docs: add fingerprint

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

DOCS.md

@@ -207,6 +207,9 @@ key
 passphrase
 : The purpose of the passphrase is usually to encrypt the private key.
 
+fingerprint
+: fingerprint SHA256 of the host public key, default is to skip verification
+
 target
 : folder path of target host
 
@@ -255,6 +258,9 @@ proxy_key_path
 proxy_passphrase
 : The purpose of the passphrase is usually to encrypt the private key.
 
+proxy_fingerprint
+: fingerprint SHA256 of the host public key, default is to skip verification
+
 ## Template Reference
 
 repo.owner

Makefile

@@ -117,16 +117,18 @@ endif
 	docker push $(DEPLOY_ACCOUNT)/$(DEPLOY_IMAGE):$(tag)
 
 ssh-server:
-	adduser -h /home/drone-scp -s /bin/bash -D -S drone-scp
+	adduser -h /home/drone-scp -s /bin/sh -D -S drone-scp
 	echo drone-scp:1234 | chpasswd
 	mkdir -p /home/drone-scp/.ssh
 	chmod 700 /home/drone-scp/.ssh
 	cat tests/.ssh/id_rsa.pub >> /home/drone-scp/.ssh/authorized_keys
 	cat tests/.ssh/test.pub >> /home/drone-scp/.ssh/authorized_keys
+	chmod 600 /home/drone-scp/.ssh/authorized_keys
 	chown -R drone-scp /home/drone-scp/.ssh
 	# install ssh and start server
 	apk add --update openssh openrc
 	rm -rf /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_dsa_key
+	sed -i 's/^#PubkeyAuthentication yes/PubkeyAuthentication yes/g' /etc/ssh/sshd_config
 	sed -i 's/AllowTcpForwarding no/AllowTcpForwarding yes/g' /etc/ssh/sshd_config
 	./tests/entrypoint.sh /usr/sbin/sshd -D &
 

go.mod

@@ -4,9 +4,10 @@ go 1.14
 
 require (
 	github.com/appleboy/com v0.0.6
-	github.com/appleboy/easyssh-proxy v1.3.1
+	github.com/appleboy/easyssh-proxy v1.3.5
 	github.com/fatih/color v1.9.0
 	github.com/joho/godotenv v1.3.0
 	github.com/stretchr/testify v1.5.1
 	github.com/urfave/cli/v2 v2.2.0
+	golang.org/x/crypto v0.0.0-20191227163750-53104e6ec876
 )

go.sum

@@ -3,8 +3,8 @@ github.com/ScaleFT/sshkeys v0.0.0-20181112160850-82451a803681 h1:JS2rl38kZmHgWa0
 github.com/ScaleFT/sshkeys v0.0.0-20181112160850-82451a803681/go.mod h1:WfDateMPQ/55dPbZRp5Zxrux5WiEaHsjk9puUhz0KgY=
 github.com/appleboy/com v0.0.6 h1:l8cZ0aQJU/SWyL79ciYAJeqV835PRdlZ6efiPhus5Ic=
 github.com/appleboy/com v0.0.6/go.mod h1:jnufjIC3opMlReyPPPye+8JqNvUzLm25o7h6SOy8nv0=
-github.com/appleboy/easyssh-proxy v1.3.1 h1:zj5u800KIRPziMlJouhd2R6jufz6ihGlFSmojzXYSOw=
+github.com/appleboy/easyssh-proxy v1.3.5 h1:EGTCbqAVRcGKHQMFSxz30lQmb+0nXL+jUiCrg/FjHQM=
-github.com/appleboy/easyssh-proxy v1.3.1/go.mod h1:Kk57I3w7OCafOjp5kgZFvxk2fO8Tca5CriBTOsbSbjY=
+github.com/appleboy/easyssh-proxy v1.3.5/go.mod h1:Kk57I3w7OCafOjp5kgZFvxk2fO8Tca5CriBTOsbSbjY=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=

main.go

@@ -17,6 +17,13 @@ var (
 )
 
 func main() {
+	// Load env-file if it exists first
+	if filename, found := os.LookupEnv("PLUGIN_ENV_FILE"); found {
+		_ = godotenv.Load(filename)
+	}
+
+	defaultCiphers := []string{"aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "arcfour256", "arcfour128", "aes128-cbc", "3des-cbc"}
+
 	app := cli.NewApp()
 	app.Name = "Drone SCP"
 	app.Usage = "Copy files and artifacts via SSH."
@@ -32,9 +39,10 @@ func main() {
 	app.Version = Version
 	app.Flags = []cli.Flag{
 		&cli.StringSliceFlag{
-			Name:    "host, H",
+			Name:     "host, H",
-			Usage:   "Server host",
+			Usage:    "Server host",
-			EnvVars: []string{"PLUGIN_HOST", "SCP_HOST", "SSH_HOST", "HOST", "INPUT_HOST"},
+			EnvVars:  []string{"PLUGIN_HOST", "SCP_HOST", "SSH_HOST", "HOST", "INPUT_HOST"},
+			FilePath: ".host",
 		},
 		&cli.StringFlag{
 			Name:    "port, P",
@@ -52,6 +60,17 @@ func main() {
 			Usage:   "Password for password-based authentication",
 			EnvVars: []string{"PLUGIN_PASSWORD", "SCP_PASSWORD", "SSH_PASSWORD", "PASSWORD", "INPUT_PASSWORD"},
 		},
+		&cli.StringSliceFlag{
+			Name:    "ciphers",
+			Usage:   "The allowed cipher algorithms. If unspecified then a sensible",
+			EnvVars: []string{"PLUGIN_CIPHERS", "SSH_CIPHERS", "CIPHERS", "INPUT_CIPHERS"},
+			Value:   cli.NewStringSlice(defaultCiphers...),
+		},
+		&cli.StringFlag{
+			Name:    "fingerprint",
+			Usage:   "fingerprint SHA256 of the host public key, default is to skip verification",
+			EnvVars: []string{"PLUGIN_FINGERPRINT", "SSH_FINGERPRINT", "FINGERPRINT", "INPUT_FINGERPRINT"},
+		},
 		&cli.DurationFlag{
 			Name:    "timeout",
 			Usage:   "connection timeout",
@@ -147,10 +166,6 @@ func main() {
 			Usage:   "build link",
 			EnvVars: []string{"DRONE_BUILD_LINK"},
 		},
-		&cli.StringFlag{
-			Name:  "env-file",
-			Usage: "source env file",
-		},
 		&cli.StringFlag{
 			Name:    "proxy.ssh-key",
 			Usage:   "private ssh key of proxy",
@@ -182,6 +197,17 @@ func main() {
 			Usage:   "connect to host of proxy",
 			EnvVars: []string{"PLUGIN_PROXY_HOST", "PROXY_SSH_HOST", "PROXY_HOST", "INPUT_PROXY_HOST"},
 		},
+		&cli.StringSliceFlag{
+			Name:    "proxy.ciphers",
+			Usage:   "The allowed cipher algorithms. If unspecified then a sensible",
+			EnvVars: []string{"PLUGIN_PROXY_CIPHERS", "PROXY_SSH_CIPHERS", "PROXY_CIPHERS", "INPUT_PROXY_CIPHERS"},
+			Value:   cli.NewStringSlice(defaultCiphers...),
+		},
+		&cli.StringFlag{
+			Name:    "proxy.fingerprint",
+			Usage:   "fingerprint SHA256 of the host public key, default is to skip verification",
+			EnvVars: []string{"PLUGIN_PROXY_FINGERPRINT", "SSH_PROXY_FINGERPRINT", "PROXY_FINGERPRINT", "INPUT_PROXY_FINGERPRINT"},
+		},
 		&cli.StringFlag{
 			Name:    "proxy.port",
 			Usage:   "connect to port of proxy",
@@ -260,10 +286,6 @@ REPOSITORY:
 }
 
 func run(c *cli.Context) error {
-	if c.String("env-file") != "" {
-		_ = godotenv.Load(c.String("env-file"))
-	}
-
 	plugin := Plugin{
 		Repo: Repo{
 			Owner: c.String("repo.owner"),
@@ -285,6 +307,7 @@ func run(c *cli.Context) error {
 			Username:        c.String("username"),
 			Password:        c.String("password"),
 			Passphrase:      c.String("ssh-passphrase"),
+			Fingerprint:     c.String("fingerprint"),
 			Timeout:         c.Duration("timeout"),
 			CommandTimeout:  c.Duration("command.timeout"),
 			Key:             c.String("ssh-key"),
@@ -297,15 +320,18 @@ func run(c *cli.Context) error {
 			TarExec:         c.String("tar.exec"),
 			TarTmpPath:      c.String("tar.tmp-path"),
 			Overwrite:       c.Bool("overwrite"),
+			Ciphers:         c.StringSlice("ciphers"),
 			Proxy: easyssh.DefaultConfig{
-				Key:        c.String("proxy.ssh-key"),
+				Key:         c.String("proxy.ssh-key"),
-				Passphrase: c.String("proxy.ssh-passphrase"),
+				Passphrase:  c.String("proxy.ssh-passphrase"),
-				KeyPath:    c.String("proxy.key-path"),
+				Fingerprint: c.String("proxy.fingerprint"),
-				User:       c.String("proxy.username"),
+				KeyPath:     c.String("proxy.key-path"),
-				Password:   c.String("proxy.password"),
+				User:        c.String("proxy.username"),
-				Server:     c.String("proxy.host"),
+				Password:    c.String("proxy.password"),
-				Port:       c.String("proxy.port"),
+				Server:      c.String("proxy.host"),
-				Timeout:    c.Duration("proxy.timeout"),
+				Port:        c.String("proxy.port"),
+				Timeout:     c.Duration("proxy.timeout"),
+				Ciphers:     c.StringSlice("proxy.ciphers"),
 			},
 		},
 	}

plugin.go

@@ -51,6 +51,7 @@ type (
 		Password        string
 		Key             string
 		Passphrase      string
+		Fingerprint     string
 		KeyPath         string
 		Timeout         time.Duration
 		CommandTimeout  time.Duration
@@ -63,6 +64,7 @@ type (
 		Proxy           easyssh.DefaultConfig
 		Debug           bool
 		Overwrite       bool
+		Ciphers         []string
 	}
 
 	// Plugin values.
@@ -165,23 +167,27 @@ func (p *Plugin) removeDestFile(ssh *easyssh.MakeConfig) error {
 func (p *Plugin) removeAllDestFile() error {
 	for _, host := range p.Config.Host {
 		ssh := &easyssh.MakeConfig{
-			Server:     host,
+			Server:      host,
-			User:       p.Config.Username,
+			User:        p.Config.Username,
-			Password:   p.Config.Password,
+			Password:    p.Config.Password,
-			Port:       p.Config.Port,
+			Port:        p.Config.Port,
-			Key:        p.Config.Key,
+			Key:         p.Config.Key,
-			KeyPath:    p.Config.KeyPath,
+			KeyPath:     p.Config.KeyPath,
-			Passphrase: p.Config.Passphrase,
+			Passphrase:  p.Config.Passphrase,
-			Timeout:    p.Config.Timeout,
+			Timeout:     p.Config.Timeout,
+			Ciphers:     p.Config.Ciphers,
+			Fingerprint: p.Config.Fingerprint,
 			Proxy: easyssh.DefaultConfig{
-				Server:     p.Config.Proxy.Server,
+				Server:      p.Config.Proxy.Server,
-				User:       p.Config.Proxy.User,
+				User:        p.Config.Proxy.User,
-				Password:   p.Config.Proxy.Password,
+				Password:    p.Config.Proxy.Password,
-				Port:       p.Config.Proxy.Port,
+				Port:        p.Config.Proxy.Port,
-				Key:        p.Config.Proxy.Key,
+				Key:         p.Config.Proxy.Key,
-				KeyPath:    p.Config.Proxy.KeyPath,
+				KeyPath:     p.Config.Proxy.KeyPath,
-				Passphrase: p.Config.Proxy.Passphrase,
+				Passphrase:  p.Config.Proxy.Passphrase,
-				Timeout:    p.Config.Proxy.Timeout,
+				Timeout:     p.Config.Proxy.Timeout,
+				Ciphers:     p.Config.Proxy.Ciphers,
+				Fingerprint: p.Config.Proxy.Fingerprint,
 			},
 		}
 
@@ -275,23 +281,27 @@ func (p *Plugin) Exec() error {
 		go func(host string) {
 			// Create MakeConfig instance with remote username, server address and path to private key.
 			ssh := &easyssh.MakeConfig{
-				Server:     host,
+				Server:      host,
-				User:       p.Config.Username,
+				User:        p.Config.Username,
-				Password:   p.Config.Password,
+				Password:    p.Config.Password,
-				Port:       p.Config.Port,
+				Port:        p.Config.Port,
-				Key:        p.Config.Key,
+				Key:         p.Config.Key,
-				KeyPath:    p.Config.KeyPath,
+				KeyPath:     p.Config.KeyPath,
-				Passphrase: p.Config.Passphrase,
+				Passphrase:  p.Config.Passphrase,
-				Timeout:    p.Config.Timeout,
+				Timeout:     p.Config.Timeout,
+				Ciphers:     p.Config.Ciphers,
+				Fingerprint: p.Config.Fingerprint,
 				Proxy: easyssh.DefaultConfig{
-					Server:     p.Config.Proxy.Server,
+					Server:      p.Config.Proxy.Server,
-					User:       p.Config.Proxy.User,
+					User:        p.Config.Proxy.User,
-					Password:   p.Config.Proxy.Password,
+					Password:    p.Config.Proxy.Password,
-					Port:       p.Config.Proxy.Port,
+					Port:        p.Config.Proxy.Port,
-					Key:        p.Config.Proxy.Key,
+					Key:         p.Config.Proxy.Key,
-					KeyPath:    p.Config.Proxy.KeyPath,
+					KeyPath:     p.Config.Proxy.KeyPath,
-					Passphrase: p.Config.Proxy.Passphrase,
+					Passphrase:  p.Config.Proxy.Passphrase,
-					Timeout:    p.Config.Proxy.Timeout,
+					Timeout:     p.Config.Proxy.Timeout,
+					Ciphers:     p.Config.Proxy.Ciphers,
+					Fingerprint: p.Config.Proxy.Fingerprint,
 				},
 			}
 

plugin_test.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"io/ioutil"
+	"log"
 	"os"
 	"os/exec"
 	"os/user"
@@ -11,6 +13,7 @@ import (
 
 	"github.com/appleboy/easyssh-proxy"
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/crypto/ssh"
 )
 
 func TestMissingAllConfig(t *testing.T) {
@@ -169,6 +172,90 @@ func TestSCPFileFromPublicKeyWithPassphrase(t *testing.T) {
 	}
 }
 
+func TestWrongFingerprint(t *testing.T) {
+	u, err := user.Lookup("drone-scp")
+	if err != nil {
+		t.Fatalf("Lookup: %v", err)
+	}
+
+	plugin := Plugin{
+		Config: Config{
+			Host:           []string{"localhost"},
+			Username:       "drone-scp",
+			Port:           "22",
+			KeyPath:        "./tests/.ssh/id_rsa",
+			Source:         []string{"tests/a.txt", "tests/b.txt"},
+			Target:         []string{filepath.Join(u.HomeDir, "/test2")},
+			CommandTimeout: 60 * time.Second,
+			TarExec:        "tar",
+			Fingerprint:    "wrong",
+		},
+	}
+
+	err = plugin.Exec()
+	log.Println(err)
+	assert.NotNil(t, err)
+}
+
+func getHostPublicKeyFile(keypath string) (ssh.PublicKey, error) {
+	var pubkey ssh.PublicKey
+	var err error
+	buf, err := ioutil.ReadFile(keypath)
+	if err != nil {
+		return nil, err
+	}
+
+	pubkey, _, _, _, err = ssh.ParseAuthorizedKey(buf)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return pubkey, nil
+}
+
+func TestSCPFileFromPublicKeyWithFingerprint(t *testing.T) {
+	if os.Getenv("SSH_AUTH_SOCK") != "" {
+		if err := exec.Command("eval", "`ssh-agent -k`").Run(); err != nil {
+			t.Fatalf("exec: %v", err)
+		}
+	}
+
+	u, err := user.Lookup("drone-scp")
+	if err != nil {
+		t.Fatalf("Lookup: %v", err)
+	}
+
+	hostKey, err := getHostPublicKeyFile("/etc/ssh/ssh_host_rsa_key.pub")
+	assert.NoError(t, err)
+
+	plugin := Plugin{
+		Config: Config{
+			Host:           []string{"localhost"},
+			Username:       "drone-scp",
+			Port:           "22",
+			KeyPath:        "./tests/.ssh/id_rsa",
+			Fingerprint:    ssh.FingerprintSHA256(hostKey),
+			Source:         []string{"tests/a.txt", "tests/b.txt"},
+			Target:         []string{filepath.Join(u.HomeDir, "/test2")},
+			CommandTimeout: 60 * time.Second,
+			TarExec:        "tar",
+		},
+	}
+
+	err = plugin.Exec()
+	assert.Nil(t, err)
+
+	// check file exist
+	if _, err := os.Stat(filepath.Join(u.HomeDir, "/test2/tests/a.txt")); os.IsNotExist(err) {
+		t.Fatalf("SCP-error: %v", err)
+	}
+
+	if _, err := os.Stat(filepath.Join(u.HomeDir, "/test2/tests/b.txt")); os.IsNotExist(err) {
+		t.Fatalf("SCP-error: %v", err)
+	}
+}
+
 func TestSCPWildcardFileList(t *testing.T) {
 	if os.Getenv("SSH_AUTH_SOCK") != "" {
 		if err := exec.Command("eval", "`ssh-agent -k`").Run(); err != nil {