X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere-host;h=2dc6003c6cdd7904ad413ba3789681f80afd4991;hb=d2874b94fedbe6d043d44ca3562879251e6ea10f;hp=d6e4c686287a57c0782e33896c08d44200252247;hpb=b55981fb8aa689aede58ed7ab4d8692c52b5c472;p=monkeysphere.git diff --git a/src/monkeysphere-host b/src/monkeysphere-host index d6e4c68..2dc6003 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -37,8 +37,7 @@ MHTMPDIR="${MHDATADIR}/tmp" export MHTMPDIR # host pub key files -HOST_KEY_PUB="${SYSDATADIR}/ssh_host_rsa_key.pub" -HOST_KEY_PUB_GPG="${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" +HOST_KEY_FILE="${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" # UTC date in ISO 8601 format if needed DATE=$(date -u '+%FT%T') @@ -67,12 +66,12 @@ subcommands: revoke-key (r) revoke host key publish-key (p) publish host key to keyserver - expert run expert command - expert help expert command help + import-key (i) [NAME[:PORT]] import existing ssh key to gpg version (v) show version number help (h,?) this help +See ${PGRM}(8) for more info. EOF } @@ -90,36 +89,32 @@ gpg_host_list() { } # command for edit key scripts, takes scripts on stdin +# FIXME: should we supress all the edit script spew? or pipe it +# through log debug? gpg_host_edit() { gpg_host --quiet --command-fd 0 --edit-key \ "0x${HOST_FINGERPRINT}!" "$@" } -# export the host key to stdout -gpg_host_export() { - gpg_host --export --armor --export-options export-minimal \ - "0x${HOST_FINGERPRINT}!" -} - # export the host public key to the monkeysphere gpg pub key file -create_gpg_pub_file() { - log debug "creating openpgp public key file..." - gpg_host_export > "$HOST_KEY_PUB_GPG" - log info "GPG host public key file: $HOST_KEY_PUB_GPG" +update_gpg_pub_file() { + log debug "updating openpgp public key file '$HOST_KEY_FILE'..." + gpg_host --export --armor --export-options export-minimal \ + "0x${HOST_FINGERPRINT}!" > "$HOST_KEY_FILE" } # load the host fingerprint into the fingerprint variable, using the # export gpg pub key file # FIXME: this seems much less than ideal, with all this temp keyring # stuff. is there a way we can do this without having to create temp -# files? +# files? what if we stored the fingerprint in MHDATADIR/fingerprint? load_fingerprint() { - if [ -f "$HOST_KEY_PUB_GPG" ] ; then + if [ -f "$HOST_KEY_FILE" ] ; then HOST_FINGERPRINT=$( \ (FUBAR=$(mktemp -d) && export GNUPGHOME="$FUBAR" \ && gpg --quiet --import \ && gpg --quiet --list-keys --with-colons --with-fingerprint \ - && rm -rf "$FUBAR") <"$HOST_KEY_PUB_GPG" \ + && rm -rf "$FUBAR") <"$HOST_KEY_FILE" \ | grep '^fpr:' | cut -d: -f10 ) else HOST_FINGERPRINT= @@ -135,23 +130,17 @@ load_fingerprint_secret() { | grep '^fpr:' | cut -d: -f10 ) } -# output host key ssh fingerprint -load_ssh_fingerprint() { - [ -f "$HOST_KEY_PUB" ] || return 0 - HOST_FINGERPRINT_SSH=$(ssh-keygen -l -f "$HOST_KEY_PUB" \ - | awk '{ print $1, $2, $4 }') -} - # fail if host key present check_host_key() { - [ -z "$HOST_FINGERPRINT" ] \ + [ ! -s "$HOST_KEY_FILE" ] \ || failure "An OpenPGP host key already exists." } # fail if host key not present check_host_no_key() { - [ "$HOST_FINGERPRINT" ] \ - || failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-host expert import-key' first." + [ -s "$HOST_KEY_FILE" ] \ + || failure "You don't appear to have a Monkeysphere host key on this server. +Please run 'monkeysphere-host import-key' first." } # output the index of a user ID on the host key @@ -180,30 +169,52 @@ find_host_userid() { # show info about the host key show_key() { - gpg_host --fingerprint --list-key --list-options show-unusable-uids \ - "0x${HOST_FINGERPRINT}!" 2>/dev/null || true - # FIXME: make sure expiration date is shown + local GNUPGHOME - echo "OpenPGP fingerprint: $HOST_FINGERPRINT" + # tmp gpghome dir + export GNUPGHOME=$(mktemp -d) - load_ssh_fingerprint + # trap to remove tmp dir if break + trap "rm -rf $GNUPGHOME" EXIT - if [ "$HOST_FINGERPRINT_SSH" ] ; then - echo "ssh fingerprint: $HOST_FINGERPRINT_SSH" - else - log error "SSH host key not found." - fi + # import the host key into the tmp dir + gpg --quiet --import <"$HOST_KEY_FILE" + + HOST_FINGERPRINT=$(gpg --quiet --list-keys --with-colons --with-fingerprint \ + | grep '^fpr:' | cut -d: -f10 ) - # FIXME: other relevant key parameters? + # list the host key info + # FIXME: make no-show-keyring work so we don't have to do the grep'ing + # FIXME: can we show uid validity somehow? + gpg --list-keys --fingerprint \ + --list-options show-unusable-uids 2>/dev/null \ + | grep -v "^${GNUPGHOME}/pubring.gpg$" \ + | egrep -v '^-+$' + + # list the pgp fingerprint + echo "OpenPGP fingerprint: $HOST_FINGERPRINT" + + # list the ssh fingerprint + echo -n "ssh fingerprint: " + ssh-keygen -l -f /dev/stdin \ + <<<$(openpgp2ssh <"$HOST_KEY_FILE" 2>/dev/null) \ + | awk '{ print $1, $2, $4 }' + + # remove the tmp file + trap - EXIT + rm -rf "$GNUPGHOME" } ######################################################################## # MAIN ######################################################################## -# unset variables that should be defined only in config file +# unset variables that should be defined only in config file of in +# MONKEYSPHERE_ variables +unset LOG_LEVEL unset KEYSERVER unset MONKEYSPHERE_USER +unset PROMPT # load configuration file [ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] && . "$MONKEYSPHERE_HOST_CONFIG" @@ -212,9 +223,8 @@ unset MONKEYSPHERE_USER # defaults LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=${LOG_LEVEL:="INFO"}} KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="pool.sks-keyservers.net"}} -AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:=${AUTHORIZED_USER_IDS:="%h/.monkeysphere/authorized_user_ids"}} -RAW_AUTHORIZED_KEYS=${MONKEYSPHERE_RAW_AUTHORIZED_KEYS:=${RAW_AUTHORIZED_KEYS:="%h/.ssh/authorized_keys"}} MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkeysphere"}} +PROMPT=${MONKEYSPHERE_PROMPT:=${PROMPT:="true"}} # other variables CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"} @@ -224,12 +234,13 @@ GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"} export DATE export MODE export LOG_LEVEL -export MONKEYSPHERE_USER export KEYSERVER +export MONKEYSPHERE_USER +export PROMPT +export CHECK_KEYSERVER export GNUPGHOME_HOST export GNUPGHOME export HOST_FINGERPRINT= -export HOST_FINGERPRINT_SSH= # get subcommand COMMAND="$1" @@ -238,94 +249,62 @@ shift case $COMMAND in 'show-key'|'show'|'s') - load_fingerprint check_host_no_key show_key ;; 'set-expire'|'extend-key'|'e') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/set_expire" set_expire "$@" ;; 'add-hostname'|'add-name'|'n+') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/add_hostname" add_hostname "$@" ;; 'revoke-hostname'|'revoke-name'|'n-') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/revoke_hostname" revoke_hostname "$@" ;; 'add-revoker'|'o') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/add_revoker" add_revoker "$@" ;; 'revoke-key'|'r') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/revoke_key" revoke_key "$@" ;; 'publish-key'|'publish'|'p') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/publish_key" publish_key ;; - 'expert') - SUBCOMMAND="$1" - shift - case "$SUBCOMMAND" in - 'help'|'h'|'?') - cat < [options] [args] - -expert subcommands: - import-key (i) FILE [NAME[:PORT]] import existing ssh key to gpg - gen-key (g) [NAME[:PORT]] generate gpg key for the host - --length (-l) BITS key length in bits (2048) - diagnostics (d) monkeysphere host status + 'import-key'|'i') + check_host_key + source "${MHSHAREDIR}/import_key" + import_key "$@" + ;; -EOF - ;; - - 'import-key'|'i') - load_fingerprint - check_host_key - source "${MHSHAREDIR}/import_key" - import_key "$@" - ;; - - 'gen-key'|'g') - load_fingerprint - check_host_key - source "${MHSHAREDIR}/gen_key" - gen_key "$@" - ;; - - 'diagnostics'|'d') - source "${MHSHAREDIR}/diagnostics" - diagnostics - ;; - - *) - failure "Unknown expert subcommand: '$COMMAND' -Type '$PGRM help' for usage." - ;; - esac + 'diagnostics'|'d') + load_fingerprint + source "${MHSHAREDIR}/diagnostics" + diagnostics ;; 'version'|'v')