su_monkeysphere_user "gpg $@"
}
+# function to check for host secret keys
+# fails if host sec key exists, exits true otherwise
+check_host_keyring() {
+ if ! gpg_host --list-secret-keys --fingerprint \
+ --with-colons --fixed-list-mode 2>/dev/null | grep -q '^sec:' ; then
+
+ failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-server gen-key' first."
+ fi
+}
+
# output just key fingerprint
fingerprint_server_key() {
gpg_host --list-secret-keys --fingerprint \
fingerprint=$(fingerprint_server_key)
gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprint"
- # dumping to a file named ' ' so that the ssh-keygen output
- # doesn't claim any potentially bogus hostname(s):
- tmpkey=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
- gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ "
+ # do some crazy "Here Strings" redirection to get the key to
+ # ssh-keygen, since it doesn't read from stdin cleanly
echo -n "ssh fingerprint: "
- (cd "$tmpkey" && ssh-keygen -l -f ' ' | awk '{ print $2 }')
- rm -rf "$tmpkey"
+ ssh-keygen -l -f /dev/stdin \
+ <<<$(gpg_authentication "--export $fingerprint" | \
+ openpgp2ssh "$fingerprint" 2>/dev/null) | \
+ awk '{ print $1, $2, $4 }'
echo -n "OpenPGP fingerprint: "
echo "$fingerprint"
}
log verbose "----- user: $uname -----"
# make temporary directory
- TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX)
+ TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
# trap to delete temporary directory on exit
trap "rm -rf $TMPLOC" EXIT
# add user-controlled authorized_keys file if specified
# translate ssh-style path variables
rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
- if [ "$rawAuthorizedKeys" ] ; then
+ if [ "$rawAuthorizedKeys" != 'none' ] ; then
log debug "checking for raw authorized_keys..."
if [ -s "$rawAuthorizedKeys" ] ; then
# check permissions on the authorized_keys file path
userID="ssh://${hostName}"
# check for presense of key with user ID
+ # FIXME: is this the proper test to be doing here?
if gpg_host --list-key ="$userID" > /dev/null 2>&1 ; then
failure "Key for '$userID' already exists"
fi
(umask 077 && \
gpg_host --export-secret-key "$fingerprint" | \
openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key")
- log info "private SSH host key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+ log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+ ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
+ log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
+ gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+ log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
}
# extend the lifetime of a host key:
local fpr=$(fingerprint_server_key)
local extendTo="$1"
- if [ -z "$fpr" ] ; then
- failure "You don't appear to have a MonkeySphere host key on this server. Try 'monkeysphere-server gen-key' first."
- fi
-
# get the new expiration date
extendTo=$(get_gpg_expiration "$extendTo")
echo " - Recommendation: remove the above HostKey lines from $sshd_config"
problemsfound=$(($problemsfound+1))
fi
+
+ # FIXME: test (with ssh-keyscan?) that the running ssh
+ # daemon is actually offering the monkeysphere host key.
+
fi
fi
# export the key to the host keyring
gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
- if [ "$trust" == marginal ]; then
+ if [ "$trust" = marginal ]; then
trustval=1
- elif [ "$trust" == full ]; then
+ elif [ "$trust" = full ]; then
trustval=2
else
failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)."
case $COMMAND in
'update-users'|'update-user'|'u')
+ check_host_keyring
update_users "$@"
;;
;;
'extend-key'|'e')
+ check_host_keyring
extend_key "$@"
;;
'add-hostname'|'add-name'|'n+')
+ check_host_keyring
add_hostname "$@"
;;
'revoke-hostname'|'revoke-name'|'n-')
+ check_host_keyring
revoke_hostname "$@"
;;
'show-key'|'show'|'s')
+ check_host_keyring
show_server_key
;;
'publish-key'|'publish'|'p')
+ check_host_keyring
publish_server_key
;;
;;
'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
+ check_host_keyring
add_certifier "$@"
;;
'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
+ check_host_keyring
remove_certifier "$@"
;;
'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
+ check_host_keyring
list_certifiers "$@"
;;