SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
export SYSDATADIR
+# monkeysphere temp directory, in sysdatadir to enable atomic moves of
+# authorized_keys files
+MSTMPDIR="${SYSDATADIR}/tmp"
+export MSTMPDIR
+
# UTC date in ISO 8601 format if needed
DATE=$(date -u '+%FT%T')
su_monkeysphere_user "gpg $@"
}
+# check if user is root
+is_root() {
+ [ $(id -u 2>/dev/null) = '0' ]
+}
+
+# check that user is root, for functions that require root access
+check_user() {
+ is_root || failure "You must be root to run this command."
+}
+
# output just key fingerprint
fingerprint_server_key() {
+ # set the pipefail option so functions fails if can't read sec key
+ set -o pipefail
+
gpg_host --list-secret-keys --fingerprint \
--with-colons --fixed-list-mode 2> /dev/null | \
- grep '^fpr:' | head -1 | cut -d: -f10
+ grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null
+}
+
+# function to check for host secret key
+check_host_keyring() {
+ fingerprint_server_key >/dev/null \
+ || failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-server gen-key' first."
}
# output key information
show_server_key() {
- local fingerprint
- local tmpkey
+ local fingerprintPGP
+ local fingerprintSSH
+ local ret=0
+
+ # FIXME: you shouldn't have to be root to see the host key fingerprint
+ if is_root ; then
+ check_host_keyring
+ fingerprintPGP=$(fingerprint_server_key)
+ gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null
+ echo "OpenPGP fingerprint: $fingerprintPGP"
+ else
+ log info "You must be root to see host OpenPGP fingerprint."
+ ret='1'
+ fi
- fingerprint=$(fingerprint_server_key)
- gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprint"
-
- # dumping to a file named ' ' so that the ssh-keygen output
- # doesn't claim any potentially bogus hostname(s):
- tmpkey=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
- gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ "
- echo -n "ssh fingerprint: "
- (cd "$tmpkey" && ssh-keygen -l -f ' ' | awk '{ print $2 }')
- rm -rf "$tmpkey"
- echo -n "OpenPGP fingerprint: "
- echo "$fingerprint"
+ if [ -f "${SYSDATADIR}/ssh_host_rsa_key.pub" ] ; then
+ fingerprintSSH=$(ssh-keygen -l -f "${SYSDATADIR}/ssh_host_rsa_key.pub" | \
+ awk '{ print $1, $2, $4 }')
+ echo "ssh fingerprint: $fingerprintSSH"
+ else
+ log info "SSH host key not found."
+ ret='1'
+ fi
+
+ return $ret
}
# update authorized_keys for users
unames=$(getent passwd | cut -d: -f1)
fi
+ RETCODE=0
+
# set mode
MODE="authorized_keys"
# loop over users
for uname in $unames ; do
# check all specified users exist
- if ! getent passwd "$uname" >/dev/null ; then
+ if ! id "$uname" >/dev/null ; then
log error "----- unknown user '$uname' -----"
continue
fi
log verbose "----- user: $uname -----"
# make temporary directory
- TMPLOC=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
+ TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
# trap to delete temporary directory on exit
trap "rm -rf $TMPLOC" EXIT
chown -R "$MONKEYSPHERE_USER" "$TMPLOC"
# process authorized_user_ids file
+ log debug "checking for authorized_user_ids..."
# translating ssh-style path variables
authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
if [ -s "$authorizedUserIDs" ] ; then
". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
RETURN="$?"
else
- log error "Improper permissions on path '$AUTHORIZED_USER_IDS'."
+ log debug "not processing authorized_user_ids."
fi
+ else
+ log debug "empty or absent authorized_user_ids file."
fi
# add user-controlled authorized_keys file if specified
# translate ssh-style path variables
rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
- if [ "$rawAuthorizedKeys" != '-' -a -s "$rawAuthorizedKeys" ] ; then
- # check permissions on the authorized_keys file path
- if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then
- log verbose "adding raw authorized_keys file... "
- cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
+ if [ "$rawAuthorizedKeys" != 'none' ] ; then
+ log debug "checking for raw authorized_keys..."
+ if [ -s "$rawAuthorizedKeys" ] ; then
+ # check permissions on the authorized_keys file path
+ if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then
+ log verbose "adding raw authorized_keys file... "
+ cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
+ else
+ log debug "not adding raw authorized_keys file."
+ fi
else
- log error "Improper permissions on path '$RAW_AUTHORIZED_KEYS'. Not added to authorized_keys file."
+ log debug "empty or absent authorized_keys file."
fi
fi
# openssh appears to check the contents of the
# authorized_keys file as the user in question, so the
# file must be readable by that user at least.
- # FIXME: is there a better way to do this?
- chown root "$AUTHORIZED_KEYS"
- chgrp $(getent passwd "$uname" | cut -f4 -d:) "$AUTHORIZED_KEYS"
- chmod g+r "$AUTHORIZED_KEYS"
- mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}"
+ # but in general, we don't want the user tampering with
+ # this file directly, so we'll adopt this approach: Own
+ # the file by the monkeysphere-server invoker (usually
+ # root, but should be the same uid that sshd is launched
+ # as); change the group of the file so that members of the
+ # user's group can read it.
+
+ # FIXME: is there a better way to do this?
+ chown $(whoami) "$AUTHORIZED_KEYS" && \
+ chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \
+ chmod g+r "$AUTHORIZED_KEYS" && \
+ mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \
+ {
+ log error "Failed to install authorized_keys for '$uname'!"
+ rm -f "${SYSDATADIR}/authorized_keys/${uname}"
+ # indicate that there has been a failure:
+ RETURN=1
+ }
else
rm -f "${SYSDATADIR}/authorized_keys/${uname}"
fi
revoker=
# get options
- TEMP=$(PATH="/usr/local/bin:$PATH" getopt -o e:l:r -l expire:,length:,revoker: -n "$PGRM" -- "$@") || failure "getopt failed! Does your getopt support GNU-style long options?"
-
- if [ $? != 0 ] ; then
- exit 1
- fi
-
- # Note the quotes around `$TEMP': they are essential!
- eval set -- "$TEMP"
-
while true ; do
case "$1" in
-l|--length)
revoker="$2"
shift 2
;;
- --)
- shift
- ;;
- *)
+ *)
+ if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then
+ failure "Unknown option '$1'.
+Type '$PGRM help' for usage."
+ fi
break
;;
esac
hostName=${1:-$(hostname -f)}
userID="ssh://${hostName}"
- # check for presense of key with user ID
- if gpg_host --list-key ="$userID" > /dev/null 2>&1 ; then
- failure "Key for '$userID' already exists"
- fi
+ # check for presense of secret key
+ # FIXME: is this the proper test to be doing here?
+ fingerprint_server_key >/dev/null \
+ && failure "A key for this host already exists."
# prompt about key expiration if not specified
keyExpire=$(get_gpg_expiration "$keyExpire")
# set key parameters
- keyParameters=$(cat <<EOF
-Key-Type: $keyType
+ keyParameters=\
+"Key-Type: $keyType
Key-Length: $keyLength
Key-Usage: $keyUsage
Name-Real: $userID
-Expire-Date: $keyExpire
-EOF
-)
+Expire-Date: $keyExpire"
# add the revoker field if specified
# FIXME: the "1:" below assumes that $REVOKER's key is an RSA key.
# FIXME: key is marked "sensitive"? is this appropriate?
if [ "$revoker" ] ; then
- keyParameters="${keyParameters}"$(cat <<EOF
-Revoker: 1:$revoker sensitive
-EOF
-)
+ keyParameters=\
+"${keyParameters}
+Revoker: 1:${revoker} sensitive"
fi
echo "The following key parameters will be used for the host private key:"
fi
# add commit command
- keyParameters="${keyParameters}"$(cat <<EOF
+ # must include blank line!
+ keyParameters=\
+"${keyParameters}
%commit
-%echo done
-EOF
-)
+%echo done"
log verbose "generating server key..."
echo "$keyParameters" | gpg_host --batch --gen-key
- # output the server fingerprint
- fingerprint_server_key "=${userID}"
-
# find the key fingerprint of the newly generated key
fingerprint=$(fingerprint_server_key)
(umask 077 && \
gpg_host --export-secret-key "$fingerprint" | \
openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key")
- log info "Private SSH host key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+ log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+ ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
+ log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
+ gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+ log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+
+ # show info about new key
+ show_server_key
}
# extend the lifetime of a host key:
local fpr=$(fingerprint_server_key)
local extendTo="$1"
- if [ -z "$fpr" ] ; then
- failure "You don't appear to have a MonkeySphere host key on this server. Try 'monkeysphere-server gen-key' first."
- fi
-
# get the new expiration date
extendTo=$(get_gpg_expiration "$extendTo")
save
EOF
- )
+)
# execute edit-key script
if echo "$adduidCommand" | \
echo " - Recommendation: remove the above HostKey lines from $sshd_config"
problemsfound=$(($problemsfound+1))
fi
+
+ # FIXME: test (with ssh-keyscan?) that the running ssh
+ # daemon is actually offering the monkeysphere host key.
+
fi
fi
depth=1
# get options
- TEMP=$(PATH="/usr/local/bin:$PATH" getopt -o n:t:d: -l domain:,trust:,depth: -n "$PGRM" -- "$@") || failure "getopt failed! Does your getopt support GNU-style long options?"
-
- if [ $? != 0 ] ; then
- exit 1
- fi
-
- # Note the quotes around `$TEMP': they are essential!
- eval set -- "$TEMP"
-
while true ; do
case "$1" in
-n|--domain)
depth="$2"
shift 2
;;
- --)
- shift
- ;;
- *)
+ *)
+ if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then
+ failure "Unknown option '$1'.
+Type '$PGRM help' for usage."
+ fi
break
;;
esac
# export the key to the host keyring
gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
- if [ "$trust" == marginal ]; then
+ if [ "$trust" = marginal ]; then
trustval=1
- elif [ "$trust" == full ]; then
+ elif [ "$trust" = full ]; then
trustval=2
else
failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)."
case $COMMAND in
'update-users'|'update-user'|'u')
+ check_user
+ check_host_keyring
update_users "$@"
;;
'gen-key'|'g')
+ check_user
gen_key "$@"
;;
'extend-key'|'e')
+ check_user
+ check_host_keyring
extend_key "$@"
;;
'add-hostname'|'add-name'|'n+')
+ check_user
+ check_host_keyring
add_hostname "$@"
;;
'revoke-hostname'|'revoke-name'|'n-')
+ check_user
+ check_host_keyring
revoke_hostname "$@"
;;
;;
'publish-key'|'publish'|'p')
+ check_user
+ check_host_keyring
publish_server_key
;;
'diagnostics'|'d')
+ check_user
diagnostics
;;
'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
+ check_user
+ check_host_keyring
add_certifier "$@"
;;
'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
+ check_user
+ check_host_keyring
remove_certifier "$@"
;;
'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
+ check_user
+ check_host_keyring
list_certifiers "$@"
;;
'gpg-authentication-cmd')
+ check_user
gpg_authentication_cmd "$@"
;;
projects / monkeysphere.git / blobdiff