_KEYS_PREVIOUS}" ]; then
echo "Missing ssh public keys previous folder: ${SSH_PUBLIC_KEYS_PREVIOUS}";
exit;
fi
# load config
if [ -f "${CONFIG_BASE}settings.ini" ]; then
@@ -17,13 +55,91 @@ if [ ! -f "${CONFIG_BASE}${server_list}" ]; then
exit
fi
# default ssh command
SSH="ssh -a -x";
remove_ssh_key() {
AUTH_KEY_FILE="${1}";
PUB_KEY_FILE="${2}";
RMV_CHATTR_I="chattr -i"
ADD_CHATTR_I="chattr +i"
RMV_CHMOD_UW="chmod u-w"
ADD_CHMOD_UW="chmod u+w"
pub_key=$(cat "${PUB_KEY_FILE}");
# we need to escape for sed
pub_key_escaped=$(printf '%s\n' "$pub_key" | sed -e 's/[]\/$*.^[]/\\&/g');
# the -z `tail ...` checks for a trailing newline. The echo adds one if was missing (from ssh-copy-id)
UNINSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
if [ -f "${AUTH_KEY_FILE}" ] && grep "${pub_key}" "${AUTH_KEY_FILE}" >> /dev/null; then
${RMV_CHATTR_I} "${AUTH_KEY_FILE}";
${ADD_CHMOD_UW} "${AUTH_KEY_FILE}";
sed -i "/${pub_key_escaped}/d" "${AUTH_KEY_FILE}";
${RMV_CHMOD_UW} "${AUTH_KEY_FILE}";
${ADD_CHATTR_I} "${AUTH_KEY_FILE}";
fi;
EOF
);
# to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
printf "exec sudo sh -c '%s'" "${UNINSTALLKEYS_SH}"
}
uninstall_ssh_key() {
HOSTNAME="${1}";
USERNAME="${2}";
PUB_KEY_FILE="${3}";
AUTH_KEY_FILE="${4}";
echo "[.] Remove from auth file: ${AUTH_KEY_FILE}";
if [ ${DRY_RUN} -eq 0 ]; then
# find the pub key in the file and remove this line only
${SSH} "${USERNAME}"@"${HOSTNAME}" "$(remove_ssh_key "${AUTH_KEY_FILE}" "${PUB_KEY_FILE}")"
else
echo "${SSH} \"${USERNAME}\"@\"${HOSTNAME}\" \"\$(remove_ssh_key \"${AUTH_KEY_FILE}\" \"${PUB_KEY_FILE}\")\"";
fi
}
# find last public in remote server and remove it
for line in `cat "${CONFIG_BASE}${server_list}" | sed 1d`; do
hostname=$(echo "${line}" | cut -d "," -f 1)
# flags are current "M" for multi key, has other users public key in too
flags=$(echo "${line}" | cut -d "," -f 2)
echo "Remove previous key for: ${hostname}";
if [[ "${i}" =~ ^\# ]]; then
continue;
fi
# hostname is on pos 1
hostname=$(echo "${line}" | cut -d "," -f 1);
# if hostname opt set and not matching skip
if [ ! -z "${HOST_ONLY}" ] && [ "${HOST_ONLY}" != "${hostname}" ]; then
continue;
fi
# login user name
username=$(echo "${line}" | cut -d "," -f 2);
# if username opt set and not matching skip
if [ ! -z "${USER_ONLY}" ] && [ "${USER_ONLY}" != "${username}" ]; then
continue;
fi
# flags: (not used at the moment)
flags=$(echo "${line}" | cut -d "," -f 3);
# ssh key names
SSH_KEY_PUB_FILE="${hostname}_${username}.pem.pub";
# previous public key does not exist, skip
if [ ! -f "${SSH_PUBLIC_KEYS_PREVIOUS}${SSH_KEY_PUB_FILE}" ]; then
echo "[!] Missing previous public key file ${SSH_KEY_PUB_FILE} for ${username}@${hostname}";
continue;
fi
echo "[-] Remove previous key for: ${username}@${hostname} with flags '${flags}'";
# find in master key and $admin user
if [[ ${ADMIN_USERS[@]} =~ $username ]]; then
# find in "/etc/ssh/authorized_keys--master";
uninstall_ssh_key "${hostname}" "${username}" "${SSH_PUBLIC_KEYS_PREVIOUS}${SSH_KEY_PUB_FILE}" "/etc/ssh/authorized_keys--master";
fi
uninstall_ssh_key "${hostname}" "${username}" "${SSH_PUBLIC_KEYS_PREVIOUS}${SSH_KEY_PUB_FILE}" "/etc/ssh/authorized_keys/${username}"
# remove old key
echo "[-] Remove previous public key: ${SSH_KEY_PUB_FILE}";
if [ ${DRY_RUN} -eq 0 ]; then
rm "${SSH_PUBLIC_KEYS_PREVIOUS}${SSH_KEY_PUB_FILE}";
else
echo "rm \"${SSH_PUBLIC_KEYS_PREVIOUS}${SSH_KEY_PUB_FILE}\";";
fi;
echo "[=] ............... DONE";
done
# __END__

223
bin/rotate-ssh-keys.sh
View File

@@ -19,17 +19,15 @@ SSH_PRIVATE_KEYS="${BASE_FOLDER}../ssh-keys/";
# ssh public keys from current and last
SSH_PUBLIC_KEYS_PREVIOUS="${BASE_FOLDER}../ssh-public-keys/previous/";
SSH_PUBLIC_KEYS_CURRENT="${BASE_FOLDER}../ssh-public-keys/current/";
# PEM folder for server
PEM_SERVER="${HOME}/.ssh/PEMS/SERVER-ADMIN/";
# PEM archive folder
PEM_ARCHIVE="${HOME}/.ssh/ARCHIVED_PEMs/SERVER-ADMIN/$(date +%F)/";
# list of admin user names, if username does not match this only update the user entry
ADMIN_USERS=(admin ubuntu ec2-user)
DRYRUN=0;
DRY_RUN=0;
FORCE=0;
HOST_ONLY="";
USER_ONLY="";
#
while getopts ":h:u:n" opt; do
while getopts ":h:u:nf" opt; do
case "${opt}" in
h|hostname)
HOST_ONLY="${OPTARG}";
@@ -37,8 +35,8 @@ while getopts ":h:u:n" opt; do
u|username)
USER_ONLY="${OPTARG}";
;;
n|dryrun)
DRYRUN=1;
n|dry-run)
DRY_RUN=1;
;;
f|force)
FORCE=1;
@@ -46,12 +44,14 @@ while getopts ":h:u:n" opt; do
\?)
echo -e "\n Option does not exist: ${OPTARG}\n";
echo "-h override single host name";
echo "-u override user name for a host";
echo "-f force key change";
echo "-n dry run";
echo ""
exit 1;
;;
esac;
done;
esac
done
if [ ! -d "${SSH_PRIVATE_KEYS}" ]; then
echo "Missing ssh private keys folder: ${SSH_PRIVATE_KEYS}";
@@ -74,77 +74,92 @@ if [ -z "${key_age}" ]; then
echo "A minimnum key age in days must be set";
exit;
fi
# we must have "server_list" set and file must be in config folder
if [ ! -f "${CONFIG_BASE}${server_list}" ]; then
echo "Cannot find ${server_list} file in the config folder";
exit;
fi
# If the path is under "" then the ~ replacement is needed
# PEM folder for server
__PEM_SERVER="${server_pem_folder}";
if [ -z "${server_pem_folder##~\/*}" ]; then
server_pem_folder="${server_pem_folder/~\//"${HOME}"\/}";
fi;
PEM_SERVER="${server_pem_folder}/";
if [ ! -d "${PEM_SERVER}" ]; then
echo "Cannot found PEM server key folder: ${PEM_SERVER}";
exit;
fi
# PEM archive folder
__PEM_ARCHIVE="${server_pem_archive_folder}/$(date +%F)/";
if [ -z "${server_pem_archive_folder##~\/*}" ]; then
server_pem_archive_folder="${server_pem_archive_folder/~\//"${HOME}"\/}";
fi
PEM_ARCHIVE="${server_pem_archive_folder}";
if [ ! -d "${PEM_ARCHIVE}" ]; then
echo "Cannot found PEM server key archive folder: ${PEM_ARCHIVE}";
exit;
fi
# add todays date
PEM_ARCHIVE="${PEM_ARCHIVE}/$(date +%F)/"
# default ssh command
SSH="ssh -a -x";
# Add the SSH Key to an auth file if it does not exist yet and the auth file does exist
# Build bash command to run this
# @Params
# AUTH_KEY_FILE {1}: the auth key file where to add the key
# PUB_KEY_FILE {2}: Public key file name
add_ssh_key() {
AUTH_KEY_FILE="${1}";
PUB_KEY_DATA="${2}";
PUB_KEY_FILE="${2}";
RMV_CHATTR_I="chattr -i"
ADD_CHATTR_I="chattr +i"
RMV_CHMOD_UW="chamod u-w "
RMV_CHMOD_UW="chmod u-w"
ADD_CHMOD_UW="chmod u+w"
# { [ -z \`tail -1c ${AUTH_KEY_FILE} 2>/dev/null\` ] ||
# echo >> "${AUTH_KEY_FILE}" || exit 1; } &&
# cat >> "${AUTH_KEY_FILE}" || exit 1;
# check if same key already exists, if yes, skip
# check if the auth file exists and the key is not yet in the auth file
# the -z `tail ...` checks for a trailing newline. The echo adds one if was missing (from ssh-copy-id)
# if [ -f "${AUTH_KEY_FILE}" ] && ! cat >> grep "${AUTH_KEY_FILE}"; then
# ${RMV_CHATTR_I} ${AUTH_KEY_FILE}
# ${ADD_CHMOD_UW} ${AUTH_KEY_FILE}
# { [ -z \`tail -1c ${AUTH_KEY_FILE} 2>/dev/null\` ] ||
# echo >> "${AUTH_KEY_FILE}" || exit 1; } &&
# cat >> "${AUTH_KEY_FILE}"
# ${RMV_CHMOD_UW} ${AUTH_KEY_FILE}
# ${ADD_CHATTR_I} ${AUTH_KEY_FILE}
# fi;
# PROBLEM:
# for grep from pipe, the left data is removed. we also can't cat from pipe
# into a var as that would go through a pipe and not be visible
# so we get the pub key file name and read it here
pub_key=$(cat "${PUB_KEY_FILE}");
INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
if [ -f "~/TEMP_SSH_PUB.pem.pub" ] && ! cat >> grep "~/TEMP_SSH_PUB.pem.pub"; then
${RMV_CHATTR_I} ~/TEMP_SSH_PUB.pem.pub
${ADD_CHMOD_UW} ~/TEMP_SSH_PUB.pem.pub
{ [ -z \`tail -1c ~/TEMP_SSH_PUB.pem.pub 2>/dev/null\` ] ||
echo >> "~/TEMP_SSH_PUB.pem.pub || exit 1; } &&
cat >> "~/TEMP_SSH_PUB.pem.pub"
${RMV_CHMOD_UW} ~/TEMP_SSH_PUB.pem.pub
${ADD_CHATTR_I} ~/TEMP_SSH_PUB.pem.pub
if [ -f "${AUTH_KEY_FILE}" ] && ! grep "${pub_key}" "${AUTH_KEY_FILE}" >> /dev/null; then
${RMV_CHATTR_I} "${AUTH_KEY_FILE}";
${ADD_CHMOD_UW} "${AUTH_KEY_FILE}";
{ [ -z \`tail -1c ${AUTH_KEY_FILE} 2>/dev/null\` ] ||
echo >> "${AUTH_KEY_FILE}" || exit 1; } &&
echo "${pub_key}" >> "${AUTH_KEY_FILE}" || exit 1;
${RMV_CHMOD_UW} "${AUTH_KEY_FILE}";
${ADD_CHATTR_I} "${AUTH_KEY_FILE}";
fi;
EOF
)
);
# to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"
printf "exec sudo sh -c '%s'" "${INSTALLKEYS_SH}"
}
# install call
# @Params
# HOSTNAME {1} hostname to access
# USERNAME {2} username to use
# PUB_KEY_FILE {3} public key file to add
# AUTH_KEY_FILE {4} auth key file where to add the public key
install_ssh_key() {
HOSTNAME="${1}";
USERNAME="${2}";
PUB_KEY="${3}";
PUB_KEY_FILE="${3}";
AUTH_KEY_FILE="${4}";
# PUB_KEY_DATA=$(printf '%s\n' "$(cat "${PUB_KEY}")")
echo "=== FILE ${AUTH_KEY_FILE}";
printf '%s\n' "$(cat "${PUB_KEY}")" | ${SSH} "${USERNAME}"@"${HOSTNAME}" "$(add_ssh_key "${AUTH_KEY_FILE}" "${PUB_KEY_DATA}")"
}
# Remove all last entries
# Move all current to last
if [ ${DRYRUN} -eq 0 ]; then
echo "Remove all previous ssh public keys";
rm "${SSH_PUBLIC_KEYS_PREVIOUS}"*;
echo "Move all current public keys to the previous folder";
mv "${SSH_PUBLIC_KEYS_CURRENT}"* "${SSH_PUBLIC_KEYS_PREVIOUS}";
# create new archive folder local
mkdir -p "${PEM_ARCHIVE}";
echo "[.] Add to auth file: ${AUTH_KEY_FILE}";
if [ ${DRY_RUN} -eq 0 ]; then
${SSH} "${USERNAME}"@"${HOSTNAME}" "$(add_ssh_key "${AUTH_KEY_FILE}" "${PUB_KEY_FILE}")"
else
echo "${SSH} \"${USERNAME}\"@\"${HOSTNAME}\" \"\$(add_ssh_key \"${AUTH_KEY_FILE}\" \"${PUB_KEY_FILE}\")\"";
fi
}
for line in `cat "${CONFIG_BASE}${server_list}" | sed 1d`; do
if [[ "${i}" =~ ^\# ]]; then
@@ -170,43 +185,123 @@ for line in `cat "${CONFIG_BASE}${server_list}" | sed 1d`; do
age=$(( ($current_timestamp - $last_rotate) ))
days_left=$(( (age)/(3600*24) ))
if [ $days_left -le $key_age ]; then
echo "Last rotate for ${username}@${hostname} was ${days_left} days ago, minimum is ${key_age}";
echo "[!] Last rotate for ${username}@${hostname} was ${days_left} days ago, minimum is ${key_age}";
echo "[_] ............... SKIP";
continue;
fi
fi
# flags: (not used at the moment)
# Possible: U (add to .ssh/authorized_keys)
flags=$(echo "${line}" | cut -d "," -f 3);
# name for the SSH key files
SSH_KEY_FILE="${hostname}_${username}.pem";
SSH_KEY_PUB_FILE="${hostname}_${username}.pem.pub";
# create name
echo "Create new key for: ${username}@${hostname} with flags '${flags}'";
# if current exist, skip creation
# if pem or pub missing, but not both, alert and skip
# else create new
if [ -f "${SSH_KEY_FILE}" ]
ssh-keygen -t ed25519 -N "" -C "${hostname}: $(date +%F)" -f "${SSH_PRIVATE_KEYS}${SSH_KEY_FILE}"
CREATE_NEW_KEY=0;
# if we have force, override this all
if [ ${FORCE} -eq 1 ]; then
CREATE_NEW_KEY=1;
elif [ -f "${SSH_PRIVATE_KEYS}${SSH_KEY_FILE}" ] || [ -f "${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}" ]; then
# if we miss private key -> alert skip
if [ ! -f "${SSH_PRIVATE_KEYS}${SSH_KEY_FILE}" ]; then
# extract public key from ${PEM_SERVER}${SSH_KEY_FILE} and check if same to public key
if [ ! -f "${PEM_SERVER}${SSH_KEY_FILE}" ]; then
echo "[!] There are no master pem file to extract public key from for ${username}@${hostname}";
echo "[_] ............... SKIP";
continue;
else
__COMP_PUB_KEY=$(ssh-keygen -y -f "${PEM_SERVER}${SSH_KEY_FILE}");
__CURRENT_PUB_KEY=$(cat "${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}");
if [ "${__COMP_PUB_KEY}" != "${__CURRENT_PUB_KEY}" ]; then
echo "[!] Current PEM public key does not match existing for ${username}@${hostname}";
echo "[!] Current Public: ${__CURRENT_PUB_KEY}";
echo "[!] Master Public : ${__COMP_PUB_KEY}";
echo "[_] ............... SKIP";
continue;
fi
fi
fi
else
CREATE_NEW_KEY=1
fi
# create name
NEW_KEY_CREATED=0;
if [ ${CREATE_NEW_KEY} -eq 1 ]; then
echo "[+] Create new key for: ${username}@${hostname} with flags '${flags}' as: ${SSH_KEY_PUB_FILE}";
# previous still exists? alert and abort
if [ -f "${SSH_PUBLIC_KEYS_PREVIOUS}${SSH_KEY_PUB_FILE}" ]; then
echo "[!] Previous public key still exists, was the remote key removed for ${username}@${hostname}";
continue;
fi
# Move all current to last
if [ -f "${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}" ]; then
echo "[>] Move current public key to the previous folder";
if [ ${DRY_RUN} -eq 0 ]; then
mv "${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}" "${SSH_PUBLIC_KEYS_PREVIOUS}";
else
echo "mv \"${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}\" \"${SSH_PUBLIC_KEYS_PREVIOUS}\";";
fi
fi
# only create if not dry run
if [ ${DRY_RUN} -eq 0 ]; then
# <<< $'\ny'
ssh-keygen -q -t ed25519 -N "" -C "${username}@${hostname}: $(date +%F)" -f "${SSH_PRIVATE_KEYS}${SSH_KEY_FILE}"
# move the public key to the current folder
mv "${SSH_PRIVATE_KEYS}${SSH_KEY_PUB_FILE}" "${SSH_PUBLIC_KEYS_CURRENT}";
# flag new key creation for move
else
echo "ssh-keygen -q -t ed25519 -N \"\" -C \"${username}@${hostname}: $(date +%F)\" -f \"${SSH_PRIVATE_KEYS}${SSH_KEY_FILE}\";";
echo "mv \"${SSH_PRIVATE_KEYS}${SSH_KEY_PUB_FILE}\" \"${SSH_PUBLIC_KEYS_CURRENT}\";";
fi
NEW_KEY_CREATED=1;
else
echo "[~] Deploy current key for: ${username}@${hostname} with flags '${flags}': ${SSH_KEY_PUB_FILE}";
fi
# deploy public key to server
if [[ ${ADMIN_USERS[@]} =~ $username ]]; then
# - master admin file
install_ssh_key "${hostname}" "${username}" "${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}" "/etc/ssh/authorized_keys--master"
install_ssh_key "${hostname}" "${username}" "${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}" "/etc/ssh/authorized_keys--master";
fi
# - admin ssh config auth file
install_ssh_key "${hostname}" "${username}" "${SSH_PUBLIC_KEYS_CURRENT}${SSH_KEY_PUB_FILE}" "/etc/ssh/authorized_keys/${username}"
if [ ${NEW_KEY_CREATED} -eq 1 ]; then
# - copy local PEM file to archive folder
if [ ${DRYRUN} -eq 0 ]; then
if [ -f "${PEM_SERVER}${SSH_KEY_FILE}" ]; then
cp "${PEM_SERVER}${SSH_KEY_FILE}" "${PEM_ARCHIVE}";
# create new archive folder local, one time action
if [ ! -d "${PEM_ARCHIVE}" ]; then
echo "[+] Create ${PEM_ARCHIVE}":
if [ ${DRY_RUN} -eq 0 ]; then
mkdir -p "${PEM_ARCHIVE}";
else
echo "mkdir -p \"${PEM_ARCHIVE}\";";
fi
fi
echo "[>] Move old PEM key to archive folder: ${__PEM_ARCHIVE}";
if [ ${DRY_RUN} -eq 0 ]; then
cp "${PEM_SERVER}${SSH_KEY_FILE}" "${PEM_ARCHIVE}";
else
echo "cp \"${PEM_SERVER}${SSH_KEY_FILE}\" \"${PEM_ARCHIVE}\";";
fi
fi
echo "[>] Move PEM key '${SSH_KEY_FILE}' to .ssh folder: ${__PEM_SERVER}";
if [ ${DRY_RUN} -eq 0 ]; then
# - copy to local ssh folder
mv "${SSH_PRIVATE_KEYS}${SSH_KEY_FILE}" "${PEM_SERVER}";
else
echo "mv \"${SSH_PRIVATE_KEYS}${SSH_KEY_FILE}\" \"${PEM_SERVER}\";";
fi
fi
# post roate write timestamp into rotate file
if [ ${DRYRUN} -eq 0 ]; then
if [ ${DRY_RUN} -eq 0 ]; then
echo $(date +%s) > "${LAST_ROTATE}${hostname}_${username}.last-rotate";
else
echo "\"echo $(date +%s) > \"${LAST_ROTATE}${hostname}_${username}.last-rotate\";";
fi
echo "[=] ............... DONE";
done

1
config/.gitignore vendored
View File

@@ -1,2 +1,3 @@
*
!.gitignore
!settings.sample.ini

6
config/settings.sample.ini Normal file
View File

@@ -0,0 +1,6 @@
[Settings]
key_age=90
server_list=server_list.csv
# if start with ~/ it will be replaced with $HOME
server_pem_folder=path to pem folder for server pems
server_pem_archive_folder=path to archive folder for old pems