more specific grep pattern

authorized_keys

@@ -1,14 +0,0 @@
-# Yubikey
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCoRxIS1Dr33Jhybd/ck7UCLQ1Df5msSpvw03w/ljgB+1sx/U+965+q597XRHHnzPey8NFrOdID4I1l0tfco1XG5DJG2yJ/zY+tbyK+0b0Yi4qbRFnH2kxKYcdHq29CiVk64o1VHJxxj78IO2wTUcgK4sXijm05LWqCik4LSfcOBEyOwK6f37Mew19KDq7UAojHLTEbVB6xiv2ufh9evn3PggirE1VtvQlTBnt3NdBDumxD1RzRoVgwMuU1FNvQeMwLnlMlvLX76vjPkRRrgBGEJ2k0BUm7slrAtRnBzIvIbouk55MIBzpPjCIi53L91KxwNkHNPldYG81C+BczN/R5 cardno:000604717732
-
-# Chromebook (GalliumOS)
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDxUNqjpukVhDXJnicD0dOhMMaQPOqYgPR14NSUd9rLp lobo@gallium
-
-# Home server
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4qu/tmKfeTtFDFimpcKH+1HRiiug7eNzNvORoH1ngh lobo@nas2
-
-# Corp workspaces
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqdB5I6TIaXo0vMTjQ59SA4OL9TWWVXt+afbKRgU2u3 lobo@DESKTOP-VT5VL1V
-
-# Phone
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPb49syadEvvwlBpRs6DaZxJGV1HgOC/bYZR1WIYvNus u0_a276@localhost

config

@@ -1,3 +0,0 @@
-[default]
-region = us-west-2
-output = json

makeitso

@@ -5,9 +5,12 @@ if [ $# -ne 1 ]; then
   exit 1
 fi
 
-#sudo adduser --disabled-login --gecos 'User for AuthorizedKeysCommand' authorizedkeysuser ||
-sudo useradd -c 'User for AuthorizedKeysCommand' -d /home/authorizedkeysuser -m -s/usr/sbin/nologin authorizedkeysuser
+if [ ! -d /home/authorizedkeysuser ]; then
+  #sudo adduser --disabled-login --gecos 'User for AuthorizedKeysCommand' authorizedkeysuser ||
+  sudo useradd -c 'User for AuthorizedKeysCommand' -d /home/authorizedkeysuser -m -s/usr/sbin/nologin authorizedkeysuser
+fi
 
+grep -qF 'AuthorizedKeysCommand /etc/ssh/get_authorized_keys' /etc/ssh/sshd_config || \
 sudo sh -c "echo 'Match User $1
   AuthorizedKeysCommand /etc/ssh/get_authorized_keys
   AuthorizedKeysCommandUser authorizedkeysuser' >> /etc/ssh/sshd_config"
@@ -16,9 +19,4 @@ sudo cp get_authorized_keys /etc/ssh
 
 sudo chmod 755 /etc/ssh/get_authorized_keys
 
-sudo -u authorizedkeysuser mkdir ~authorizedkeysuser/.aws
-sudo -u authorizedkeysuser cp config ~authorizedkeysuser/.aws
-sudo -u authorizedkeysuser cp .credentials ~authorizedkeysuser/.aws/credentials
-sudo -u authorizedkeysuser chmod 600 ~authorizedkeysuser/.aws/*
-sudo -H -u authorizedkeysuser sh -c 'command -v aws > /dev/null 2>&1 || pip install --user awscli'
 sudo systemctl restart sshd

trigger/authorized_keys.py

@@ -1,74 +0,0 @@
-import json
-import boto3
-
-ddb = boto3.client('dynamodb')
-codecommit = boto3.client('codecommit')
-targetarn = 'arn:aws:codecommit:us-west-2:932028523435:authorized_keys'
-
-
-def lambda_handler(event, context):
-    # {
-    #   "Records": [
-    #     {
-    #       "awsRegion": "us-west-2",
-    #       "codecommit": {
-    #         "references": [
-    #           {
-    #             "commit": "5c4ef1049f1d27deadbeeff313e0730018be182b",
-    #             "ref": "refs/heads/master"
-    #           }
-    #         ]
-    #       },
-    #       "customData": "this is custom data",
-    #       "eventId": "5a824061-17ca-46a9-bbf9-114edeadbeef",
-    #       "eventName": "TriggerEventTest",
-    #       "eventPartNumber": 1,
-    #       "eventSource": "aws:codecommit",
-    #       "eventSourceARN": "arn:aws:codecommit:us-west-2:123456789012:repo",
-    #       "eventTime": "2016-01-01T23:59:59.000+0000",
-    #       "eventTotalParts": 1,
-    #       "eventTriggerConfigId": "5a824061-17ca-46a9-bbf9-114edeadbeef",
-    #       "eventTriggerName": "my-trigger",
-    #       "eventVersion": "1.0",
-    #       "userIdentityARN": "arn:aws:iam::123456789012:root"
-    #     }
-    #   ]
-    # }
-    print(json.dumps(event))
-    records = event["Records"]
-    if records is None or len(records) == 0:
-        raise RuntimeError('No records property in event')
-    print(records)
-    for record in records:
-        repoArn = record['eventSourceARN']
-        if repoArn is None:
-            print('no eventSourceARN on record')
-            continue
-        print('Record from ARN' + repoArn)
-        if repoArn != targetarn:
-            print('Not target ARN. Continuting')
-            continue
-        resp = codecommit.get_file(repositoryName='authorized_keys',
-                                   filePath='authorized_keys')
-        data = resp['fileContent'].decode("utf-8")
-        ddbitem = ddb.scan(TableName='key')  # ddbitem['Items']...
-        found = False
-        for item in ddbitem['Items']:  # should be only one anyway - whatever
-            if item['key']['S'] == data:
-                found = True
-                break
-        if found:
-            print('no change to keys. continuing')
-            continue
-        # Something's changed - let's make the update in DDB
-        ddb.put_item(TableName='key', Item={'key': {'S': data}})
-        for item in ddbitem['Items']:  # should be only one anyway - whatever
-            print('deleting old item')
-            ddb.delete_item(TableName='key', Key=item)
-
-    print('All records processed')
-
-    return {
-        'statusCode': 200,
-        'body': json.dumps('Processing complete')
-    }