rc.d/sshd: Add "showfp" cmd to display host key fingerprint

[lwhsu]

Summary

rc.d/sshd: Add "showfp" cmd to display host key fingerprint

It's customized in many cloud images and it's good to have this in base to be
used more widely.

MFC:		1 week
Sponsored by:	The FreeBSD Foundation

[lwhsu]

I'm cleaning up small local changes when sorting my git workspace. This patch may need to be improved, but need to get it out my private tree first.

[emaste]

Do you know if there's some canonical reference for emitting the fingerprints to the system console on startup? Searching for -----BEGIN SSH HOST KEY FINGERPRINTS----- turns up lots of examples, but if there is some canonical reference it would be good to include here.

libexec/rc/rc.d/sshd

77–84

I'm not sure this check adds much value; trying to specify an algorithm that doesn't yet exist would be a bug in sshd_showfp, and falling through to the warn below is fine in that case I'd say

[lwhsu]

Remove unnecessary checks.

[lwhsu]

In D52159#1194978, @emaste wrote:

Do you know if there's some canonical reference for emitting the fingerprints to the system console on startup? Searching for -----BEGIN SSH HOST KEY FINGERPRINTS----- turns up lots of examples, but if there is some canonical reference it would be good to include here.

It's learnt from @cperciva 's ec2 scripts https://github.com/cperciva/ec2-scripts/blob/master/ec2_loghostkey . I skipped the ###... lines but the -----BEGIN... part looks good. The ec2: prefix cloud be useful for certain automation in the clouds. We can have an extension of this work for customizing the format (and even expend to other scripts... that's too far for now.)

[emaste]

libexec/rc/rc.d/sshd

78

I think it would be fine if we didn't capitalize the key here to simplify a bit more, but doesn't matter much either way.

83

if we want to be pedantic

[emaste]

Agree wrt. the BEGIN SSH HOST KEY FINGERPRINTS and #####... lines. Happy to get this in and iterate after we see what people think.

[jlduran]

I wonder if we should also check for presence of the public key.

libexec/rc/rc.d/sshd

77

[emaste]

libexec/rc/rc.d/sshd

77

Presumably || not &&?

Of if ! [ -f ${keyfile}" -a -f "${keyfile}.pub ]

[lwhsu]

check public key file

[lwhsu]

In D52159#1196628, @jlduran wrote:

I wonder if we should also check for presence of the public key.

This is a good point, indeed its output is fingerprint of the public key so perhaps it's better to just check for the public key file. That's what ec2-script does.

I was thinking that checking the private can make sure the key pair is complete, as from the man page ssh-keygen will find the matching public key file.

libexec/rc/rc.d/sshd

78

I'll leave this for now as it's aligning with sshd_keygen_alg(), and maybe update both places in another commit

83

Will update along with sshd_keygen_alg() in another commit.

[jlduran]

This will be displayed on every dmesg -a by default, just like the AWS images. Is this the desired behavior?

[jlduran]

libexec/rc/rc.d/sshd

77

Yes, you are correct. Checking the presence of both files.
Now it's only checking for a pubkey.

[jlduran]

In D52159#1194978, @emaste wrote:

Do you know if there's some canonical reference for emitting the fingerprints to the system console on startup? Searching for -----BEGIN SSH HOST KEY FINGERPRINTS----- turns up lots of examples, but if there is some canonical reference it would be good to include here.

https://docs.aws.amazon.com/en_us/AWSEC2/latest/UserGuide/connection-prereqs-general.html

This is AWS-specific, that's why I thought it was going to be an optional thing (maybe under a checkyesno rc variable).