2 # This should be sourced by bash (though we welcome changes to make it POSIX sh compliant)
4 # Monkeysphere authentication update-users subcommand
6 # The monkeysphere scripts are written by:
7 # Jameson Rollins <jrollins@finestructure.net>
8 # Jamie McClelland <jm@mayfirst.org>
9 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
11 # They are Copyright 2008-2009, and are all released under the GPL,
19 local authorizedKeysDir
20 local authorizedUserIDs
23 # get users from command line
26 # or just look at all users if none specified
27 unames=$(getent passwd | cut -d: -f1)
31 MODE="authorized_keys"
34 GNUPGHOME="$GNUPGHOME_SPHERE"
36 # the authorized_keys directory
37 authorizedKeysDir="${SYSDATADIR}/authorized_keys"
39 # check to see if the gpg trust database has been initialized
40 if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
41 failure "GNUPG trust database uninitialized. Please see MONKEYSPHERE-SERVER(8)."
44 # make sure the authorized_keys directory exists
45 mkdir -p "${authorizedKeysDir}"
48 for uname in $unames ; do
49 # check all specified users exist
50 if ! id "$uname" >/dev/null ; then
51 log error "----- unknown user '$uname' -----"
55 log verbose "----- user: $uname -----"
57 # make temporary directory
58 TMPLOC=$(mktemp -d ${MATMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
60 # trap to delete temporary directory on exit
61 trap "rm -rf $TMPLOC" EXIT
63 # create temporary authorized_user_ids file
64 TMP_AUTHORIZED_USER_IDS="${TMPLOC}/authorized_user_ids"
65 touch "$TMP_AUTHORIZED_USER_IDS"
67 # create temporary authorized_keys file
68 AUTHORIZED_KEYS="${TMPLOC}/authorized_keys"
69 touch "$AUTHORIZED_KEYS"
71 # set restrictive permissions on the temporary files
72 # FIXME: is there a better way to do this?
74 chmod 0600 "$AUTHORIZED_KEYS"
75 chmod 0600 "$TMP_AUTHORIZED_USER_IDS"
76 chown -R "$MONKEYSPHERE_USER" "$TMPLOC"
78 # process authorized_user_ids file
79 log debug "checking for authorized_user_ids..."
80 # translating ssh-style path variables
81 authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
82 if [ -s "$authorizedUserIDs" ] ; then
83 log debug "authorized_user_ids file found."
84 # check permissions on the authorized_user_ids file path
85 if check_key_file_permissions "$uname" "$authorizedUserIDs" ; then
86 # copy user authorized_user_ids file to temporary
88 cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
90 # export needed variables
92 export AUTHORIZED_KEYS
93 export TMP_AUTHORIZED_USER_IDS
95 # process authorized_user_ids file, as monkeysphere user
96 su_monkeysphere_user \
97 ". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS" \
100 log debug "not processing authorized_user_ids."
103 log debug "empty or absent authorized_user_ids file."
106 # add user-controlled authorized_keys file if specified translate
107 # ssh-style path variables
108 rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
109 if [ "$rawAuthorizedKeys" != 'none' ] ; then
110 log debug "checking for raw authorized_keys..."
111 if [ -s "$rawAuthorizedKeys" ] ; then
112 # check permissions on the authorized_keys file path
113 if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then
114 log verbose "adding raw authorized_keys file... "
115 cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
117 log debug "not adding raw authorized_keys file."
120 log debug "empty or absent authorized_keys file."
124 # move the new authorized_keys file into place
125 if [ -s "$AUTHORIZED_KEYS" ] ; then
126 # openssh appears to check the contents of the authorized_keys
127 # file as the user in question, so the file must be readable
128 # by that user at least.
130 # but in general, we don't want the user tampering with this
131 # file directly, so we'll adopt this approach: Own the file by
132 # the monkeysphere-server invoker (usually root, but should be
133 # the same uid that sshd is launched as); change the group of
134 # the file so that members of the user's group can read it.
136 # FIXME: is there a better way to do this?
137 chown $(whoami) "$AUTHORIZED_KEYS" && \
138 chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \
139 chmod g+r "$AUTHORIZED_KEYS" && \
140 mv -f "$AUTHORIZED_KEYS" "${authorizedKeysDir}/${uname}" || \
142 log error "Failed to install authorized_keys for '$uname'!"
143 rm -f "${authorizedKeysDir}/${uname}"
144 # indicate that there has been a failure:
148 rm -f "${authorizedKeysDir}/${uname}"
154 # destroy temporary directory