3 # monkeysphere: Monkeysphere client tool
5 # The monkeysphere scripts are written by:
6 # Jameson Rollins <jrollins@fifthhorseman.net>
7 # Jamie McClelland <jm@mayfirst.org>
8 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
9 # Micah Anderson <micah@riseup.net>
11 # They are Copyright 2008-2009, and are all released under the GPL, version 3
14 ########################################################################
19 SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
21 . "${SYSSHAREDIR}/common" || exit 1
23 # sharedir for host functions
24 MSHAREDIR="${SYSSHAREDIR}/m"
26 # UTC date in ISO 8601 format if needed
27 DATE=$(date -u '+%FT%T')
29 # unset some environment variables that could screw things up
32 # set the file creation mask to be only owner rw
35 ########################################################################
37 ########################################################################
41 usage: $PGRM <subcommand> [options] [args]
42 Monkeysphere client tool.
45 update-known_hosts (k) [HOST]... update known_hosts file
46 update-authorized_keys (a) update authorized_keys file
47 gen-subkey (g) [KEYID] generate an authentication subkey
48 --length (-l) BITS key length in bits (2048)
49 ssh-proxycommand monkeysphere ssh ProxyCommand
50 subkey-to-ssh-agent (s) store authentication subkey in ssh-agent
51 version (v) show version number
57 # user gpg command to define common options
59 gpg --no-greeting --quiet --no-tty "$@"
62 # take a secret key ID and check that only zero or one ID is provided,
63 # and that it corresponds to only a single secret key ID
64 check_gpg_sec_key_id() {
69 gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons 2>/dev/null | egrep '^sec:')
72 gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons "$keyID" | egrep '^sec:') || failure
75 failure "You must specify only a single primary key ID."
79 # check that only a single secret key was found
80 case $(echo "$gpgSecOut" | grep -c '^sec:') in
82 failure "No secret keys found. Create an OpenPGP key with the following command:
86 echo "$gpgSecOut" | cut -d: -f5
89 echo "Multiple primary secret keys found:"
90 for key in $(echo "$gpgSecOut" | cut -d: -f5) ; do
93 echo "Please specify which primary key to use."
99 # check that a valid authentication subkey does not already exist
100 check_gpg_authentication_subkey() {
110 # check that a valid authentication key does not already exist
112 for line in $(gpg_user --fixed-list-mode --list-keys --with-colons "$keyID") ; do
113 type=$(echo "$line" | cut -d: -f1)
114 validity=$(echo "$line" | cut -d: -f2)
115 usage=$(echo "$line" | cut -d: -f12)
118 if [ "$type" != 'pub' -a "$type" != 'sub' ] ; then
121 # check for authentication capability
122 if ! check_capability "$usage" 'a' ; then
125 # if authentication key is valid, prompt to continue
126 if [ "$validity" = 'u' ] ; then
127 echo "A valid authentication key already exists for primary key '$keyID'."
128 if [ "$PROMPT" = "true" ] ; then
129 read -p "Are you sure you would like to generate another one? (y/N) " OK; OK=${OK:N}
130 if [ "${OK/y/Y}" != 'Y' ] ; then
141 ########################################################################
143 ########################################################################
145 # set unset default variables
146 GNUPGHOME=${GNUPGHOME:="${HOME}/.gnupg"}
147 KNOWN_HOSTS="${HOME}/.ssh/known_hosts"
148 HASH_KNOWN_HOSTS="true"
149 AUTHORIZED_KEYS="${HOME}/.ssh/authorized_keys"
151 # unset the check keyserver variable, since that needs to have
152 # different defaults for the different functions
153 unset CHECK_KEYSERVER
156 [ -r "${SYSCONFIGDIR}/monkeysphere.conf" ] \
157 && . "${SYSCONFIGDIR}/monkeysphere.conf"
159 # set monkeysphere home directory
160 MONKEYSPHERE_HOME=${MONKEYSPHERE_HOME:="${HOME}/.monkeysphere"}
161 mkdir -p -m 0700 "$MONKEYSPHERE_HOME"
164 [ -e ${MONKEYSPHERE_CONFIG:="${MONKEYSPHERE_HOME}/monkeysphere.conf"} ] \
165 && . "$MONKEYSPHERE_CONFIG"
167 # set empty config variables with ones from the environment
168 GNUPGHOME=${MONKEYSPHERE_GNUPGHOME:=$GNUPGHOME}
169 LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=$LOG_LEVEL}
170 KEYSERVER=${MONKEYSPHERE_KEYSERVER:=$KEYSERVER}
171 # if keyserver not specified in env or conf, then look in gpg.conf
172 if [ -z "$KEYSERVER" ] ; then
173 if [ -f "${GNUPGHOME}/gpg.conf" ] ; then
174 KEYSERVER=$(grep -e "^[[:space:]]*keyserver " "${GNUPGHOME}/gpg.conf" | tail -1 | awk '{ print $2 }')
177 PROMPT=${MONKEYSPHERE_PROMPT:=$PROMPT}
178 KNOWN_HOSTS=${MONKEYSPHERE_KNOWN_HOSTS:=$KNOWN_HOSTS}
179 HASH_KNOWN_HOSTS=${MONKEYSPHERE_HASH_KNOWN_HOSTS:=$HASH_KNOWN_HOSTS}
180 AUTHORIZED_KEYS=${MONKEYSPHERE_AUTHORIZED_KEYS:=$AUTHORIZED_KEYS}
182 # other variables not in config file
183 AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:="${MONKEYSPHERE_HOME}/authorized_user_ids"}
184 REQUIRED_HOST_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_HOST_KEY_CAPABILITY:="a"}
185 REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
187 # export GNUPGHOME and make sure gpg home exists with proper
190 mkdir -p -m 0700 "$GNUPGHOME"
195 [ "$COMMAND" ] || failure "Type '$PGRM help' for usage."
199 'update-known_hosts'|'update-known-hosts'|'k')
200 # whether or not to check keyservers
201 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
203 # if hosts are specified on the command line, process just
206 update_known_hosts "$@"
208 # otherwise, if no hosts are specified, process every host
209 # in the user's known_hosts file
215 'update-authorized_keys'|'update-authorized-keys'|'a')
216 # whether or not to check keyservers
217 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
219 # process authorized_user_ids file
220 process_authorized_user_ids "$AUTHORIZED_USER_IDS"
224 source "${MSHAREDIR}/import_subkey"
229 source "${MSHAREDIR}/gen_subkey"
233 'ssh-proxycommand'|'p')
234 source "${MSHAREDIR}/ssh_proxycommand"
235 ssh_proxycommand "$@"
238 'subkey-to-ssh-agent'|'s')
239 source "${MSHAREDIR}/subkey_to_ssh_agent"
240 subkey_to_ssh_agent "$@"
247 '--help'|'help'|'-h'|'h'|'?')
252 failure "Unknown command: '$COMMAND'
253 Type '$PGRM help' for usage."