Postgres recursive query for SSH authorized key paths - postgresql

Question

How do I structure a recursive query to help me find all server-to-server jumps that are accessible via SSH public key authorization?
For a given SSH pubkey fingerprint, first find the list of servers/accounts that the key is authorized for. For each server found, iterate over the private keys on that server, and find the list of servers/accounts that each of those are authorized for.
Repeat this process until there's a dead end, i.e. the authorized key path ends. Return a full authorized key path (as an array) per row.
Simplified example:
CREATE TABLE sshkeys (
server text, -- server UUID
username text, -- authorized username
privkey_owner text, -- owner of private key
fingerprint text, -- SSH key fingerprint
keytype text, -- "public" or "private"
)
Server Username Owner Fingerprint Keytype
banana root key_id_james public
banana james key_id_james public
banana root key_id_root#banana private
apple root key_id_root#banana public
apple fred fred key_id_fred private
mango fred key_id_fred public
James, using his key with ID key_id_james, has access to root#banana. From there, the root#banana private key is authorized for root#apple. On apple, root can access key_id_fred, and is thus authorized for fred#mango.
So ultimately, James has access to Fred's account on mango, via root access to banana and apple. He also has access to james#banana. The two output rows would consist of arrays of {source, keyid, target} elements, looking something like:
{{NULL, key_id_james, root#banana},
{banana, key_id_root#banana, root#apple},
{apple, key_id_fred, fred#mango}},
{{NULL, key_id_james, james#banana}}
I plan to add restrictions and heuristics that should be taken into account, including whether private keys are encrypted and whether a given user has group or chmod access to another user's private key (by joining to other tables in the database). That should be easy to tack onto a working base query, however.
As for the query, I'm unable to figure out how to do the secondary step, that is: For each server initially found to be accessible via the given key, iterate over all private keys on each server and recurse. I'm not getting further than this non-working query:
WITH RECURSIVE initial_authkeys AS (
SELECT
server, username, privkey_owner, fingerprint, keytype
FROM
sshkeys
WHERE
fingerprint = 'key_id_james' AND
keytype = 'public'
UNION ALL
SELECT
ak.server, ak.username, ak.privkey_owner, ak.fingerprint, ak.keytype
FROM
sshkeys,
initial_authkeys ak
WHERE
sshkeys.fingerprint = ak.fingerprint AND
sshkeys.keytype = 'private'
)
SELECT * FROM initial_authkeys;
Any suggestions?

Answer 1

What's needed to make this work is a subquery expression to find the SSH fingerprints of any available private key on the server where the given pubkey is authorized. Below is a working query that includes a rudimentary heuristic to only find private keys if the user has root access to the server. It could be expanded to verify private key file permissions, group ownership, etc.
WITH RECURSIVE authkeys(server, username, fingerprint, level, auth_path) AS (
SELECT
server, username, fingerprint, 1 AS level,
ARRAY['Authorized to '||username||
'#'||server||' using keyid='||fingerprint]
FROM
sshkeys
WHERE
fingerprint = 'key_id_james' AND keytype = 'public'
UNION
SELECT
k.server, k.username, k.fingerprint, ak.level+1 AS level,
auth_path || ARRAY['Authorized to '||k.username||
'#'||k.server||' using keyid='||k.fingerprint]
FROM
sshkeys k, authkeys ak
WHERE
k.keytype = 'public' AND k.fingerprint IN (
SELECT
fingerprint
FROM
sshkeys k2
WHERE
k2.server = ak.server AND k2.keytype = 'private' AND
ak.username = 'root'
)
) SELECT * FROM authkeys;