#	$OpenBSD: hostbased.sh,v 1.9 2026/03/24 12:31:35 dtucker Exp $
#	Placed in the Public Domain.

# Since helper for host-based authentication uses keys with hard coded
# paths, unlike the other tests it needs to use the real host keys.
# In addition host-based requires:
# - helper(ssh-keysign) must be installed.
# - "EnableSSHKeysign yes" must be in the system client configuration.
# - host and user accepted by system-wide shosts.equiv.
# - host public keys listed in global known hosts files.
# - if host keys are not readable by user:
#   - SUDO must be set.
#   - helper must be setuid root.

tid="hostbased"

mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
( grep -vi hostkey $OBJ/sshd_proxy.orig
cat <<EOF
HostbasedAuthentication yes
HostbasedUsesNameFromPacketOnly yes
IgnoreUserKnownHosts yes
EOF
) > $OBJ/sshd_proxy

mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig
( grep -vi HostbasedAuthentication $OBJ/ssh_proxy.orig | \
  grep -vi GlobalKnownHostsFile | grep -vi UserKnownHostsFile | \
  grep -vi IdentityFile | \
  grep -vi HostKeyAlias
cat <<EOF
HostKeyAlias $HOST
HostbasedAuthentication yes
PreferredAuthentications hostbased
UserKnownHostsFile none
EOF
) > $OBJ/ssh_proxy

algos=
# keep order as in ssh-keysign.c
for t in mldsa ed25519 ecdsa rsa dsa ; do
	key="$sysconfdir/ssh_host_${t}_key"
	test -f $key.pub || continue
	case "`$SSHKEYGEN -l -f $key.pub 2>/dev/null`" in
	10496*MLDSA*)	algos="$algos mldsa-44" ;;
	15616*MLDSA*)	algos="$algos mldsa-65" ;;
	20736*MLDSA*)	algos="$algos mldsa-87" ;;
	256*ECDSA*)	algos="$algos ecdsa-sha2-nistp256" ;;
	384*ECDSA*)	algos="$algos ecdsa-sha2-nistp384" ;;
	521*ECDSA*)	algos="$algos ecdsa-sha2-nistp521" ;;
	*RSA*)		algos="$algos ssh-rsa rsa-sha2-256 rsa-sha2-512" ;;
	*ED25519*)	algos="$algos ssh-ed25519" ;;
	*DSA*)		algos="$algos ssh-dss" ;;
	*)		verbose "unknown host key $key"
			continue;;
	esac
	echo "HostKey $key" >> $OBJ/sshd_proxy
done
test -z "$algos" && fail "no default host-keys"

for algo in $algos; do
	trace "hostbased algo $algo"
	opts="-F $OBJ/ssh_proxy -o HostbasedAlgorithms=$algo"
	SSH_CONNECTION=`$SSH $opts localhost 'echo $SSH_CONNECTION'`
	if test $? -ne 0 ; then
		fail "connect failed, hostbased $algo"
	elif test "x$SSH_CONNECTION" != "xUNKNOWN 65535 UNKNOWN 65535" ; then
		fail "hostbased $algo bad SSH_CONNECTION" \
		    "$SSH_CONNECTION"
	else
		verbose "ok hostbased $algo"
	fi
done
