+# function to run command as monkeysphere user
+su_monkeysphere_user() {
+ # if the current user is the monkeysphere user, then just eval
+ # command
+ if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then
+ eval "$@"
+
+ # otherwise su command as monkeysphere user
+ else
+ su "$MONKEYSPHERE_USER" -c "$@"
+ fi
+}
+
+# function to interact with the host gnupg keyring
+gpg_host() {
+ local returnCode
+
+ GNUPGHOME="$GNUPGHOME_HOST"
+ export GNUPGHOME
+
+ # NOTE: we supress this warning because we need the monkeysphere
+ # user to be able to read the host pubring. we realize this might
+ # be problematic, but it's the simplest solution, without too much
+ # loss of security.
+ gpg --no-permission-warning "$@"
+ returnCode="$?"
+
+ # always reset the permissions on the host pubring so that the
+ # monkeysphere user can read the trust signatures
+ chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_HOST}/pubring.gpg"
+ chmod g+r "${GNUPGHOME_HOST}/pubring.gpg"
+
+ return "$returnCode"
+}
+
+# function to interact with the authentication gnupg keyring
+# FIXME: this function requires basically accepts only a single
+# argument because of problems with quote expansion. this needs to be
+# fixed/improved.
+gpg_authentication() {
+ GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
+ export GNUPGHOME
+
+ su_monkeysphere_user "gpg $@"
+}
+
+# output just key fingerprint
+fingerprint_server_key() {
+ # set the pipefail option so functions fails if can't read sec key
+ set -o pipefail
+
+ gpg_host --list-secret-keys --fingerprint \
+ --with-colons --fixed-list-mode 2> /dev/null | \
+ grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null
+}
+
+# function to check for host secret key
+check_host_keyring() {
+ fingerprint_server_key >/dev/null \
+ || failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-server gen-key' first."
+}
+
+# output key information
+show_server_key() {
+ local fingerprintPGP
+ local fingerprintSSH
+ local ret=0
+
+ # FIXME: you shouldn't have to be root to see the host key fingerprint
+ check_host_keyring
+ fingerprintPGP=$(fingerprint_server_key)
+ gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null
+ if [ $? -ne 0 ] ; then
+ log info "You must be root to see host OpenPGP fingerprint."
+ ret='1'
+ else
+ echo "OpenPGP fingerprint: $fingerprintPGP"
+ fi
+
+ if [ -f "${SYSDATADIR}/ssh_host_rsa_key.pub" ] ; then
+ fingerprintSSH=$(ssh-keygen -l -f "${SYSDATADIR}/ssh_host_rsa_key.pub" | \
+ awk '{ print $1, $2, $4 }')
+ echo "ssh fingerprint: $fingerprintSSH"
+ else
+ log info "SSH host key not found."
+ ret='1'
+ fi
+
+ return $ret
+}
+
+# update authorized_keys for users
+update_users() {
+ if [ "$1" ] ; then
+ # get users from command line
+ unames="$@"
+ else
+ # or just look at all users if none specified
+ unames=$(getent passwd | cut -d: -f1)
+ fi
+
+ RETCODE=0
+
+ # set mode
+ MODE="authorized_keys"
+
+ # set gnupg home
+ GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
+
+ # check to see if the gpg trust database has been initialized
+ if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
+ failure "GNUPG trust database uninitialized. Please see MONKEYSPHERE-SERVER(8)."
+ fi
+
+ # make sure the authorized_keys directory exists
+ mkdir -p "${SYSDATADIR}/authorized_keys"
+
+ # loop over users
+ for uname in $unames ; do
+ # check all specified users exist
+ if ! id "$uname" >/dev/null ; then
+ log error "----- unknown user '$uname' -----"
+ continue
+ fi
+
+ log verbose "----- user: $uname -----"
+
+ # make temporary directory
+ TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
+
+ # trap to delete temporary directory on exit
+ trap "rm -rf $TMPLOC" EXIT
+
+ # create temporary authorized_user_ids file
+ TMP_AUTHORIZED_USER_IDS="${TMPLOC}/authorized_user_ids"
+ touch "$TMP_AUTHORIZED_USER_IDS"
+
+ # create temporary authorized_keys file
+ AUTHORIZED_KEYS="${TMPLOC}/authorized_keys"
+ touch "$AUTHORIZED_KEYS"
+
+ # set restrictive permissions on the temporary files
+ # FIXME: is there a better way to do this?
+ chmod 0700 "$TMPLOC"
+ chmod 0600 "$AUTHORIZED_KEYS"
+ chmod 0600 "$TMP_AUTHORIZED_USER_IDS"
+ chown -R "$MONKEYSPHERE_USER" "$TMPLOC"
+
+ # process authorized_user_ids file
+ log debug "checking for authorized_user_ids..."
+ # translating ssh-style path variables
+ authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
+ if [ -s "$authorizedUserIDs" ] ; then
+ # check permissions on the authorized_user_ids file path
+ if check_key_file_permissions "$uname" "$authorizedUserIDs" ; then
+ # copy user authorized_user_ids file to temporary
+ # location
+ cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
+
+ # export needed variables
+ export AUTHORIZED_KEYS
+ export TMP_AUTHORIZED_USER_IDS
+
+ # process authorized_user_ids file, as monkeysphere
+ # user
+ su_monkeysphere_user \
+ ". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
+ RETURN="$?"
+ else
+ log debug "not processing authorized_user_ids."
+ fi
+ else
+ log debug "empty or absent authorized_user_ids file."
+ fi
+
+ # add user-controlled authorized_keys file if specified
+ # translate ssh-style path variables
+ rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
+ if [ "$rawAuthorizedKeys" != 'none' ] ; then
+ log debug "checking for raw authorized_keys..."
+ if [ -s "$rawAuthorizedKeys" ] ; then
+ # check permissions on the authorized_keys file path
+ if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then
+ log verbose "adding raw authorized_keys file... "
+ cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
+ else
+ log debug "not adding raw authorized_keys file."
+ fi
+ else
+ log debug "empty or absent authorized_keys file."
+ fi
+ fi
+
+ # move the new authorized_keys file into place
+ if [ -s "$AUTHORIZED_KEYS" ] ; then
+ # openssh appears to check the contents of the
+ # authorized_keys file as the user in question, so the
+ # file must be readable by that user at least.
+
+ # but in general, we don't want the user tampering with
+ # this file directly, so we'll adopt this approach: Own
+ # the file by the monkeysphere-server invoker (usually
+ # root, but should be the same uid that sshd is launched
+ # as); change the group of the file so that members of the
+ # user's group can read it.
+
+ # FIXME: is there a better way to do this?
+ chown $(whoami) "$AUTHORIZED_KEYS" && \
+ chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \
+ chmod g+r "$AUTHORIZED_KEYS" && \
+ mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \
+ {
+ log error "Failed to install authorized_keys for '$uname'!"
+ rm -f "${SYSDATADIR}/authorized_keys/${uname}"
+ # indicate that there has been a failure:
+ RETURN=1
+ }
+ else
+ rm -f "${SYSDATADIR}/authorized_keys/${uname}"
+ fi
+
+ # unset the trap
+ trap - EXIT
+
+ # destroy temporary directory
+ rm -rf "$TMPLOC"
+ done
+}
+
+# import an existing ssh key to a gpg key
+import_key() {
+ local hostName=$(hostname -f)
+ local keyFile="/etc/ssh/ssh_host_rsa_key"
+ local keyExpire
+ local userID
+
+ # check for presense of secret key
+ # FIXME: is this the proper test to be doing here?
+ fingerprint_server_key >/dev/null \
+ && failure "An OpenPGP host key already exists."
+
+ # get options
+ while true ; do
+ case "$1" in
+ -h|--hostname)
+ hostName="$2"
+ shift 2
+ ;;
+ -f|--keyfile)
+ keyFile="$2"
+ shift 2
+ ;;
+ -e|--expire)
+ keyExpire="$2"
+ shift 2
+ ;;
+ *)
+ if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then
+ failure "Unknown option '$1'.
+Type '$PGRM help' for usage."
+ fi
+ break
+ ;;
+ esac
+ done
+
+ if [ ! -f "$keyFile" ] ; then
+ failure "SSH secret key file '$keyFile' not found."
+ fi
+
+ userID="ssh://${hostName}"
+
+ # prompt about key expiration if not specified
+ keyExpire=$(get_gpg_expiration "$keyExpire")
+
+ echo "The following key parameters will be used for the host private key:"
+ echo "Import: $keyFile"
+ echo "Name-Real: $userID"
+ echo "Expire-Date: $keyExpire"
+
+ read -p "Import key? (Y/n) " OK; OK=${OK:=Y}
+ if [ ${OK/y/Y} != 'Y' ] ; then
+ failure "aborting."
+ fi
+
+ log verbose "importing ssh key..."
+ # translate ssh key to a private key
+ (umask 077 && \
+ pem2openpgp "$userID" "$keyExpire" < "$sshKey" | gpg_host --import)
+
+ # find the key fingerprint of the newly converted key
+ fingerprint=$(fingerprint_server_key)
+
+ # export host ownertrust to authentication keyring
+ log verbose "setting ultimate owner trust for host key..."
+ echo "${fingerprint}:6:" | gpg_host "--import-ownertrust"
+ echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
+
+ # export public key to file
+ gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+ log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+
+ # show info about new key
+ show_server_key
+}
+