cfg/bin/vault-sshadd
Knut Ahlers cb2b5b8497
Remove DISPLAY var to prevent calling askpass
Signed-off-by: Knut Ahlers <knut@ahlers.me>
2018-08-31 23:06:41 +02:00

62 lines
1.5 KiB
Bash
Executable file

#!/bin/bash
set -euo pipefail
source "${HOME}/bin/script_framework.sh"
if ! (which vault >/dev/null); then
error "vault is required."
exit 2
fi
# Require something to be passed to this command
if [ $# -eq 0 ]; then
error "You need to specify a key name."
exit 2
fi
# Create a helper script to send STDIN data to ssh-add
HELPER=$(mktemp)
chmod 0700 ${HELPER}
trap "rm ${HELPER}" EXIT
cat -s <<EOF >${HELPER}
#!/bin/bash -eu
export -n DISPLAY
vault read -field=private "secret/ssh-key/\$1" | exec ssh-add -t 3600 -
EOF
for KEY_NAME in $@; do
fingerprint=$(vault read -field=public "/secret/ssh-key/$1" | ssh-keygen -l -f -)
# If this key is already in the agent we don't need to do anything
if (ssh-add -l | grep -q "${fingerprint}"); then
info "[${KEY_NAME}] Key already present."
continue
fi
# Retrieve key from LastPass
PWD=$(vault read -field=passphrase "secret/ssh-key/${KEY_NAME}")
# In case LastPass exitted non-zero we have no password
if ! [ $? -eq 0 ]; then
error "[${KEY_NAME}] Unable to get password. Not trying to unlock."
continue
fi
# Fill password to ssh-add utility
expect <<EOF >/dev/null
spawn ${HELPER} ${KEY_NAME}
expect "Enter passphrase"
send "$PWD\n"
expect "added:" {exit 0} timeout {exit 1}
EOF
if [ $? -eq 0 ]; then
info "[${KEY_NAME}] Should be loaded by now."
vault-patch --log-level=warn secret/ssh-key/${KEY_NAME} last_used=$(date +%Y-%m-%dT%H:%M:%S%z)
else
error "[${KEY_NAME}] Was not added successfully."
fi
done