sliftutils 1.7.125 → 1.7.127

package/security/authorizedKeys/daemon/revocation.ts

@@ -0,0 +1,329 @@
+import fs from "fs/promises";
+import path from "path";
+import { keyFingerprint, summarizeKey } from "../authorizedKeys";
+import { deriveRevokeKey, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
+import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { cloneRepo, repoIsUsable, runGit } from "./git";
+import { messageTimestamp } from "../../notifications/discord";
+import { UNREVOKE_DELAY } from "./paths";
+import { notify } from "./notify";
+import { addChangeReason } from "./changes";
+import { describeAllEnded, endAllSSHSessions } from "./sessions";
+import { getState, saveState } from "./state";
+
+// One revocation per key, ever. Naming the file after the fingerprint is what makes that true:
+// a second attempt from a different address lands on a name that already exists.
+const REVOCATIONS_DIR = "revocations";
+const UNREVOKES_DIR = "unrevoked";
+
+export type Attempt = {
+    ip: string;
+    user: string;
+    port: string;
+    required: string;
+    line: string;
+};
+
+export function revocationIdOf(fingerprint: string) {
+    return fingerprint.replace(/^SHA256:/, "").replace(/[^A-Za-z0-9]+/g, "-");
+}
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+/** The revoke repo's key is worked out from the source's, so nothing extra had to be uploaded and
+    nothing extra is stored anywhere it could be taken from. */
+async function ensureRevokeKey(sourceURL: string) {
+    let keyPath = revokeKeyPath(sourceURL);
+    if (await pathExists(keyPath)) {
+        return keyPath;
+    }
+    let derived = deriveRevokeKey(await fs.readFile(sourceKeyPath(sourceURL), "utf8"));
+    await fs.mkdir(path.dirname(keyPath), { recursive: true, mode: 0o700 });
+    await fs.writeFile(keyPath, derived.privateKeyFile, { mode: 0o600 });
+    console.log(`Derived the revoke key for ${sourceURL}`);
+    return keyPath;
+}
+
+/** Brings the revoke checkout up to date. Returns false when it cannot be reached, so a missing
+    revoke repo degrades to "keep what we already know" rather than stopping everything. */
+export async function syncRevokeRepo(sourceURL: string) {
+    let repoURL = revokeRepoURL(sourceURL);
+    let repoPath = revokeRepoPath(sourceURL);
+    let keyPath = await ensureRevokeKey(sourceURL);
+    try {
+        if (!await repoIsUsable({ repoPath, keyPath })) {
+            await cloneRepo({ repoURL, repoPath, keyPath });
+            return true;
+        }
+        let localHead = await runGit({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath, allowFailure: true });
+        if (localHead.status !== 0) {
+            // A revoke repo with no commits yet. Nothing has ever been revoked, which is the state
+            // every one of these starts in, so there is nothing to pull and nothing to say.
+            return true;
+        }
+        let head = (await runGit({ args: ["rev-parse", "--abbrev-ref", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
+        let localSha = localHead.stdout.trim();
+        // A ref listing is a few hundred bytes and no objects, so the usual case of nothing having
+        // been revoked anywhere costs almost nothing.
+        let listing = (await runGit({ args: ["ls-remote", "origin", head], cwd: repoPath, keyPath })).stdout;
+        let remoteSha = (listing.split(/\s+/)[0] || "").trim();
+        if (remoteSha && remoteSha === localSha) {
+            return true;
+        }
+        await runGit({ args: ["fetch", "--prune", "origin"], cwd: repoPath, keyPath });
+        await runGit({ args: ["reset", "--hard", `origin/${head}`], cwd: repoPath, keyPath });
+        await runGit({ args: ["clean", "-fdx"], cwd: repoPath, keyPath });
+        return true;
+    } catch (e) {
+        console.log(`Could not sync ${repoURL}. ${e}`);
+        return false;
+    }
+}
+
+export async function readRevocationFiles(sourceURL: string) {
+    let directory = path.join(revokeRepoPath(sourceURL), REVOCATIONS_DIR);
+    if (!await pathExists(directory)) {
+        return [];
+    }
+    let revocations: { fingerprint: string; revocationId: string }[] = [];
+    for (let name of (await fs.readdir(directory)).sort()) {
+        if (!name.endsWith(".json")) {
+            continue;
+        }
+        try {
+            let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            if (parsed.fingerprint) {
+                revocations.push({ fingerprint: parsed.fingerprint, revocationId: parsed.revocationId || name.replace(/\.json$/, "") });
+            }
+        } catch (e) {
+            console.log(`Ignoring unreadable revocation ${name}. ${e}`);
+        }
+    }
+    return revocations;
+}
+
+/** Unrevokes live in the source repo, so they are covered by its signature. */
+export async function readUnrevokeIds(sourceURL: string) {
+    let directory = path.join(sourceRepoPath(sourceURL), UNREVOKES_DIR);
+    if (!await pathExists(directory)) {
+        return new Map<string, string>();
+    }
+    let ids = new Map<string, string>();
+    for (let name of (await fs.readdir(directory)).sort()) {
+        if (!name.endsWith(".json")) {
+            continue;
+        }
+        try {
+            let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            for (let revocationId of parsed.revocationIds || []) {
+                ids.set(revocationId, name.replace(/\.json$/, ""));
+            }
+        } catch (e) {
+            console.log(`Ignoring unreadable unrevoke ${name}. ${e}`);
+        }
+    }
+    return ids;
+}
+
+/** Writes a revocation, unless this key is already revoked. Checked twice: against what this
+    machine already knows, which needs no network, and again against the repo after pulling it,
+    so a flood of unknown keys cannot turn into a flood of commits. */
+export async function recordRevocation(config: {
+    sourceURL: string;
+    fingerprint: string;
+    keyLine: string;
+    attempt: Attempt;
+    hostLabel: string;
+}) {
+    let { sourceURL, fingerprint, keyLine, attempt, hostLabel } = config;
+    let state = getState();
+    if (state.revocations[fingerprint]) {
+        return false;
+    }
+    if (!await syncRevokeRepo(sourceURL)) {
+        console.log(`Cannot record the revocation of ${fingerprint}, ${revokeRepoURL(sourceURL)} is unreachable`);
+        return false;
+    }
+    let revocationId = revocationIdOf(fingerprint);
+    let alreadyThere = (await readRevocationFiles(sourceURL)).some(entry => entry.fingerprint === fingerprint);
+    if (alreadyThere) {
+        // Another machine got there first, which is the normal outcome when several see the same
+        // attempt. Record it locally so we never look again.
+        state.revocations[fingerprint] = {
+            fingerprint, revocationId, unrevokeSeenAt: 0, unrevokeId: "", unrevoked: false,
+            reportedRemoved: false,
+        };
+        await saveState();
+        return false;
+    }
+
+    let repoPath = revokeRepoPath(sourceURL);
+    let keyPath = revokeKeyPath(sourceURL);
+    let directory = path.join(repoPath, REVOCATIONS_DIR);
+    await fs.mkdir(directory, { recursive: true });
+    await fs.writeFile(path.join(directory, `${revocationId}.json`), JSON.stringify({
+        revocationId,
+        fingerprint,
+        key: keyLine,
+        revokedAt: new Date().toISOString(),
+        revokedBy: hostLabel,
+        reason: "used from an address its from= restriction does not allow",
+        attempt,
+    }, undefined, 4) + "\n");
+
+    await runGit({ args: ["add", "-A"], cwd: repoPath, keyPath });
+    await runGit({ args: ["-c", "user.email=portsecure@localhost", "-c", "user.name=portsecure", "commit", "-m", `revoke ${revocationId}`], cwd: repoPath, keyPath });
+    let push = await runGit({ args: ["push", "origin", "HEAD"], cwd: repoPath, keyPath, allowFailure: true });
+    if (push.status !== 0) {
+        // Most likely another machine pushed the same revocation first. The next check will pull
+        // it and record it, so there is nothing to retry here.
+        console.log(`Could not push the revocation of ${fingerprint}, will pick it up on the next check. ${(push.stdout + push.stderr).trim()}`);
+        return false;
+    }
+    state.revocations[fingerprint] = {
+        fingerprint, revocationId, unrevokeSeenAt: 0, unrevokeId: "", unrevoked: false,
+        // The message below already says this machine has stopped accepting the key, so the one
+        // about noticing a revocation would only repeat it.
+        reportedRemoved: true,
+    };
+    await saveState();
+    let ended = describeAllEnded(await endAllSSHSessions());
+    // Said when the file is written, not here, so one event produces one message.
+    addChangeReason(
+        `**AUTHENTICATED ACCESS FROM AN UNAPPROVED IP: \`${attempt.ip}\`** The key was correct, so`
+        + ` either someone else has this key, or a developer's IP has changed.`
+        + `\nkey \`${keyLine && summarizeKey(keyLine) || fingerprint}\` (\`${fingerprint}\`)`
+        + `\ntried as user \`${attempt.user}\`, and is only allowed from \`${attempt.required}\``
+        + `\nThat key is now revoked everywhere.${ended}`
+        + `\nIf this really was an attack, IMMEDIATELY remove that key from \`${sourceURL}\`.`
+        + `\nIf it was legitimate use, run this in \`${sourceURL}\`: \`yarn unrevoke git\``
+    );
+    return true;
+}
+
+/** Takes everything the revoke repos list into local state. Once here a revocation never leaves,
+    even if the file is deleted: the key that writes revocations is on every server, so an attacker
+    holding it could otherwise erase the record that locked them out. */
+export async function absorbRevocations(sourceURLs: string[]) {
+    let state = getState();
+    let changed = false;
+    for (let sourceURL of sourceURLs) {
+        for (let entry of await readRevocationFiles(sourceURL)) {
+            if (state.revocations[entry.fingerprint]) {
+                continue;
+            }
+            state.revocations[entry.fingerprint] = {
+                fingerprint: entry.fingerprint,
+                revocationId: entry.revocationId,
+                unrevokeSeenAt: 0,
+                unrevokeId: "",
+                unrevoked: false,
+                reportedRemoved: false,
+            };
+            changed = true;
+        }
+    }
+    if (changed) {
+        await saveState();
+    }
+}
+
+/** An unrevoke is held for an hour before it counts, so a signing key that was itself compromised
+    cannot instantly undo the revocation that shut it out. */
+export async function applyUnrevokes(sourceURLs: string[]) {
+    let state = getState();
+    let unrevokeIds = new Map<string, string>();
+    for (let sourceURL of sourceURLs) {
+        for (let [revocationId, unrevokeId] of await readUnrevokeIds(sourceURL)) {
+            unrevokeIds.set(revocationId, unrevokeId);
+        }
+    }
+    for (let revocation of Object.values(state.revocations)) {
+        if (revocation.unrevoked) {
+            continue;
+        }
+        let unrevokeId = unrevokeIds.get(revocation.revocationId);
+        if (!unrevokeId) {
+            continue;
+        }
+        if (!revocation.unrevokeSeenAt) {
+            revocation.unrevokeSeenAt = Date.now();
+            revocation.unrevokeId = unrevokeId;
+            await saveState();
+            // Nothing has changed yet, so nobody is told. Whoever published it was already told it
+            // takes an hour, and every machine seeing the same unrevoke would say so separately.
+            console.log(
+                `Holding the unrevoke ${unrevokeId} for ${revocation.fingerprint} until`
+                + ` ${messageTimestamp(new Date(revocation.unrevokeSeenAt + UNREVOKE_DELAY))}`
+            );
+            continue;
+        }
+        if (Date.now() - revocation.unrevokeSeenAt < UNREVOKE_DELAY) {
+            continue;
+        }
+        revocation.unrevoked = true;
+        revocation.reportedRemoved = false;
+        await saveState();
+        // Only means anything if the key comes back into the file, so it is said there.
+        addChangeReason(`the unrevoke of \`${revocation.fingerprint}\` has taken effect, ${unrevokeId}.`);
+    }
+}
+
+export function revokedFingerprints() {
+    return new Set(
+        Object.values(getState().revocations)
+            .filter(revocation => !revocation.unrevoked)
+            .map(revocation => revocation.fingerprint)
+    );
+}
+
+/** Drops revoked keys from the merged set, and says so the first time a key actually disappears -
+    which is the thing worth knowing, rather than the mere existence of a revocation. */
+export async function removeRevokedKeys(keys: string[]) {
+    let revoked = revokedFingerprints();
+    if (!revoked.size) {
+        return keys;
+    }
+    let state = getState();
+    let allowed: string[] = [];
+    let dropped: string[] = [];
+    for (let key of keys) {
+        let fingerprint = keyFingerprint(key);
+        if (!fingerprint || !revoked.has(fingerprint)) {
+            allowed.push(key);
+            continue;
+        }
+        dropped.push(fingerprint);
+        let revocation = state.revocations[fingerprint];
+        if (!revocation || revocation.reportedRemoved) {
+            continue;
+        }
+        revocation.reportedRemoved = true;
+        await saveState();
+        // Nothing to do if the key is not in the file. It left long ago, and this is a machine that
+        // restarted and read the revocation back out of the repo.
+        if (!state.appliedKeys.includes(key)) {
+            continue;
+        }
+        // Whatever that key is holding open goes with it.
+        let ended = describeAllEnded(await endAllSSHSessions());
+        addChangeReason(`a revocation for \`${fingerprint}\` was published elsewhere.${ended}`);
+    }
+    // Said on every check, not once. A key being held out of authorized_keys is the current state
+    // of the machine, and someone reading the log to work out why a key does not work should find
+    // the answer there rather than having to know what to search the history for.
+    if (dropped.length) {
+        console.log(
+            `Dropped ${dropped.length} revoked key(s) from the merged set, ${allowed.length} left.`
+            + ` Revoked: ${dropped.join(", ")}`
+        );
+    }
+    return allowed;
+}

package/security/authorizedKeys/daemon/rootKeys.ts

@@ -0,0 +1,198 @@
+import fs from "fs/promises";
+import path from "path";
+import { keyFingerprint, keyRestriction, keyRestrictionList, NO_RESTRICTION, summarizeKey } from "../authorizedKeys";
+import { KEYS_HISTORY_PATH, ROOT_AUTHORIZED_KEYS } from "./paths";
+import { notify } from "./notify";
+import { getState, saveState } from "./state";
+import { takeChangeReasons } from "./changes";
+
+const KEY_FILE_HEADER = "# Managed by portsecure. Manual changes are reverted and reported.";
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+/** Keys are matched by the key itself, not by the text of the line, so changing which addresses a
+    key may be used from reads as that one key changing rather than as one key leaving and another
+    arriving. A line we cannot read a key out of falls back to the whole line. */
+function keyIdentity(keyLine: string) {
+    return keyFingerprint(keyLine) || keyLine;
+}
+
+/** Which addresses a key gained or lost, rather than two long lists to compare by eye. Returns ""
+    when the addresses did not change at all. Losing the from= altogether is the loudest case there
+    is, so it is spelled out rather than shown as a list of removals. */
+function describeAddressChange(config: { previousLine: string; currentLine: string }) {
+    let { previousLine, currentLine } = config;
+    let previous = keyRestrictionList(previousLine);
+    let current = keyRestrictionList(currentLine);
+    if (!previous && !current) {
+        return "";
+    }
+    if (previous && !current) {
+        return `          was ${previous.join(",")}\n          now ${NO_RESTRICTION}`;
+    }
+    if (!previous && current) {
+        return `          was ${NO_RESTRICTION}\n          now restricted to ${current.join(",")}`;
+    }
+    let removed = (previous || []).filter(address => !(current || []).includes(address));
+    let added = (current || []).filter(address => !(previous || []).includes(address));
+    if (!removed.length && !added.length) {
+        return "";
+    }
+    let lines = [
+        ...removed.map(address => `          no longer allowed from ${address}`),
+        ...added.map(address => `          now also allowed from ${address}`),
+    ];
+    lines.push(`          still allowed from ${(current || []).filter(address => !added.includes(address)).join(",") || "nothing"}`);
+    return lines.join("\n");
+}
+
+export function describeKeyDifference(config: { before: string[]; after: string[] }) {
+    let { before, after } = config;
+    let beforeByKey = new Map(before.map(key => [keyIdentity(key), key]));
+    let afterByKey = new Map(after.map(key => [keyIdentity(key), key]));
+
+    let lines: string[] = [];
+    for (let [identity, keyLine] of afterByKey) {
+        if (!beforeByKey.has(identity)) {
+            lines.push(`+ added   ${summarizeKey(keyLine)}\n          from ${keyRestriction(keyLine)}`);
+        }
+    }
+    for (let [identity, keyLine] of beforeByKey) {
+        if (!afterByKey.has(identity)) {
+            lines.push(`- removed ${summarizeKey(keyLine)}\n          from ${keyRestriction(keyLine)}`);
+        }
+    }
+    for (let [identity, previousLine] of beforeByKey) {
+        let currentLine = afterByKey.get(identity);
+        if (!currentLine || currentLine === previousLine) {
+            continue;
+        }
+        let addressChange = describeAddressChange({ previousLine, currentLine });
+        if (addressChange) {
+            lines.push(`~ changed ${summarizeKey(currentLine)}\n${addressChange}`);
+            continue;
+        }
+        lines.push(
+            `~ changed ${summarizeKey(currentLine)}\n          from ${keyRestriction(currentLine)}\n`
+            + `          its options or comment changed`
+        );
+    }
+    if (!lines.length) {
+        return "(no keys differ)";
+    }
+    return lines.join("\n");
+}
+
+export async function readAuthorizedKeysFile(filePath: string) {
+    if (!await pathExists(filePath)) {
+        return [];
+    }
+    let contents = await fs.readFile(filePath, "utf8");
+    return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+}
+
+export async function writeAuthorizedKeysFile(config: { filePath: string; keys: string[] }) {
+    let { filePath, keys } = config;
+    let directory = path.dirname(filePath);
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    await fs.chmod(directory, 0o700);
+    // Written to a temporary file first, so an interrupted write can never leave root with a
+    // truncated authorized_keys and no way back in.
+    let temporaryPath = `${filePath}.portsecure-tmp`;
+    await fs.writeFile(temporaryPath, `${KEY_FILE_HEADER}\n${keys.join("\n")}\n`, { mode: 0o600 });
+    await fs.rename(temporaryPath, filePath);
+}
+
+/** Keeps a copy of whatever is about to be overwritten, named for the moment it was replaced.
+    Recovers a key that was clobbered by mistake, and doubles as the history of who had access.
+    The very first archive is the most valuable one, since it holds the keys from before portsecure
+    took the file over. */
+export async function archiveAuthorizedKeys(config: { filePath: string; reason: string }) {
+    let { filePath, reason } = config;
+    if (!await pathExists(filePath)) {
+        return "";
+    }
+    let contents = await fs.readFile(filePath, "utf8");
+    await fs.mkdir(KEYS_HISTORY_PATH, { recursive: true, mode: 0o700 });
+    await fs.chmod(KEYS_HISTORY_PATH, 0o700);
+    let stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    let archivePath = path.join(KEYS_HISTORY_PATH, `${stamp}-${reason}.authorized_keys`);
+    let attempt = 1;
+    while (await pathExists(archivePath)) {
+        attempt++;
+        archivePath = path.join(KEYS_HISTORY_PATH, `${stamp}-${reason}-${attempt}.authorized_keys`);
+    }
+    await fs.writeFile(archivePath, contents, { mode: 0o600 });
+    return archivePath;
+}
+
+function sameKeys(one: string[], two: string[]) {
+    return one.length === two.length && one.every((key, index) => key === two[index]);
+}
+
+/** Puts the allowed keys in place, and says which of the two things happened.
+
+    Whether this was our own doing is decided by comparing what we want against what we last wrote,
+    not by guessing from whether a repo happened to change. A revocation changes what we want
+    without any repo changing, and reading that as somebody having edited the file was both wrong
+    and alarming. */
+export async function enforceRootKeys(keys: string[]) {
+    // An empty set is written out like any other. If every key is revoked then nobody should be
+    // getting in, and the way back is to put a key in the repo, which is already being watched.
+    if (!keys.length) {
+        console.log(`No keys are allowed, so ${ROOT_AUTHORIZED_KEYS} is being emptied`);
+    }
+    let state = getState();
+    let currentKeys = await readAuthorizedKeysFile(ROOT_AUTHORIZED_KEYS);
+    if (!state.appliedKeys.length) {
+        // Nothing recorded yet, on a first start or an upgrade. Whatever is in the file is taken as
+        // ours, so the first check reports what actually changes rather than reintroducing every
+        // key that was already there.
+        state.appliedKeys = currentKeys;
+        await saveState();
+    }
+
+    if (sameKeys(currentKeys, keys)) {
+        // Nothing came of whatever was decided this pass, so none of it is reported.
+        takeChangeReasons();
+        if (!sameKeys(state.appliedKeys, keys)) {
+            state.appliedKeys = keys;
+            await saveState();
+        }
+        return;
+    }
+
+    let weChangedIt = !sameKeys(state.appliedKeys, keys);
+    let previouslyApplied = state.appliedKeys;
+    // Still archived, it is just not worth a line in the message. Whoever needs the old file knows
+    // where the history is.
+    await archiveAuthorizedKeys({
+        filePath: ROOT_AUTHORIZED_KEYS,
+        reason: weChangedIt && "update" || "reverted",
+    });
+    await writeAuthorizedKeysFile({ filePath: ROOT_AUTHORIZED_KEYS, keys });
+    state.appliedKeys = keys;
+    await saveState();
+
+    let reasons = takeChangeReasons();
+    let why = reasons.length && `\n\n${reasons.join("\n\n")}` || "";
+    if (weChangedIt) {
+        await notify(
+            `applied authorized key changes:`
+            + `\n\`\`\`\n${describeKeyDifference({ before: previouslyApplied, after: keys })}\n\`\`\`${why}`
+        );
+        return;
+    }
+    await notify(
+        `root's authorized_keys was edited by something other than portsecure. The edit below has`
+        + ` been undone, and the keys from the repos are back in place.`
+        + `\n\`\`\`\n${describeKeyDifference({ before: keys, after: currentKeys })}\n\`\`\`${why}`
+    );
+}

package/security/authorizedKeys/daemon/sessions.ts

@@ -0,0 +1,139 @@
+import fs from "fs/promises";
+import { spawnPromise } from "../../helpers/spawn";
+import { AUTH_LOG_PATH } from "./paths";
+
+// Taking a key out of authorized_keys only stops the next login. Whoever is already connected with
+// it stays connected for as long as they like, which would make revoking a key that is being
+// actively misused close to pointless.
+//
+// sshd names the key it accepted and the process handling that connection on the same line, so the
+// sessions belonging to one key can be ended without touching anyone else's.
+const ACCEPTED = /(?:sshd|sshd-session)\[(\d+)\]:\s+Accepted publickey for (\S+) from (\S+) port (\d+) ssh2: \S+ (SHA256:[A-Za-z0-9+/=]+)/;
+
+export type KeySession = { processId: number; user: string; ip: string; port: string };
+
+export function parseAcceptedSessions(contents: string, fingerprint: string) {
+    let sessions: KeySession[] = [];
+    for (let line of contents.split("\n")) {
+        let match = line.match(ACCEPTED);
+        if (!match || match[5] !== fingerprint) {
+            continue;
+        }
+        sessions.push({ processId: Number(match[1]), user: match[2], ip: match[3], port: match[4] });
+    }
+    return sessions;
+}
+
+/** Process ids are reused, so one is only killed when it is still an ssh session. Killing whatever
+    happens to hold that number now would be far worse than missing a session. */
+async function isSSHSession(processId: number) {
+    try {
+        let name = await fs.readFile(`/proc/${processId}/comm`, "utf8");
+        return name.trim().startsWith("sshd");
+    } catch (e) {
+        return false;
+    }
+}
+
+/** The whole log, not only what is new, because the session being ended may have been established
+    long before the key was misused. */
+async function readWholeAuthLog() {
+    try {
+        return await fs.readFile(AUTH_LOG_PATH, "utf8");
+    } catch (e) {
+        let result = await spawnPromise({
+            command: "journalctl",
+            args: ["-u", "ssh", "-u", "sshd", "--no-pager", "--since", "-30days"],
+        });
+        return result.status === 0 && result.stdout || "";
+    }
+}
+
+/** Ends every live session that authenticated with this key. Returns what was ended, so the
+    revocation can say so rather than leaving it to be discovered. */
+export async function endSessionsUsingKey(fingerprint: string) {
+    let ended: KeySession[] = [];
+    for (let session of parseAcceptedSessions(await readWholeAuthLog(), fingerprint)) {
+        if (session.processId <= 1 || session.processId === process.pid) {
+            continue;
+        }
+        if (!await isSSHSession(session.processId)) {
+            continue;
+        }
+        try {
+            process.kill(session.processId, "SIGKILL");
+            ended.push(session);
+            console.log(`Ended ssh session ${session.processId} (${session.user} from ${session.ip}), it used ${fingerprint}`);
+        } catch (e) {
+            // Gone between looking and killing, which is the outcome we wanted anyway.
+        }
+    }
+    return ended;
+}
+
+/** Whether this process is one connection. The listener is not a connection - it is the process
+    that accepts them - so it is not a candidate here at all.
+
+    Every openssh since 9.8 runs each connection as its own sshd-session. On older ones connections
+    are named sshd too, and the listener is the one systemd started directly with -D. */
+async function isConnectionProcess(processId: number) {
+    let name: string;
+    try {
+        name = (await fs.readFile(`/proc/${processId}/comm`, "utf8")).trim();
+    } catch (e) {
+        return false;
+    }
+    if (name === "sshd-session") {
+        return true;
+    }
+    if (name !== "sshd") {
+        return false;
+    }
+    let commandLine = await fs.readFile(`/proc/${processId}/cmdline`, "utf8").catch(() => "");
+    let parentId = Number((await fs.readFile(`/proc/${processId}/stat`, "utf8").catch(() => "")).split(") ")[1]?.split(" ")[1] || 0);
+    return !commandLine.includes("-D") && parentId !== 1;
+}
+
+/** Disconnects every ssh session on the machine.
+
+    Not only the ones using the key that was just taken away: a session that predates the key being
+    removed is exactly as dangerous, and working out which sessions are still entitled to be here
+    is guesswork. Anyone who still has access can reconnect in a second, and anyone who does not
+    should not be here. */
+export async function endAllSSHSessions() {
+    let ended: number[] = [];
+    for (let entry of await fs.readdir("/proc")) {
+        let processId = Number(entry);
+        if (!processId || processId <= 1 || processId === process.pid) {
+            continue;
+        }
+        if (!await isConnectionProcess(processId)) {
+            continue;
+        }
+        try {
+            process.kill(processId, "SIGKILL");
+            ended.push(processId);
+        } catch (e) {
+            // Gone between looking and killing, which is the outcome we wanted anyway.
+        }
+    }
+    if (ended.length) {
+        console.log(`Disconnected ${ended.length} ssh session(s): ${ended.join(", ")}`);
+    }
+    return ended;
+}
+
+export function describeAllEnded(ended: number[]) {
+    if (!ended.length) {
+        return " Nothing was connected.";
+    }
+    return ` Every ssh session on this machine was disconnected, ${ended.length} of them.`;
+}
+
+export function describeEndedSessions(ended: KeySession[]) {
+    if (!ended.length) {
+        return " Nothing was connected with it.";
+    }
+    return ` ${ended.length} live session(s) using it were killed: `
+        + ended.map(session => `${session.user}@${session.ip}:${session.port}`).join(", ") + ".";
+}