rename function to get the host fingerprint, and fix some

[monkeysphere.git] / src / monkeysphere-host

diff --git a/src/monkeysphere-host b/src/monkeysphere-host
index bcb570b98df166310938b1f795c445537fc33a95..be398b159dfe22f5789157c795cad849ba280b45 100755 (executable)
--- a/src/monkeysphere-host
+++ b/src/monkeysphere-host
@@ -14,6 +14,9 @@
 ########################################################################
 set -e
 
+# set the pipefail option so pipelines fail on first command failure
+set -o pipefail
+
 PGRM=$(basename $0)
 
 SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
@@ -65,19 +68,6 @@ subcommands:
 EOF
 }
 
-# function to run command as monkeysphere user
-su_monkeysphere_user() {
-    # if the current user is the monkeysphere user, then just eval
-    # command
-    if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then
-       eval "$@"
-
-    # otherwise su command as monkeysphere user
-    else
-       su "$MONKEYSPHERE_USER" -c "$@"
-    fi
-}
-
 # function to interact with the gpg keyring
 gpg_host() {
     GNUPGHOME="$GNUPGHOME_HOST" gpg "$@"
@@ -106,18 +96,19 @@ gpg_host_export() {
 # export the host key to the monkeysphere host file key
 gpg_host_export_to_ssh_file() {
     log debug "exporting openpgp public key..."
-    gpg_host_export > "${MHDATADIR}/ssh_host_rsa_key.pub.gpg"
-    log info "SSH host public key in OpenPGP form: ${MHDATADIR}/ssh_host_rsa_key.pub.gpg"
+
+    gpg_host_export > "$HOST_KEY_PUB_GPG"
+    log info "SSH host public key in OpenPGP form: $HOST_KEY_PUB_GPG"
 }
 
 # output just key fingerprint
-fingerprint_host_key() {
-    # set the pipefail option so functions fails if can't read sec key
-    set -o pipefail
-
+# FIXME: should not have to be priviledged user to get host
+# fingerprint.  should be taken from publicly accessible key files,
+# instead of the keyring.
+get_host_fingerprint() {
     gpg_host --list-secret-keys --fingerprint \
        --with-colons --fixed-list-mode 2> /dev/null | \
-       grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null
+       grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null || true
 }
 
 # output the index of a user ID on the host key
@@ -154,24 +145,21 @@ check_host_fail() {
 show_key() {
     local fingerprintSSH
 
-    # FIXME: should not have to be priviledged user to see this info.
-    # should be taken from publicly accessible key files, instead of
-    # the keyring.
-
     gpg_host --fingerprint --list-key --list-options show-unusable-uids \
        "0x${HOST_FINGERPRINT}!" 2>/dev/null
+    # FIXME: make sure expiration date is shown
 
     echo "OpenPGP fingerprint: $HOST_FINGERPRINT"
 
-    if [ -f "${MHDATADIR}/ssh_host_rsa_key.pub" ] ; then
-       fingerprintSSH=$(ssh-keygen -l -f "${MHDATADIR}/ssh_host_rsa_key.pub" | \
+    if [ -f "$HOST_KEY_PUB" ] ; then
+       fingerprintSSH=$(ssh-keygen -l -f "$HOST_KEY_PUB" | \
            awk '{ print $1, $2, $4 }')
+
        echo "ssh fingerprint: $fingerprintSSH"
     else
-       log info "SSH host key not found."
+       log error "SSH host key not found."
     fi
 
-    # FIXME: show expiration date
     # FIXME: other relevant key parameters?
 }
 
@@ -199,7 +187,11 @@ CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"}
 GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"}
 
 # host key fingerprint
-HOST_FINGERPRINT=$(fingerprint_host_key)
+HOST_FINGERPRINT=$(get_host_fingerprint)
+
+# host pub key files
+HOST_KEY_PUB="${SYSDATADIR}/ssh_host_rsa_key.pub"
+HOST_KEY_PUB_GPG="${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 
 # export variables needed in su invocation
 export DATE
@@ -219,42 +211,42 @@ shift
 
 case $COMMAND in
     'show-key'|'show'|'s')
-       check_host_keyring
+       check_host_fail
        show_key
        ;;
 
     'set-expire'|'extend-key'|'e')
-       check_host_keyring
+       check_host_fail
        source "${MHSHAREDIR}/set_expire"
        set_expire "$@"
        ;;
 
     'add-hostname'|'add-name'|'n+')
-       check_host_keyring
+       check_host_fail
        source "${MHSHAREDIR}/add_hostname"
        add_hostname "$@"
        ;;
 
     'revoke-hostname'|'revoke-name'|'n-')
-       check_host_keyring
+       check_host_fail
        source "${MHSHAREDIR}/revoke_hostname"
        revoke_hostname "$@"
        ;;
 
     'add-revoker'|'o')
-       check_host_keyring
+       check_host_fail
        source "${MHSHAREDIR}/add_revoker"
        add_revoker "$@"
        ;;
 
     'revoke-key'|'r')
-       check_host_keyring
+       check_host_fail
        source "${MHSHAREDIR}/revoke_key"
        revoke_key "$@"
        ;;
 
     'publish-key'|'publish'|'p')
-       check_host_keyring
+       check_host_fail
        source "${MHSHAREDIR}/publish_key"
        publish_key
        ;;