X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere-host;h=3f4a43467086e33621b17c30104f37edcb09b46b;hb=89e447e2001c0406fab6d2e6ca300a19d492435b;hp=94392647c32693ce74bce898debcfd818e69170b;hpb=26bdfd9c0aa0853ca1ea80e1980e7e9849646e10;p=monkeysphere.git diff --git a/src/monkeysphere-host b/src/monkeysphere-host index 9439264..3f4a434 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -3,12 +3,13 @@ # monkeysphere-host: Monkeysphere host admin tool # # The monkeysphere scripts are written by: -# Jameson Rollins +# Jameson Rollins # Jamie McClelland # Daniel Kahn Gillmor +# Micah Anderson # -# They are Copyright 2008, and are all released under the GPL, version 3 -# or later. +# They are Copyright 2008-2009, and are all released under the GPL, +# version 3 or later. ######################################################################## PGRM=$(basename $0) @@ -17,9 +18,15 @@ SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"} export SYSSHAREDIR . "${SYSSHAREDIR}/common" || exit 1 -SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere/host"} +SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"} export SYSDATADIR +# sharedir for host functions +MHSHAREDIR="${SYSSHAREDIR}/mh" + +# datadir for host functions +MHDATADIR="${SYSDATADIR}/host" + # UTC date in ISO 8601 format if needed DATE=$(date -u '+%FT%T') @@ -47,14 +54,8 @@ subcommands: revoke-key (r) revoke host key publish-key (p) publish server host key to keyserver - expert - import-key (i) NAME[:PORT] import existing ssh key to gpg - --keyfile (-f) FILE key file to import - --expire (-e) EXPIRE date to expire - gen-key (g) NAME[:PORT] generate gpg key for the host - --length (-l) BITS key length in bits (2048) - --expire (-e) EXPIRE date to expire - diagnostics (d) monkeysphere host status + expert run expert command + expert help expert command help version (v) show version number help (h,?) this help @@ -75,7 +76,7 @@ su_monkeysphere_user() { fi } -# function to interact with the host gnupg keyring +# function to interact with the gpg keyring gpg_host() { local returnCode @@ -86,15 +87,7 @@ gpg_host() { # user to be able to read the host pubring. we realize this might # be problematic, but it's the simplest solution, without too much # loss of security. - gpg --no-permission-warning "$@" - returnCode="$?" - - # always reset the permissions on the host pubring so that the - # monkeysphere user can read the trust signatures - chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_HOST}/pubring.gpg" - chmod g+r "${GNUPGHOME_HOST}/pubring.gpg" - - return "$returnCode" + gpg "$@" } # output just key fingerprint @@ -117,29 +110,20 @@ check_host_keyring() { show_key() { local fingerprintPGP local fingerprintSSH - local ret=0 # FIXME: you shouldn't have to be root to see the host key fingerprint - if is_root ; then - check_host_keyring - fingerprintPGP=$(fingerprint_server_key) - gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null - echo "OpenPGP fingerprint: $fingerprintPGP" - else - log info "You must be root to see host OpenPGP fingerprint." - ret='1' - fi + check_host_keyring + fingerprintPGP=$(fingerprint_server_key) + gpg_host "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null + echo "OpenPGP fingerprint: $fingerprintPGP" - if [ -f "${SYSDATADIR}/ssh_host_rsa_key.pub" ] ; then - fingerprintSSH=$(ssh-keygen -l -f "${SYSDATADIR}/ssh_host_rsa_key.pub" | \ + if [ -f "${MHDATADIR}/ssh_host_rsa_key.pub" ] ; then + fingerprintSSH=$(ssh-keygen -l -f "${MHDATADIR}/ssh_host_rsa_key.pub" | \ awk '{ print $1, $2, $4 }') echo "ssh fingerprint: $fingerprintSSH" else log info "SSH host key not found." - ret='1' fi - -return $ret } ######################################################################## @@ -148,12 +132,10 @@ return $ret # unset variables that should be defined only in config file unset KEYSERVER -unset AUTHORIZED_USER_IDS -unset RAW_AUTHORIZED_KEYS unset MONKEYSPHERE_USER # load configuration file -[ -e ${MONKEYSPHERE_SERVER_CONFIG:="${SYSCONFIGDIR}/monkeysphere-server.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG" +[ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] && . "$MONKEYSPHERE_HOST_CONFIG" # set empty config variable with ones from the environment, or with # defaults @@ -165,20 +147,15 @@ MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkey # other variables CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"} -REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"} -GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${SYSDATADIR}/gnupg-host"} -GNUPGHOME_AUTHENTICATION=${MONKEYSPHERE_GNUPGHOME_AUTHENTICATION:="${SYSDATADIR}/gnupg-authentication"} +GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"} # export variables needed in su invocation export DATE export MODE -export MONKEYSPHERE_USER export LOG_LEVEL +export MONKEYSPHERE_USER export KEYSERVER -export CHECK_KEYSERVER -export REQUIRED_USER_KEY_CAPABILITY export GNUPGHOME_HOST -export GNUPGHOME_AUTHENTICATION export GNUPGHOME # get subcommand @@ -188,53 +165,78 @@ shift case $COMMAND in 'show-key'|'show'|'s') - show_server_key + check_host_keyring + show_key ;; 'extend-key'|'e') check_host_keyring + source "${MHSHAREDIR}/extend_key" extend_key "$@" ;; 'add-hostname'|'add-name'|'n+') check_host_keyring + source "${MHSHAREDIR}/add_hostname" add_hostname "$@" ;; 'revoke-hostname'|'revoke-name'|'n-') check_host_keyring + source "${MHSHAREDIR}/revoke_hostname" revoke_hostname "$@" ;; 'add-revoker'|'o') check_host_keyring + source "${MHSHAREDIR}/add_revoker" add_revoker "$@" ;; 'revoke-key'|'r') check_host_keyring + source "${MHSHAREDIR}/revoke_key" revoke_key "$@" ;; 'publish-key'|'publish'|'p') check_host_keyring - publish_server_key + source "${MHSHAREDIR}/publish_key" + publish_key ;; 'expert'|'e') - check_user SUBCOMMAND="$1" shift case "$SUBCOMMAND" in + 'help'|'h'|'?') + cat < [options] [args] + +expert subcommands: + import-key (i) [NAME[:PORT]] import existing ssh key to gpg + --keyfile (-f) FILE key file to import + --expire (-e) EXPIRE date to expire + gen-key (g) [NAME[:PORT]] generate gpg key for the host + --length (-l) BITS key length in bits (2048) + --expire (-e) EXPIRE date to expire + diagnostics (d) monkeysphere host status + +EOF + ;; + 'import-key'|'i') + source "${MHSHAREDIR}/import_key" import_key "$@" ;; 'gen-key'|'g') + source "${MHSHAREDIR}/gen_key" gen_key "$@" ;; 'diagnostics'|'d') + source "${MHSHAREDIR}/diagnostics" diagnostics ;;