GitHubMirror/sshyp
1
0
Fork 0
mirror of https://github.com/rwinkhart/sshyp.git synced 2026-09-05 16:47:14 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fixed quick-unlock requirng passphrase regardless of whether or not it is needed - again

Browse Source 
Former-commit-id: 53325cbf8c6f46d4e83c4e9ed4b9f9d4b1196bd5 [formerly a26ca86977]
Former-commit-id: 21fb1f899370f428ea08e1e5bb50bc2610e00983
This commit is contained in:
RandyTheSilly
2022-10-25 11:53:52 -04:00
parent 2ab409e95e
commit 9848d38a0b
1 changed files with 30 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/sshyp.py
+14 -12
View File
@@ -146,7 +146,7 @@ def encrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, _gpg_id, _tmp_dir=pat
def decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, _quick_pass, def decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, _quick_pass,
_tmp_dir=path.expanduser('~/.config/sshyp/tmp/')): # decrypts an entry to a temporary directory _tmp_dir=path.expanduser('~/.config/sshyp/tmp/')): # decrypts an entry to a temporary directory
if not isinstance(_quick_pass, bool): if not isinstance(_quick_pass, bool):
_unlock_method = f"gpg --pinentry-mode loopback --passphrase -qd --output " _unlock_method = f"gpg --pinentry-mode loopback --passphrase '{_quick_pass}' -qd --output "
else: else:
_unlock_method = f"{_gpg_com} -qd --output " _unlock_method = f"{_gpg_com} -qd --output "
if _shm_folder == 0 and _shm_entry == 0: if _shm_folder == 0 and _shm_entry == 0:
@@ -157,12 +157,8 @@ def decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, _quick_pass,
run(_unlock_method + _output_target, shell=True, stderr=PIPE, check=True, close_fds=True) run(_unlock_method + _output_target, shell=True, stderr=PIPE, check=True, close_fds=True)
except CalledProcessError: except CalledProcessError:
if not isinstance(_quick_pass, bool): if not isinstance(_quick_pass, bool):
try: print('\n\u001b[38;5;9merror: your sshyp server is unreachable or quick-unlock is incorrectly '
run(f"gpg --pinentry-mode loopback --passphrase '{_quick_pass}' -qd --output {_output_target}", 'configured\n\nfalling back to standard unlock\u001b[0m\n')
shell=True, stderr=PIPE, check=True, close_fds=True)
except CalledProcessError:
print('\n\u001b[38;5;9merror: quick-unlock failed - falling back to standard unlock\n\nyour sshyp '
'server is unreachable or quick-unlock is incorrectly configured\u001b[0m\n')
try: try:
run(f"{_gpg_com} -qd --output {_output_target}", shell=True, stderr=PIPE, check=True, run(f"{_gpg_com} -qd --output {_output_target}", shell=True, stderr=PIPE, check=True,
close_fds=True) close_fds=True)
@@ -176,7 +172,8 @@ def decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, _quick_pass,
def determine_decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com): def determine_decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com):
if quick_unlock_enabled == 'y': if quick_unlock_enabled == 'y':
decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, whitelist_verify(port, username_ssh, ip)) decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, whitelist_verify(port, username_ssh, ip,
client_device_id))
else: else:
decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, False) decrypt(_entry_dir, _shm_folder, _shm_entry, _gpg_com, False)
@@ -576,11 +573,16 @@ def whitelist_verify(_port, _username_ssh, _ip, _client_device_id):
'@' + _ip + " 'ls ~/.config/sshyp/whitelist'", shell=True, stdout=PIPE, text=True) '@' + _ip + " 'ls ~/.config/sshyp/whitelist'", shell=True, stdout=PIPE, text=True)
for _device_id in _server_whitelist.stdout.rstrip().split('\n'): for _device_id in _server_whitelist.stdout.rstrip().split('\n'):
if _device_id == _client_device_id: if _device_id == _client_device_id:
try:
run(f"gpg --pinentry-mode cancel -qd --output /dev/null {path.expanduser('~/.config/sshyp/lock.gpg')}",
shell=True, stderr=PIPE, check=True, close_fds=True)
_full_password = False
except CalledProcessError:
_quick_unlock_password = input('\nquick-unlock passphrase: ') _quick_unlock_password = input('\nquick-unlock passphrase: ')
_quick_unlock_password_excluded = run( _quick_unlock_password_excluded = \
'ssh -i ' + "'" + path.expanduser('~/.ssh/sshyp') + "' -p " + _port + " " + _username_ssh + '@' + _ip + run('ssh -i ' + "'" + path.expanduser('~/.ssh/sshyp') + "' -p " + _port + " " + _username_ssh + '@'
f" 'gpg --pinentry-mode loopback --passphrase '{_quick_unlock_password}' " + _ip + f" 'gpg --pinentry-mode loopback --passphrase '{_quick_unlock_password}' -qd"
f"-qd ~/.config/sshyp/excluded.gpg'", shell=True, stdout=PIPE, text=True).stdout.rstrip() f" ~/.config/sshyp/excluded.gpg'", shell=True, stdout=PIPE, text=True).stdout.rstrip()
while _i < len(_quick_unlock_password_excluded): while _i < len(_quick_unlock_password_excluded):
try: try:
_full_password += _quick_unlock_password_excluded[_i] _full_password += _quick_unlock_password_excluded[_i]