# -*-shell-script-*-
# This should be sourced by bash (though we welcome changes to make it POSIX sh compliant)
-# monkeysphere-ssh-proxycommand: MonkeySphere ssh ProxyCommand hook
+# Monkeysphere ssh-proxycommand subcommand
#
# The monkeysphere scripts are written by:
# Jameson Rollins <jrollins@finestructure.net>
# This is meant to be run as an ssh ProxyCommand to initiate a
# monkeysphere known_hosts update before an ssh connection to host is
# established. Can be added to ~/.ssh/config as follows:
-# ProxyCommand monkeysphere-ssh-proxycommand %h %p
-
-ssh_proxycommand() {
+# ProxyCommand monkeysphere ssh-proxycommand %h %p
# "marginal case" ouput in the case that there is not a full
# validation path to the host
output_no_valid_key() {
- local sshKeyOffered
local userID
+ local sshKeyOffered
+ local gpgOut
local type
local validity
local keyid
local tmpkey
local sshFingerprint
local gpgSigOut
+ local returnCode=0
userID="ssh://${HOSTP}"
- log "-------------------- Monkeysphere warning -------------------"
- log "Monkeysphere found OpenPGP keys for this hostname, but none had full validity."
+ LOG_PREFIX=
- # retrieve the actual ssh key
- sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null | awk '{ print $2, $3 }')
- # FIXME: should we do any checks for failed keyscans, eg. host not
- # found?
+ # retrieve the ssh key being offered by the host
+ sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null \
+ | awk '{ print $2, $3 }')
# get the gpg info for userid
- gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
+ gpgOut=$(gpg_user --list-key --fixed-list-mode --with-colon \
--with-fingerprint --with-fingerprint \
="$userID" 2>/dev/null)
- # find all 'pub' and 'sub' lines in the gpg output, which each
- # represent a retrieved key for the user ID
- echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
- while IFS=: read -r type validity keyid uidfpr usage ; do
- case $type in
- 'pub'|'sub')
- # get the ssh key of the gpg key
- sshKeyGPG=$(gpg2ssh "$keyid")
-
- # if one of keys found matches the one offered by the
- # host, then output info
- if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
- log "An OpenPGP key matching the ssh key offered by the host was found:"
- log
-
- # do some crazy "Here Strings" redirection to get the key to
- # ssh-keygen, since it doesn't read from stdin cleanly
- sshFingerprint=$(ssh-keygen -l -f /dev/stdin \
- <<<$(echo "$sshKeyGPG") | \
- awk '{ print $2 }')
-
- # get the sigs for the matching key
- gpgSigOut=$(gpg --check-sigs \
- --list-options show-uid-validity \
- "$keyid")
-
- # output the sigs, but only those on the user ID
- # we are looking for
- echo "$gpgSigOut" | awk '
+ # output header
+ log info <<EOF
+-------------------- Monkeysphere warning -------------------
+Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
+EOF
+
+ # if the host key is retrieved from the host, check against known
+ # OpenPGP keys
+ if [ "$sshKeyOffered" ] ; then
+ # find all 'pub' and 'sub' lines in the gpg output, which each
+ # represent a retrieved key for the user ID
+ echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
+ while IFS=: read -r type validity keyid uidfpr usage ; do
+ case $type in
+ 'pub'|'sub')
+ # get the ssh key of the gpg key
+ sshKeyGPG=$(gpg2ssh "$keyid")
+
+ # if one of keys found matches the one offered by the
+ # host, then output info
+ if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
+ log info <<EOF
+An OpenPGP key matching the ssh key offered by the host was found:
+
+EOF
+
+ sshKeyGPGFile=$(msmktempfile)
+ printf "%s" "$sshKeyGPG" >"$sshKeyGPGFile"
+ sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \
+ awk '{ print $2 }')
+ rm -f "$sshKeyGPGFile"
+
+ # get the sigs for the matching key
+ gpgSigOut=$(gpg_user --check-sigs \
+ --list-options show-uid-validity \
+ "$keyid")
+
+ # output the sigs, but only those on the user ID
+ # we are looking for
+ echo "$gpgSigOut" | awk '
{
if (match($0,"^pub")) { print; }
if (match($0,"^uid")) { ok=0; }
if (match($0,"^uid.*'$userID'$")) { ok=1; print; }
if (ok) { if (match($0,"^sig")) { print; } }
}
-' >&2
- log
-
- # output the other user IDs for reference
- if (echo "$gpgSigOut" | grep "^uid" | grep -v -q "$userID") ; then
- log "Other user IDs on this key:"
- echo "$gpgSigOut" | grep "^uid" | grep -v "$userID" >&2
- log
+' | log info
+ echo | log info
+
+ # output the other user IDs for reference
+ if (echo "$gpgSigOut" | grep "^uid" | grep -v -q "$userID") ; then
+ log info <<EOF
+Other user IDs on this key:
+
+EOF
+ echo "$gpgSigOut" | grep "^uid" | grep -v "$userID" | log info
+ echo | log info
+ fi
+
+ # output ssh fingerprint
+ log info <<EOF
+RSA key fingerprint is ${sshFingerprint}.
+EOF
+
+ # this whole process is in a "while read"
+ # subshell. the only way to get information
+ # out of the subshell is to change the return
+ # code. therefore we return 1 here to
+ # indicate that a matching gpg key was found
+ # for the ssh key offered by the host
+ return 1
fi
-
- # output ssh fingerprint
- log "RSA key fingerprint is ${sshFingerprint}."
-
- # this whole process is in a "while read"
- # subshell. the only way to get information out
- # of the subshell is to change the return code.
- # therefore we return 1 here to indicate that a
- # matching gpg key was found for the ssh key
- # offered by the host
- return 1
- fi
- ;;
- esac
- done
-
- # if no key match was made (and the "while read" subshell returned
- # 1) output how many keys were found
- if (($? != 1)) ; then
- log "None of the found keys matched the key offered by the host."
- log "Run the following command for more info about the found keys:"
- log "gpg --check-sigs --list-options show-uid-validity =${userID}"
- # FIXME: should we do anything extra here if the retrieved
- # host key is actually in the known_hosts file and the ssh
- # connection will succeed? Should the user be warned?
- # prompted?
+ ;;
+ esac
+ done || returnCode="$?"
+
+ # if no key match was made (and the "while read" subshell
+ # returned 1) output how many keys were found
+ if (( returnCode != 1 )) ; then
+ log info <<EOF
+None of the found keys matched the key offered by the host.
+Run the following command for more info about the found keys:
+gpg --check-sigs --list-options show-uid-validity =${userID}
+EOF
+
+ # FIXME: should we do anything extra here if the retrieved
+ # host key is actually in the known_hosts file and the ssh
+ # connection will succeed? Should the user be warned?
+ # prompted?
+ fi
+
+ # if host key could not be retrieved from the host, output message
+ else
+ log info <<EOF
+Could not retrieve RSA host key from $HOST.
+EOF
fi
- log "-------------------- ssh continues below --------------------"
+ # output footer
+ log info <<EOF
+-------------------- ssh continues below --------------------
+EOF
}
-########################################################################
-# export the monkeysphere log level
-export MONKEYSPHERE_LOG_LEVEL
+# the ssh proxycommand function itself
+ssh_proxycommand() {
if [ "$1" = '--no-connect' ] ; then
NO_CONNECT='true'
PORT="$2"
if [ -z "$HOST" ] ; then
- log "Host not specified."
+ log error "Host not specified."
usage
exit 255
fi
# intentionally different than that of running monkeyesphere normally,
# and keyserver checking is intentionally done under certain
# circumstances. This can be overridden by setting the
-# MONKEYSPHERE_CHECK_KEYSERVER environment variable.
+# MONKEYSPHERE_CHECK_KEYSERVER environment variable, or by setting the
+# CHECK_KEYSERVER variable in the monkeysphere.conf file.
# if the host is in the gpg keyring...
-if gpg --list-key ="${URI}" 2>&1 >/dev/null ; then
+if gpg_user --list-key ="${URI}" 2>&1 >/dev/null ; then
# do not check the keyserver
- CHECK_KEYSERVER="false"
+ CHECK_KEYSERVER=${CHECK_KEYSERVER:="false"}
# if the host is NOT in the keyring...
else
# FIXME: more nuanced checking should be done here to properly
# take into consideration hosts that join monkeysphere by
# converting an existing and known ssh key
- CHECK_KEYSERVER="false"
+ CHECK_KEYSERVER=${CHECK_KEYSERVER:="false"}
# if the host key is not found in the known_hosts file...
else
# check the keyserver
- CHECK_KEYSERVER="true"
+ CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"}
fi
fi
-# set and export the variable for use by monkeysphere
-MONKEYSPHERE_CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="$CHECK_KEYSERVER"}
-export MONKEYSPHERE_CHECK_KEYSERVER
+
+# finally look in the MONKEYSPHERE_ environment variable for a
+# CHECK_KEYSERVER setting to override all else
+CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=$CHECK_KEYSERVER}
# update the known_hosts file for the host
-monkeysphere update-known_hosts "$HOSTP"
+local returnCode=0
+update_known_hosts "$HOSTP" || returnCode="$?"
# output on depending on the return of the update-known_hosts
# subcommand, which is (ultimately) the return code of the
# update_known_hosts function in common
-case $? in
+case "$returnCode" in
0)
# acceptable host key found so continue to ssh
true
projects / monkeysphere.git / blobdiff