sync-ssh-keys.sh

#!/bin/bash
set -euo pipefail

# SSH Key Sync Script
# Synchronizes SSH authorized_keys files for multiple users from various sources
# Author: locus313
# Repository: https://github.com/locus313/ssh-key-sync

# shellcheck disable=SC2034  # planned to be used in a future release
readonly SCRIPT_VERSION="0.1.10"
SCRIPT_NAME="$(basename "$0")"
readonly SCRIPT_NAME

# === Configuration and Constants ===
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
readonly SCRIPT_DIR
readonly CONFIG_FILE="$SCRIPT_DIR/users.conf"
readonly DEFAULT_RETRIES=3
readonly DEFAULT_RETRY_DELAY=2
readonly GITHUB_REPO="locus313/ssh-key-sync"

# Global array for tracking temporary files (must be global for EXIT trap access)
declare -a temp_files=()

# === Utility Functions ===

# Log messages with timestamp
log_message() {
  local message="$1"
  local timestamp
  timestamp="$(date '+%Y-%m-%d %H:%M:%S')"
  echo "$timestamp: $message"
}

# Log error messages to stderr
log_error() {
  local message="$1"
  log_message "ERROR: $message" >&2
}

# Log warning messages
log_warning() {
  local message="$1"
  log_message "WARNING: $message" >&2
}

# Log info messages
log_info() {
  local message="$1"
  log_message "INFO: $message" >&2
}

# === Configuration Loading ===

# Load and validate configuration file
load_configuration() {
  if [[ ! -f "$CONFIG_FILE" ]]; then
    log_error "Configuration file 'users.conf' not found in $SCRIPT_DIR. Halting execution."
    exit 1
  fi

  # Load GITHUB_TOKEN from config if set and not already in environment
  if [[ -n "${CONF_GITHUB_TOKEN:-}" && -z "${GITHUB_TOKEN:-}" ]]; then
    export GITHUB_TOKEN="$CONF_GITHUB_TOKEN"
    log_info "Using GitHub token from configuration file"
  fi
}

# Validate configuration after sourcing
validate_configuration() {
  # Validate that USER_KEYS array is defined
  if ! declare -p USER_KEYS &>/dev/null; then
    log_error "USER_KEYS array not defined in configuration file. Halting execution."
    exit 1
  fi
}

# === Key Fetching Functions ===

# Validate method parameter
validate_method() {
  local method="$1"
  case "$method" in
    raw|api|ghuser)
      return 0
      ;;
    *)
      log_error "Unsupported method '$method'. Supported methods: raw, api, ghuser"
      return 1
      ;;
  esac
}

# Fetch key file using raw method (public URL)
fetch_raw_key() {
  local url="$1"
  local output_file="$2"
  
  if [[ -z "$url" ]]; then
    log_error "URL parameter is required for raw method"
    return 1
  fi
  
  curl -fsSL "$url" -o "$output_file"
}

# Fetch key file using GitHub API method (private repository)
fetch_api_key() {
  local url="$1"
  local output_file="$2"
  
  if [[ -z "$url" ]]; then
    log_error "URL parameter is required for API method"
    return 1
  fi
  
  if [[ -z "${GITHUB_TOKEN:-}" ]]; then
    log_error "GITHUB_TOKEN is required for API access"
    return 1
  fi
  
  # ponytail: token passed via curl -K stdin config, not argv, so it can't leak through /proc/<pid>/cmdline or ps
  curl -fsSL -K - "$url" -o "$output_file" <<EOF
header = "Authorization: token $GITHUB_TOKEN"
header = "Accept: application/vnd.github.v3.raw"
EOF
}

# Fetch key file using GitHub user method (public keys)
fetch_ghuser_key() {
  local username="$1"
  local output_file="$2"
  
  if [[ -z "$username" ]]; then
    log_error "Username parameter is required for ghuser method"
    return 1
  fi
  
  curl -fsSL "https://github.com/${username}.keys" -o "$output_file"
}

# Main key fetching function with retry logic
fetch_key_file() {
  local method="$1"
  local target="$2"
  local output_file="$3"
  local retries="${4:-$DEFAULT_RETRIES}"
  local retry_delay="${5:-$DEFAULT_RETRY_DELAY}"

  # Validate required parameters
  if [[ -z "$method" ]]; then
    log_error "Method parameter is required"
    return 1
  fi
  
  if [[ -z "$target" ]]; then
    log_error "Target parameter is required"
    return 1
  fi
  
  if [[ -z "$output_file" ]]; then
    log_error "Output file parameter is required"
    return 1
  fi

  # Validate method
  if ! validate_method "$method"; then
    return 1
  fi

  # Attempt to fetch with retries
  for ((attempt=1; attempt<=retries; attempt++)); do
    local fetch_result=0
    
    case "$method" in
      raw)
        fetch_raw_key "$target" "$output_file" || fetch_result=$?
        ;;
      api)
        fetch_api_key "$target" "$output_file" || fetch_result=$?
        ;;
      ghuser)
        fetch_ghuser_key "$target" "$output_file" || fetch_result=$?
        ;;
    esac

    # If successful, return
    if [[ $fetch_result -eq 0 ]]; then
      return 0
    fi

    # Log retry attempt
    if [[ $attempt -lt $retries ]]; then
      log_warning "Attempt $attempt/$retries failed for method '$method' and target '$target'. Retrying in $retry_delay seconds..."
      sleep "$retry_delay"
    fi
  done

  log_error "All $retries attempts failed for method '$method' and target '$target'"
  return 1
}

# === Self-Update Functions ===

# Download and validate the latest script version
download_latest_script() {
  local latest_url="$1"
  local expected_digest="$2"
  local temp_dir="$3"
  local temp_script="$temp_dir/sync-ssh-keys.sh"
  
  log_info "Downloading latest script from: $latest_url"
  
  if ! curl -fsSL "$latest_url" -o "$temp_script"; then
    log_error "Failed to download the latest script"
    return 1
  fi

  if [[ ! -s "$temp_script" ]]; then
    log_error "Downloaded script is empty"
    return 1
  fi

  # Basic validation - check if it's a bash script
  if ! head -1 "$temp_script" | grep -q "^#!/bin/bash"; then
    log_error "Downloaded file does not appear to be a bash script"
    return 1
  fi

  # Verify integrity against the sha256 digest GitHub computed for this release asset,
  # obtained from the API response (not from the download itself), so a tampered
  # download (compromised CDN/MITM) is caught before it replaces the running script.
  local actual_digest
  actual_digest="sha256:$(sha256sum "$temp_script" | cut -d ' ' -f 1)"
  if [[ "$actual_digest" != "$expected_digest" ]]; then
    log_error "Checksum mismatch: expected $expected_digest, got $actual_digest"
    return 1
  fi

  log_info "Successfully downloaded and validated script"
  return 0
}

# Get the latest release download URL and its expected sha256 digest
get_latest_release_url() {
  local repo="$1"
  local api_url="https://api.github.com/repos/$repo/releases/latest"
  
  log_info "Fetching latest release information..."
  
  local release_json
  if ! release_json=$(curl -fsSL "$api_url"); then
    log_error "Could not fetch release information from GitHub API"
    return 1
  fi

  # Isolate the JSON object for the sync-ssh-keys.sh asset so the digest we
  # extract is the one that actually corresponds to this download URL.
  local asset_block
  asset_block=$(echo "$release_json" | awk '/"name": "sync-ssh-keys.sh"/{f=1} f{print} f&&/^    \}/{exit}')

  local download_url
  download_url=$(echo "$asset_block" | grep '"browser_download_url"' | cut -d '"' -f 4)

  local digest
  digest=$(echo "$asset_block" | grep '"digest"' | cut -d '"' -f 4)

  if [[ -z "$download_url" ]]; then
    log_error "No download URL found for sync-ssh-keys.sh in latest release"
    return 1
  fi

  if [[ -z "$digest" ]]; then
    log_error "No digest found for sync-ssh-keys.sh asset; refusing to self-update without integrity verification"
    return 1
  fi

  echo "$download_url $digest"
}

# Perform self-update of the script
self_update() {
  local latest_url
  local latest_digest
  local temp_dir
  local current_script="$SCRIPT_DIR/$SCRIPT_NAME"

  log_info "Starting self-update process..."

  # Get latest release URL and its expected sha256 digest
  local release_info
  if ! release_info=$(get_latest_release_url "$GITHUB_REPO"); then
    log_error "Failed to get latest release URL"
    exit 1
  fi
  latest_url="${release_info% *}"
  latest_digest="${release_info#* }"

  # Create temporary directory
  if ! temp_dir=$(mktemp -d); then
    log_error "Failed to create temporary directory"
    exit 1
  fi

  # Ensure cleanup on exit
  trap 'rm -rf "$temp_dir"' EXIT

  # Download and validate
  if ! download_latest_script "$latest_url" "$latest_digest" "$temp_dir"; then
    log_error "Failed to download or validate the latest script"
    exit 1
  fi

  # Replace current script
  local temp_script="$temp_dir/sync-ssh-keys.sh"
  if ! chmod +x "$temp_script"; then
    log_error "Failed to make downloaded script executable"
    exit 1
  fi

  if ! mv "$temp_script" "$current_script"; then
    log_error "Failed to replace current script"
    exit 1
  fi

  log_info "Script successfully updated to the latest version"
  exit 0
}

# === User Management Functions ===

# Validate user exists and get user information
validate_user() {
  local username="$1"
  
  if ! id "$username" &>/dev/null; then
    log_warning "User '$username' does not exist. Skipping."
    return 1
  fi
  
  return 0
}

# Get user's home directory safely
get_user_home() {
  local username="$1"
  local user_home
  
  if ! user_home=$(getent passwd "$username" | cut -d: -f6); then
    log_error "Failed to get user information for '$username'"
    return 1
  fi
  
  if [[ -z "$user_home" ]]; then
    log_error "Failed to determine home directory for user '$username'"
    return 1
  fi
  
  echo "$user_home"
}

get_user_gid() {
  local username="$1"
  local user_gid
  
  if ! user_gid=$(getent passwd "$username" | cut -d: -f4); then
    log_error "Failed to get GID for user '$username'"
    return 1
  fi
  
  if [[ -z "$user_gid" ]]; then
    log_error "Failed to determine GID for user '$username'"
    return 1
  fi
  
  echo "$user_gid"
}

# Resolve numeric UID for ownership checks (portable Linux/macOS)
get_path_uid() {
  local path="$1"
  # Boundary: we validate .ssh / authorized_keys themselves, not an
  # attacker-controlled parent home (that needs write access to /home).
  stat -c '%u' "$path" 2>/dev/null || stat -f '%u' "$path" 2>/dev/null
}

# Ensure .ssh is a real directory (not a symlink), owned by the target user when root
validate_ssh_directory() {
  local username="$1"
  local ssh_dir="$2"
  local expected_uid actual_uid

  if [[ -L "$ssh_dir" ]]; then
    log_error "Refusing symlink .ssh directory for user '$username': $ssh_dir"
    return 1
  fi

  if [[ ! -d "$ssh_dir" ]]; then
    log_error ".ssh path is not a directory for user '$username': $ssh_dir"
    return 1
  fi

  # When running as root, require the directory to be owned by the target user so
  # a local account cannot redirect writes into /root/.ssh via a planted symlink.
  if [[ "$(id -u)" -eq 0 ]]; then
    if ! expected_uid=$(id -u "$username" 2>/dev/null); then
      log_error "Failed to resolve UID for user '$username'"
      return 1
    fi
    if ! actual_uid=$(get_path_uid "$ssh_dir"); then
      log_error "Failed to read ownership of .ssh directory for user '$username'"
      return 1
    fi
    if [[ "$actual_uid" != "$expected_uid" ]]; then
      log_error "Refusing .ssh directory not owned by user '$username': $ssh_dir"
      return 1
    fi
  fi

  return 0
}

# Refuse to write through a symlink authorized_keys (or under a symlink .ssh)
validate_authorized_keys_path() {
  local username="$1"
  local auth_keys_file="$2"
  local ssh_dir

  ssh_dir="$(dirname "$auth_keys_file")"

  if [[ -L "$ssh_dir" ]]; then
    log_error "Refusing authorized_keys under symlink .ssh for user '$username': $ssh_dir"
    return 1
  fi

  if [[ -L "$auth_keys_file" ]]; then
    log_error "Refusing to write through symlink authorized_keys for user '$username': $auth_keys_file"
    return 1
  fi

  return 0
}

# Create SSH directory with proper permissions
create_ssh_directory() {
  local username="$1"
  local ssh_dir="$2"
  local user_gid

  # -e is false for a dangling symlink; -L catches both dangling and live links.
  if [[ -L "$ssh_dir" ]]; then
    log_error "Refusing symlink .ssh directory for user '$username': $ssh_dir"
    return 1
  fi

  if [[ -d "$ssh_dir" ]]; then
    validate_ssh_directory "$username" "$ssh_dir"
    return $?
  fi

  if [[ -e "$ssh_dir" ]]; then
    log_error ".ssh path exists and is not a directory for user '$username': $ssh_dir"
    return 1
  fi
  
  log_info "Creating .ssh directory for user '$username' at $ssh_dir"
  
  if ! mkdir -p "$ssh_dir"; then
    log_error "Failed to create .ssh directory for user '$username'"
    return 1
  fi
  
  if ! user_gid=$(get_user_gid "$username"); then
    return 1
  fi
  
  if ! chown "$username:$user_gid" "$ssh_dir"; then
    log_error "Failed to set ownership of .ssh directory for user '$username'"
    return 1
  fi
  
  if ! chmod 700 "$ssh_dir"; then
    log_error "Failed to set permissions on .ssh directory for user '$username'"
    return 1
  fi

  validate_ssh_directory "$username" "$ssh_dir"
  return $?
}

# Update authorized_keys file with proper permissions
update_authorized_keys() {
  local username="$1"
  local temp_file="$2"
  local auth_keys_file="$3"
  local user_gid
  local ssh_dir staging_file

  ssh_dir="$(dirname "$auth_keys_file")"

  if ! validate_ssh_directory "$username" "$ssh_dir"; then
    return 1
  fi

  if ! validate_authorized_keys_path "$username" "$auth_keys_file"; then
    return 1
  fi
  
  # Check if update is needed by comparing files
  if [[ -f "$auth_keys_file" ]] && files_are_identical "$temp_file" "$auth_keys_file"; then
    log_info "No changes detected in authorized_keys for user '$username'"
    return 0
  fi
  
  # Perform update
  if [[ ! -f "$auth_keys_file" ]]; then
    log_info "No existing authorized_keys file for user '$username'. Creating a new one."
  else
    log_info "Changes detected in authorized_keys for user '$username'. Updating the file."
  fi

  # Stage in a system temp file (not under $ssh_dir) so a TOCTOU symlink swap
  # cannot redirect mktemp into /root/.ssh. Re-validate immediately before replace.
  staging_file="$(mktemp)"
  temp_files+=("$staging_file")

  if ! cp "$temp_file" "$staging_file"; then
    log_error "Failed to stage keys for user '$username'"
    rm -f "$staging_file"
    return 1
  fi

  if ! user_gid=$(get_user_gid "$username"); then
    rm -f "$staging_file"
    return 1
  fi

  if ! chown "$username:$user_gid" "$staging_file"; then
    log_error "Failed to set ownership of staged authorized_keys for user '$username'"
    rm -f "$staging_file"
    return 1
  fi

  if ! chmod 600 "$staging_file"; then
    log_error "Failed to set permissions on staged authorized_keys for user '$username'"
    rm -f "$staging_file"
    return 1
  fi

  # Re-check immediately before replace (TOCTOU)
  if ! validate_ssh_directory "$username" "$ssh_dir"; then
    rm -f "$staging_file"
    return 1
  fi
  if ! validate_authorized_keys_path "$username" "$auth_keys_file"; then
    rm -f "$staging_file"
    return 1
  fi

  if ! mv -f "$staging_file" "$auth_keys_file"; then
    log_error "Failed to install authorized_keys for user '$username'"
    rm -f "$staging_file"
    return 1
  fi
  
  log_info "Updated authorized_keys for user '$username' at $auth_keys_file"
  return 0
}

# Compare two files to check if they are identical
files_are_identical() {
  local file1="$1"
  local file2="$2"
  
  # Use a portable comparison method
  if command -v cmp >/dev/null 2>&1; then
    cmp -s "$file1" "$file2"
  elif command -v diff >/dev/null 2>&1; then
    diff -q "$file1" "$file2" >/dev/null 2>&1
  else
    # Fallback to checksum comparison if neither cmp nor diff is available
    local file1_hash file2_hash
    if command -v sha256sum >/dev/null 2>&1; then
      file1_hash=$(sha256sum "$file1" | cut -d' ' -f1)
      file2_hash=$(sha256sum "$file2" | cut -d' ' -f1)
    elif command -v md5sum >/dev/null 2>&1; then
      file1_hash=$(md5sum "$file1" | cut -d' ' -f1)
      file2_hash=$(md5sum "$file2" | cut -d' ' -f1)
    else
      # Last resort: always update if we can't compare
      log_warning "No file comparison tools available. Will always update authorized_keys."
      return 1
    fi
    
    [[ -n "$file1_hash" && "$file1_hash" == "$file2_hash" ]]
  fi
}

# Process a single user's SSH keys
process_user_keys() {
  local username="$1"
  local entry="$2"
  local temp_file="$3"
  
  # Validate required parameters
  if [[ -z "$username" ]]; then
    log_error "Username parameter is required"
    return 1
  fi
  
  if [[ -z "$entry" ]]; then
    log_error "Entry parameter is required for user '$username'"
    return 1
  fi
  
  if [[ -z "$temp_file" ]]; then
    log_error "Temporary file parameter is required for user '$username'"
    return 1
  fi
  
  # Parse method and target from entry
  local method="${entry%%:*}"
  local target="${entry#*:}"
  
  # Validate that we actually have both method and target
  if [[ "$method" == "$entry" ]]; then
    log_error "Invalid entry format for user '$username'. Expected format: method:target"
    return 1
  fi
  
  # Validate user exists
  if ! validate_user "$username"; then
    return 1
  fi
  
  # Get user home directory
  local user_home
  if ! user_home=$(get_user_home "$username"); then
    return 1
  fi
  
  # Set up paths
  local ssh_dir="$user_home/.ssh"
  local auth_keys_file="$ssh_dir/authorized_keys"
  
  # Create SSH directory if needed
  if ! create_ssh_directory "$username" "$ssh_dir"; then
    return 1
  fi
  
  # Fetch key file
  log_info "Fetching key file for $username from $target (method: $method)"
  if ! fetch_key_file "$method" "$target" "$temp_file"; then
    log_error "Failed to fetch key file for user '$username' from $target after multiple attempts"
    return 1
  fi
  
  # Update authorized_keys file
  if ! update_authorized_keys "$username" "$temp_file" "$auth_keys_file"; then
    return 1
  fi
  
  return 0
}

# === Main Execution ===

# Display usage information
show_usage() {
  cat << EOF
Usage: $SCRIPT_NAME [OPTIONS]

SSH Key Sync Script v$SCRIPT_VERSION
Synchronizes SSH authorized_keys files for multiple users from various sources.

OPTIONS:
  --self-update    Update the script to the latest version from GitHub
  --help, -h       Show this help message
  --version, -v    Show version information

For more information, see: https://github.com/$GITHUB_REPO
EOF
}

# Parse command line arguments
parse_arguments() {
  case "${1:-}" in
    --self-update)
      self_update
      ;;
    --help|-h)
      show_usage
      exit 0
      ;;
    --version|-v)
      echo "$SCRIPT_NAME version $SCRIPT_VERSION"
      exit 0
      ;;
    "")
      # No arguments - continue with normal execution
      ;;
    *)
      log_error "Unknown option: $1"
      show_usage
      exit 1
      ;;
  esac
}

# Main function
main() {
  local failed_users=0
  local processed_users=0
  
  log_info "Starting SSH key synchronization (version $SCRIPT_VERSION)"
  
  # Parse command line arguments
  parse_arguments "$@"
  
  # Source configuration file at global scope
  # shellcheck source=users.conf
  if ! source "$CONFIG_FILE"; then
    log_error "Failed to load configuration file 'users.conf'. Please check the file for syntax errors. Halting execution."
    exit 1
  fi
  
  # Load and validate configuration
  log_info "Loading configuration..."
  load_configuration
  log_info "Configuration loaded successfully"
  
  log_info "Validating configuration..."
  validate_configuration
  log_info "Configuration validated successfully"
  
  # Count users defined in USER_KEYS array
  local user_count=0
  if declare -p USER_KEYS &>/dev/null; then
    for username in "${!USER_KEYS[@]}"; do
      user_count=$((user_count + 1))
    done
  fi
  
  log_info "Found $user_count user(s) to process"
  
  if [[ $user_count -eq 0 ]]; then
    log_warning "No users defined in USER_KEYS array. Nothing to do."
    exit 0
  fi
  
  # Set up cleanup trap for temporary files
  trap 'if [[ ${#temp_files[@]} -gt 0 ]]; then rm -f "${temp_files[@]}"; fi' EXIT
  
  # Process each user
  for username in "${!USER_KEYS[@]}"; do
    local temp_file=""
    if ! temp_file=$(mktemp); then
      log_error "Failed to create temporary file for user '$username'"
      failed_users=$((failed_users + 1))
      continue
    fi
    
    temp_files+=("$temp_file")
    local entry="${USER_KEYS[$username]}"
    
    if process_user_keys "$username" "$entry" "$temp_file"; then
      log_info "Successfully processed user '$username'"
    else
      log_error "Failed to process user '$username'"
      failed_users=$((failed_users + 1))
    fi
    
    processed_users=$((processed_users + 1))
    
    # Clean up temp file immediately after processing
    rm -f "$temp_file"
  done
  
  # Summary
  log_info "Synchronization complete. Processed: $processed_users, Failed: $failed_users"
  
  if [[ $failed_users -gt 0 ]]; then
    exit 1
  fi
}

# Execute main function with all arguments
main "$@"