X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere;h=cd7719345caefedbc9068327d809d6908d2941df;hb=8ec4e9b0a4a58aece8e5034324971ab40b25fa12;hp=a25fd6a64257a780fc6628842f119218a1f198ee;hpb=5fadec09dcd44c4dcad657a0f3d96878b592b77b;p=monkeysphere.git diff --git a/src/monkeysphere b/src/monkeysphere index a25fd6a..cd77193 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -24,6 +24,9 @@ unset GREP_OPTIONS # default return code RETURN=0 +# set the file creation mask to be only owner rw +umask 077 + ######################################################################## # FUNCTIONS ######################################################################## @@ -47,29 +50,62 @@ EOF # generate a subkey with the 'a' usage flags set # FIXME: this needs some tweaking to clean it up gen_subkey(){ + local keyLength + local keyExpire local keyID local gpgOut local userID - keyID="$1" + # set default key parameter values + keyLength= + keyExpire= + + # get options + TEMP=$(getopt -o l:e: -l length:,expire: -n "$PGRM" -- "$@") + + if [ $? != 0 ] ; then + exit 1 + fi - gpgOut=$(gpg --quiet --fixed-list-mode --list-keys --with-colons \ - "$keyID" 2> /dev/null) + # Note the quotes around `$TEMP': they are essential! + eval set -- "$TEMP" + + while true ; do + case "$1" in + -l|--length) + keyLength="$2" + shift 2 + ;; + -e|--expire) + keyExpire="$2" + shift 2 + ;; + --) + shift + ;; + *) + break + ;; + esac + done - # fail if there only "tru" lines are output from gpg, which - # indicates the key was not found. - if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - failure "Key ID '$keyID' not found." + keyID="$1" + if [ -z "$keyID" ] ; then + failure "You must specify the key ID of your primary key." fi - # fail if multiple pub lines are returned, which means the id given - # is not unique - if [ $(echo "$gpgOut" | grep '^pub:' | wc -l) -gt '1' ] ; then + # get key output, and fail if not found + gpgOut=$(gpg --quiet --fixed-list-mode --list-secret-keys --with-colons \ + "$keyID") || failure + + # fail if multiple sec lines are returned, which means the id + # given is not unique + if [ $(echo "$gpgOut" | grep '^sec:' | wc -l) -gt '1' ] ; then failure "Key ID '$keyID' is not unique." fi # prompt if an authentication subkey already exists - if echo "$gpgOut" | egrep "^(pub|sub):" | cut -d: -f 12 | grep -q a ; then + if echo "$gpgOut" | egrep "^(sec|ssb):" | cut -d: -f 12 | grep -q a ; then echo "An authentication subkey already exists for key '$keyID'." read -p "Are you sure you would like to generate another one? (y/N) " OK; OK=${OK:N} if [ "${OK/y/Y}" != 'Y' ] ; then @@ -78,11 +114,8 @@ gen_subkey(){ fi # set subkey defaults - KEY_TYPE="RSA" - KEY_LENGTH=${KEY_LENGTH:-} - KEY_USAGE="auth" # prompt about key expiration if not specified - if [ -z "$KEY_EXPIRE" ] ; then + if [ -z "$keyExpire" ] ; then cat <m = key expires in n months y = key expires in n years EOF - while [ -z "$KEY_EXPIRE" ] ; do - read -p "Key is valid for? (0) " KEY_EXPIRE - if ! test_gpg_expire ${KEY_EXPIRE:=0} ; then + while [ -z "$keyExpire" ] ; do + read -p "Key is valid for? (0) " keyExpire + if ! test_gpg_expire ${keyExpire:=0} ; then echo "invalid value" - unset KEY_EXPIRE + unset keyExpire fi done - elif ! test_gpg_expire "$KEY_EXPIRE" ; then - failure "invalid key expiration value '$KEY_EXPIRE'." + elif ! test_gpg_expire "$keyExpire" ; then + failure "invalid key expiration value '$keyExpire'." fi # generate the list of commands that will be passed to edit-key @@ -110,8 +143,8 @@ S E A Q -$KEY_LENGTH -$KEY_EXPIRE +$keyLength +$keyExpire save EOF ) @@ -166,44 +199,15 @@ COMMAND="$1" [ "$COMMAND" ] || failure "Type '$PGRM help' for usage." shift -# unset option variables -unset KEY_LENGTH -unset KEY_EXPIRE - -# get options for key generation and add-certifier functions -TEMP=$(getopt -o l:e: -l length:,expire: -n "$PGRM" -- "$@") - -if [ $? != 0 ] ; then - usage - exit 1 -fi - -# Note the quotes around `$TEMP': they are essential! -eval set -- "$TEMP" - -while true ; do - case "$1" in - -l|--length) - KEY_LENGTH="$2" - shift 2 - ;; - -e|--expire) - KEY_EXPIRE="$2" - shift 2 - ;; - --) - shift - ;; - *) - break - ;; - esac -done - case $COMMAND in 'update-known_hosts'|'update-known-hosts'|'k') MODE='known_hosts' + # check permissions on the known_hosts file path + if ! check_key_file_permissions "$USER" "$KNOWN_HOSTS" ; then + failure "Improper permissions on known_hosts file path." + fi + # if hosts are specified on the command line, process just # those hosts if [ "$1" ] ; then @@ -213,8 +217,10 @@ case $COMMAND in # otherwise, if no hosts are specified, process every host # in the user's known_hosts file else - if [ ! -s "$KNOWN_HOSTS" ] ; then - failure "known_hosts file '$KNOWN_HOSTS' is empty or does not exist." + # exit if the known_hosts file does not exist + if [ ! -e "$KNOWN_HOSTS" ] ; then + log "known_hosts file '$KNOWN_HOSTS' does not exist." + exit fi process_known_hosts @@ -225,9 +231,20 @@ case $COMMAND in 'update-authorized_keys'|'update-authorized-keys'|'a') MODE='authorized_keys' - # fail if the authorized_user_ids file is empty - if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - failure "$AUTHORIZED_USER_IDS is empty or does not exist." + # check permissions on the authorized_user_ids file path + if ! check_key_file_permissions "$USER" "$AUTHORIZED_USER_IDS" ; then + failure "Improper permissions on authorized_user_ids file path." + fi + + # check permissions on the authorized_keys file path + if ! check_key_file_permissions "$USER" "$AUTHORIZED_KEYS" ; then + failure "Improper permissions on authorized_keys file path." + fi + + # exit if the authorized_user_ids file is empty + if [ ! -e "$AUTHORIZED_USER_IDS" ] ; then + log "authorized_user_ids file '$AUTHORIZED_USER_IDS' does not exist." + exit fi # process authorized_user_ids file @@ -236,11 +253,7 @@ case $COMMAND in ;; 'gen-subkey'|'g') - keyID="$1" - if [ -z "$keyID" ] ; then - failure "You must specify the key ID of your primary key." - fi - gen_subkey "$keyID" + gen_subkey "$@" ;; 'help'|'h'|'?')