make-ssh-known-hosts

#!/usr/bin/env perl
#
our $rcsid='$Id$';
our $VERSION='1.2';

=pod

=head1 NAME

make-ssh-known-hosts - Harvest SSH keys

=head1 SYNOPSIS

sample [OPTIONS] [FILE ...]

Output the SSH public keys of all hosts specified in the given
I<FILE>s (which must follow the format of F</etc/hosts>).  If not
I<FILE> is given, then read host names and addresses from
F</etc/hosts>.  Relies on the B<ssh-keyscan> program to do the actual
work.

Options:

=over 4

=item -x, --exclude I<REGEX>

Exclude hosts whose name matches I<REGEX>.  Note that I<REGEX> is only
matched against a host's FQDN.

=item -n, --no-act, --just-print

Do not harvest SSH keys, instead print the collected host names and IP
addresses as they would be passed to the B<ssh-keyscan> program.

=item --help

Print help text and exit

=back

=head1 COPYRIGHT AND LICENCE

Copyright (c) 2013 GC3, University of Zurich. All rights reserved.

You may copy, distribute and modify this file according to the GNU GPL
version 3 or (at your option) any later version.
See http://www.gnu.org/licenses/gpl.html for license details.

=cut


use strict;
use English;
use warnings;

use File::Temp ();
use File::Temp qw/:seekable/;
use Getopt::Long;
use Pod::Usage;
use Socket;


# provide default for options
my $verbose = 0;
my $no_act = 0;
my @exclude = ();
Getopt::Long::Configure ('gnu_getopt', 'no_ignore_case');
GetOptions (
    'exclude|x=s' => \@exclude,
    'help' => sub { pod2usage(-verbose => $verbose); },
    'no-act|dry-run|just-print|n!' => \$no_act,
    'verbose|v:+' => \$verbose,
    'version|V' => sub { print $PROGRAM_NAME .' '. $VERSION ."\n"; exit; }
) or pod2usage();


## main

my @hostfiles = @ARGV;
push @hostfiles, '/etc/hosts' if ($#ARGV < 0);

my $tmp = File::Temp->new(TEMPLATE => 'make-ssh-known-hosts.XXXXXX', TMPDIR => 1, UNLINK => 0);

open KEYSCAN, "|-", "ssh-keyscan -t rsa,dsa,ecdsa -f - > " . $tmp->filename
    or die "Cannot run 'ssh-keyscan'";

foreach my $line (@{&hosts2sshkeyscan(hostfiles => \@hostfiles, exclude => \@exclude)}) {
    if ($no_act) {
        print "$line\n";
    } else {
        print KEYSCAN "$line\n";
    };
};

close KEYSCAN;

# now read back ssh-keyscan's output and add IP addresses
open INTERMEDIATE, '<', $tmp->filename
    or die "Cannot re-open intermediate file";
while(<INTERMEDIATE>) {
    chomp;
    my ($names, $type, $key) = split;
    my @names = split(/,/, $names);

    my %ipaddrs;
    foreach my $name (@names) {
        my $ipstruct = gethostbyname($name);
        my $ipaddr = inet_ntoa($ipstruct) if defined($ipstruct);
        $ipaddrs{$ipaddr} = 1 if defined($ipaddr);
    };
    foreach my $ipaddr (keys %ipaddrs) {
        push @names, $ipaddr;
    };
    print STDOUT join(',', @names) . " $type $key\n";
};


## subroutines

# hosts2sshkeyscan (FILE)
#
# Read a hosts file, join on the unqualified names and return a list
# of "addrs names" as expected for `ssh-keyscan` input. (Each "addrs"
# is a comma-separated list of IP addresses, and each "names" is a
# comma-separated list of host names.)
#
sub hosts2sshkeyscan (%) {
    my %parms = @_;
    my @hostfiles = @{$parms{'hostfiles'} or []};
    my @exclude = @{$parms{'exclude'} or []};


    my %addrs;
    my %names;

    foreach my $filename (@hostfiles) {
        open INPUT, "<$filename";
      INPUT_LINE:
        while (<INPUT>) {
            chomp;

            # ignore comments and blank lines
            next if m/^ *(#.*)?$/;

            # parse line
            my ($ipaddr, $fqdn, $aliases) = split(/\s+/, $_, 3);

            # ignore localhost and collective addresses
            next INPUT_LINE if $ipaddr =~ m/^(127\.|::1|ff00::|fe00::0)/;
            next INPUT_LINE if $fqdn =~ m/^ip6-all/;

            foreach my $excl (@exclude) {
                next INPUT_LINE if $fqdn =~ m/$excl/;
            }

            # use unqualified first name as join key
            my $name = (split(/\./, $fqdn))[0];

            if (not defined($addrs{$name})) {
                $addrs{$name} = { };
            }
            $addrs{$name}{$ipaddr} = 1;

            if (not defined($names{$name})) {
                $names{$name} = { };
            };
            $names{$name}{$fqdn} = 1;
            if ($aliases) {
                foreach my $alias (split(/\s+/, $aliases)) {
                    ${$names{$name}}{$alias} = 1;
                };
            };
        };
        close INPUT;
    };

    my $result = [ ];
    foreach my $name (sort keys %addrs) {
        push @$result, (join(',', sort keys %{$addrs{$name}}) .' '. join(',', sort keys %{$names{$name}}));
    };
    return $result;
}


__END__