X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere;h=fe92960472b6b114fea610238084c5755c609ba4;hb=e9f00652e3503ef2292e6d27df80cbb4c8e09504;hp=371983f2fb82ac962fedb04475789d0e1389aa11;hpb=4e0502a242b89c73535b00cc1b199dfea38ce4d4;p=monkeysphere.git diff --git a/src/monkeysphere b/src/monkeysphere index 371983f..fe92960 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -3,7 +3,7 @@ # monkeysphere: Monkeysphere client tool # # The monkeysphere scripts are written by: -# Jameson Rollins +# Jameson Rollins # Jamie McClelland # Daniel Kahn Gillmor # Micah Anderson @@ -18,7 +18,8 @@ PGRM=$(basename $0) SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"} export SYSSHAREDIR -. "${SYSSHAREDIR}/common" || exit 1 +. "${SYSSHAREDIR}/defaultenv" +. "${SYSSHAREDIR}/common" # sharedir for host functions MSHAREDIR="${SYSSHAREDIR}/m" @@ -44,10 +45,15 @@ Monkeysphere client tool. subcommands: update-known_hosts (k) [HOST]... update known_hosts file update-authorized_keys (a) update authorized_keys file + ssh-proxycommand HOST [PORT] monkeysphere ssh ProxyCommand + --no-connect do not make TCP connection to host + subkey-to-ssh-agent (s) store authentication subkey in ssh-agent + + keys-for-userid (u) USERID output valid keys for given user ids + sshfprs-for-userid USERID output ssh fingerprints for given user ids gen-subkey (g) [KEYID] generate an authentication subkey --length (-l) BITS key length in bits (2048) - ssh-proxycommand monkeysphere ssh ProxyCommand - subkey-to-ssh-agent (s) store authentication subkey in ssh-agent + version (v) show version number help (h,?) this help @@ -59,6 +65,23 @@ gpg_user() { gpg --no-greeting --quiet --no-tty "$@" } +# output the ssh fingerprint of a gpg key +gpg_ssh_fingerprint() { + keyid="$1" + local tmpfile=$(msmktempfile) + + # trap to remove tmp file if break + trap "rm -f $tmpfile" EXIT + + # use temporary file, since ssh-keygen won't accept keys on stdin + gpg_user --export "$keyid" --no-armor | openpgp2ssh "$keyid" >"$tmpfile" + ssh-keygen -l -f "$tmpfile" | awk '{ print $1, $2, $4 }' + + # remove the tmp file + trap - EXIT + rm -rf "$tmpfile" +} + # take a secret key ID and check that only zero or one ID is provided, # and that it corresponds to only a single secret key ID check_gpg_sec_key_id() { @@ -69,7 +92,7 @@ check_gpg_sec_key_id() { gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons 2>/dev/null | egrep '^sec:') ;; 1) - gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons "$keyID" | egrep '^sec:') || failure + gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons "$1" | egrep '^sec:') || failure ;; *) failure "You must specify only a single primary key ID." @@ -86,10 +109,10 @@ check_gpg_sec_key_id() { echo "$gpgSecOut" | cut -d: -f5 ;; *) - echo "Multiple primary secret keys found:" - echo "$gpgSecOut" | cut -d: -f5 - echo "Please specify which primary key to use." - failure + local seckeys=$(echo "$gpgSecOut" | cut -d: -f5) + failure "Multiple primary secret keys found: +$seckeys +Please specify which primary key to use." ;; esac } @@ -123,8 +146,9 @@ check_gpg_authentication_subkey() { # if authentication key is valid, prompt to continue if [ "$validity" = 'u' ] ; then echo "A valid authentication key already exists for primary key '$keyID'." 1>&2 - if [ "$PROMPT" = "true" ] ; then - read -p "Are you sure you would like to generate another one? (y/N) " OK; OK=${OK:N} + if [ "$PROMPT" != "false" ] ; then + printf "Are you sure you would like to generate another one? (y/N) " >&2 + read OK; OK=${OK:N} if [ "${OK/y/Y}" != 'Y' ] ; then failure "aborting." fi @@ -176,21 +200,30 @@ PROMPT=${MONKEYSPHERE_PROMPT:=$PROMPT} KNOWN_HOSTS=${MONKEYSPHERE_KNOWN_HOSTS:=$KNOWN_HOSTS} HASH_KNOWN_HOSTS=${MONKEYSPHERE_HASH_KNOWN_HOSTS:=$HASH_KNOWN_HOSTS} AUTHORIZED_KEYS=${MONKEYSPHERE_AUTHORIZED_KEYS:=$AUTHORIZED_KEYS} +STRICT_MODES=${MONKEYSPHERE_STRICT_MODES:=$STRICT_MODES} # other variables not in config file AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:="${MONKEYSPHERE_HOME}/authorized_user_ids"} REQUIRED_HOST_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_HOST_KEY_CAPABILITY:="a"} REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"} +# note that only using '=' instead of ':=' tests only if the variable +# in unset, not if it's "null" +LOG_PREFIX=${MONKEYSPHERE_LOG_PREFIX='ms: '} # export GNUPGHOME and make sure gpg home exists with proper # permissions export GNUPGHOME mkdir -p -m 0700 "$GNUPGHOME" export LOG_LEVEL +export LOG_PREFIX + +if [ "$#" -eq 0 ] ; then + usage + failure "Please supply a subcommand." +fi # get subcommand COMMAND="$1" -[ "$COMMAND" ] || failure "Type '$PGRM help' for usage." shift case $COMMAND in @@ -218,7 +251,7 @@ case $COMMAND in process_authorized_user_ids "$AUTHORIZED_USER_IDS" ;; - 'import-subkey'|'i') + 'import-subkey'|'import'|'i') source "${MSHAREDIR}/import_subkey" import_subkey "$@" ;; @@ -238,16 +271,47 @@ case $COMMAND in subkey_to_ssh_agent "$@" ;; - 'version'|'v') - echo "$VERSION" + 'sshfpr') + echo "Warning: 'sshfpr' is deprecated. Please use 'sshfprs-for-userid' instead." >&2 + gpg_ssh_fingerprint "$@" + ;; + + 'keys-for-userid'|'u') + CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}} + keys_for_userid "$@" + ;; + + 'sshfprs-for-userid') + CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}} + keytmpdir=$(msmktempdir) + # use a file named " " to avoid arbitrary non-whitespace text + # in the fingerprint output + keytmpfile="$keytmpdir/ " + cd "$keytmpdir" + keys_for_userid "$@" | while read KEYLINE ; do + printf '%s\n' "$KEYLINE" > "$keytmpdir/ " + ssh-keygen -l -f ' ' + done + rm -f "$keytmpfile" + rmdir "$keytmpdir" + ;; + + 'keys-from-userid') + echo "Warning: 'keys-from-userid' is deprecated. Please use 'keys-for-userid' instead." >&2 + CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}} + keys_for_userid "$@" + ;; + + 'version'|'--version'|'v') + version ;; - '--help'|'help'|'-h'|'h'|'?') + 'help'|'--help'|'-h'|'h'|'?') usage ;; *) failure "Unknown command: '$COMMAND' -Type '$PGRM help' for usage." +Try '$PGRM help' for usage." ;; esac