The check last login loop for listing ssh reject users was wrong

The inside variable user "username" instead of "user"

bin/authorized_key_location_change.sh

@@ -2,19 +2,24 @@
 
 # check if we need to move the users authorized keys to the central location
 
-TEST=0;
+TEST=1;
+LIST=0;
 SKIP_USERS=();
-while getopts ":tis:" opt; do
+while getopts ":gls:" opt; do
 	case "${opt}" in
-		t|test)
-			TEST=1;
+		g|go)
+			# default we
+			TEST=0;
 			;;
 		s|skip)
 			SKIP_USERS+=("${OPTARG}");
 			;;
+		l|list)
+			LIST=1;
+			;;
 		\?)
 			echo -e "\n Option does not exist: ${OPTARG}\n";
-			echo "Use -t for test and -s <user> for users to skip";
+			echo "Use -g for go (run) and -s <user> for users to skip";
 			exit 1;
 			;;
 	esac;
@@ -23,6 +28,7 @@ done;
 # check if authorized keys is actually enabled
 # detect ssh authorized_keys setting
 SSH_CENTRAL_AUTHORIZED_FILE_FOLDER='';
+SSH_MASTER_AUTHORIZED_FILE='';
 SSH_AUTHORIZED_FILE='';
 for cf in $(grep "^AuthorizedKeysFile" /etc/ssh/sshd_config | grep "%u"); do
 	if [ ! -z $(echo "${cf}" | grep "%u") ]; then
@@ -37,17 +43,53 @@ if [ -z "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}" ]; then
 	echo "No central authorized_keys file detected, no change check needed";
 	exit;
 fi;
-echo "SSH Authorized Files folder: ${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}";
+for cf in $(grep "^AuthorizedKeysFile" /etc/ssh/sshd_config | grep -- "--master"); do
+	if [ ! -z $(echo "${cf}" | grep -- "--master") ]; then
+		SSH_MASTER_AUTHORIZED_FILE="${cf}";
+		if [ ! -f "${SSH_MASTER_AUTHORIZED_FILE}" ]; then
+			echo "ssh master authorized_file could not be found: ${SSH_MASTER_AUTHORIZED_FILE}"l
+			exit;
+		fi;
+	fi;
+done;
+if [ -z "${SSH_MASTER_AUTHORIZED_FILE}" ]; then
+	echo "No master authorized_key file detected, no change check needed";
+	exit;
+fi;
+echo "SSH Master Authorized Key file: ${SSH_MASTER_AUTHORIZED_FILE}";
+echo "SSH Authorized Keys file folder: ${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}";
 
+if [ ${LIST} -eq 1 ]; then
+	ls -l "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}";
+	lsattr "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}";
+	exit;
+fi;
+
+# base folder
+BASE_FOLDER=$(dirname $(readlink -f $0))"/";
+# output printf
 PRINTF_INFO="%-8s [%3s]: %-25s: %s\n";
 # list of user accounts we will never touch
-NO_ACTION=(root admin ec2-user ubuntu);
+NO_ACTION=(root);
+# move, but must check that master is set
+# master key is the first in the authorized keys list for the below users
+MASTER_KEY=(admin ec2-user ubuntu);
+# skip user file
+IGNORE_USER_FILE="../config/authorized_key_location_change.ignore"
+# list of users to skip from file
+IGNORE_USER=();
+
+if [ -f "${BASE_FOLDER}${IGNORE_USER_FILE}" ]; then
+	readarray -t IGNORE_USER < "${BASE_FOLDER}${IGNORE_USER_FILE}";
+	echo "Reading ${IGNORE_USER_FILE}";
+fi;
 
 # loop over passwd file
 # if not in no action then check if .ssh/authorized_keys file exists
 cat /etc/passwd | cut -d ":" -f 1,6 |
 while read user_home; do
 	username=$(echo "${user_home}" | cut -d ":" -f 1);
+	master_user=0;
 	# skip admin usernames
 	if [[ " ${NO_ACTION[*]} " =~ " ${username} " ]]; then
 		printf "${PRINTF_INFO}" "NO ACT" "!" "${username}" "user in NO ACTION list";
@@ -57,6 +99,10 @@ while read user_home; do
 		printf "${PRINTF_INFO}" "SKIP" "*" "${username}" "skip forced via command line";
 		continue;
 	fi;
+	if [[ " ${IGNORE_USER[*]} " =~ " ${username} " ]]; then
+		printf "${PRINTF_INFO}" "SKIP" "**" "${username}" "skip from ignore config file";
+		continue;
+	fi;
 	home_folder=$(echo "${user_home}" | cut -d ":" -f 2);
 	# skip no .ssh/authorized_ekys
 	if [ ! -f "${home_folder}/.ssh/authorized_keys" ]; then
@@ -68,15 +114,28 @@ while read user_home; do
 		fi;
 		continue;
 	fi;
+	# check those keys are in the master key list
+	if [[ " ${MASTER_KEY[*]} " =~ " ${username} " ]]; then
+		master_user=1;
+		ssh_key_diff=$(diff -u "${home_folder}/.ssh/authorized_keys" "${SSH_MASTER_AUTHORIZED_FILE}");
+		if [ ! -z "${ssh_key_diff}" ]; then
+			printf "${PRINTF_INFO}" "ABORT" "!!!" "${username}" "authorized key is not matching the master key file";
+			exit;
+		fi;
+	fi;
 	# check if this user public key(s) exist in AuthorizedKeysFile target
 	if [ -f "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}" ]; then
 		ssh_key_diff=$(diff -u "${home_folder}/.ssh/authorized_keys" "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}");
 		if [ -z "${ssh_key_diff}" ]; then
 			printf "${PRINTF_INFO}" "REMOVE" "-" "${username}" ".ssh/authorized_keys";
-			if [ ${TEST} -eq 0 ]; then
-				rm "${home_folder}/.ssh/authorized_keys";
+			if [ ${master_user} -eq 0 ]; then
+				if [ ${TEST} -eq 0 ]; then
+					rm "${home_folder}/.ssh/authorized_keys";
+				else
+					echo "$> rm \"${home_folder}/.ssh/authorized_keys\"";
+				fi;
 			else
-				echo "$> rm \"${home_folder}/.ssh/authorized_keys\"";
+				echo "[!] No delete for master user, must be done manually";
 			fi;
 			continue;
 		fi;
@@ -99,14 +158,22 @@ while read user_home; do
 			break;
 		fi;
 		# remove home .ssh/authorized_keys (do not remove folder)
-		rm "${home_folder}/.ssh/authorized_keys";
+		if [ ${master_user} -eq 0 ]; then
+			rm "${home_folder}/.ssh/authorized_keys";
+		else
+			echo "=> No delete for master user, must be done manually";
+		fi;
 	else
 		echo "[START] ====>";
 		echo "$> cat \"${home_folder}/.ssh/authorized_keys\" > \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
 		echo "$> chown ${username} \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
 		echo "$> chmod 400 \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
 		echo "$> chattr +i \"${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}/${username}\"";
-		echo "$> rm \"${home_folder}/.ssh/authorized_keys\"";
+		if [ ${master_user} -eq 0 ]; then
+			echo "$> rm \"${home_folder}/.ssh/authorized_keys\"";
+		else
+			echo "[!] No delete for master user, must be done manually";
+		fi;
 		echo "[END  ] ====>";
 	fi;
 done;

bin/check_last_login.sh

@@ -122,7 +122,7 @@ done;
 echo "--------------------->"
 echo "Showing current SSH Reject users:"
 for user in $(cat /etc/group|grep "${ssh_reject_group}:" | cut -d ":" -f 4 | sed -e 's/,/ /g'); do
-	echo "${username}";
+	echo "${user}";
 done;
 if [ ! -z "${delete_accounts}" ]; then
 	echo "--------------------->"