X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere-host;h=9e73ad20debd75f516b0b6d82524a05c6bbb5c4b;hb=2ab50bee3f2cc4030cb4555b6c9644e3c206141e;hp=ff28486a1b8f7ec36342a25508935c77948e0fb1;hpb=26ff353050a173bea139cce630d47b91ee2b95b6;p=monkeysphere.git diff --git a/src/monkeysphere-host b/src/monkeysphere-host index ff28486..9e73ad2 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -32,10 +32,6 @@ MHSHAREDIR="${SYSSHAREDIR}/mh" # datadir for host functions MHDATADIR="${SYSDATADIR}/host" -# temp directory for temp gnupghome directories for add_revoker -MHTMPDIR="${MHDATADIR}/tmp" -export MHTMPDIR - # host pub key files HOST_KEY_FILE="${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" @@ -58,6 +54,7 @@ usage: $PGRM [options] [args] Monkeysphere host admin tool. subcommands: + import-key (i) [NAME[:PORT]] import existing ssh key to gpg show-key (s) output all host key information set-expire (e) EXPIRE set host key expiration add-hostname (n+) NAME[:PORT] add hostname user ID to host key @@ -66,8 +63,6 @@ subcommands: revoke-key (r) revoke host key publish-key (p) publish host key to keyserver - import-key (i) [NAME[:PORT]] import existing ssh key to gpg - version (v) show version number help (h,?) this help @@ -77,10 +72,11 @@ EOF # function to interact with the gpg keyring gpg_host() { - GNUPGHOME="$GNUPGHOME_HOST" gpg "$@" + GNUPGHOME="$GNUPGHOME_HOST" gpg --no-greeting --quiet --no-tty "$@" } -# command to list the info about the host key, in colon format +# command to list the info about the host key, in colon format, to +# stdout gpg_host_list() { gpg_host --list-keys --with-colons --fixed-list-mode \ --with-fingerprint --with-fingerprint \ @@ -90,23 +86,21 @@ gpg_host_list() { # command for edit key scripts, takes scripts on stdin gpg_host_edit() { - gpg_host --quiet --command-fd 0 --edit-key \ - "0x${HOST_FINGERPRINT}!" "$@" + gpg_host --command-fd 0 --edit-key "0x${HOST_FINGERPRINT}!" "$@" } # export the host public key to the monkeysphere gpg pub key file -create_gpg_pub_file() { - log debug "creating openpgp public key file..." +update_gpg_pub_file() { + log debug "updating openpgp public key file '$HOST_KEY_FILE'..." gpg_host --export --armor --export-options export-minimal \ "0x${HOST_FINGERPRINT}!" > "$HOST_KEY_FILE" - log info "GPG host public key file: $HOST_KEY_FILE" } # load the host fingerprint into the fingerprint variable, using the # export gpg pub key file # FIXME: this seems much less than ideal, with all this temp keyring # stuff. is there a way we can do this without having to create temp -# files? +# files? what if we stored the fingerprint in MHDATADIR/fingerprint? load_fingerprint() { if [ -f "$HOST_KEY_FILE" ] ; then HOST_FINGERPRINT=$( \ @@ -124,21 +118,21 @@ load_fingerprint() { # gpg host secret key load_fingerprint_secret() { HOST_FINGERPRINT=$( \ - gpg_host --quiet --list-secret-key \ - --with-colons --with-fingerprint \ + gpg_host --list-secret-key --with-colons --with-fingerprint \ | grep '^fpr:' | cut -d: -f10 ) } # fail if host key present check_host_key() { - [ -z "$HOST_FINGERPRINT" ] \ + [ ! -s "$HOST_KEY_FILE" ] \ || failure "An OpenPGP host key already exists." } # fail if host key not present check_host_no_key() { - [ "$HOST_FINGERPRINT" ] \ - || failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-host expert import-key' first." + [ -s "$HOST_KEY_FILE" ] \ + || failure "You don't appear to have a Monkeysphere host key on this server. +Please run 'monkeysphere-host import-key...' first." } # output the index of a user ID on the host key @@ -167,52 +161,71 @@ find_host_userid() { # show info about the host key show_key() { - gpg_host --fingerprint --list-key --list-options show-unusable-uids \ - "0x${HOST_FINGERPRINT}!" 2>/dev/null || true - # FIXME: make sure expiration date is shown + local GNUPGHOME + # tmp gpghome dir + export GNUPGHOME=$(msmktempdir) + + # trap to remove tmp dir if break + trap "rm -rf $GNUPGHOME" EXIT + + # import the host key into the tmp dir + gpg --quiet --import <"$HOST_KEY_FILE" + + HOST_FINGERPRINT=$(gpg --quiet --list-keys --with-colons --with-fingerprint \ + | grep '^fpr:' | cut -d: -f10 ) + + # list the host key info + # FIXME: make no-show-keyring work so we don't have to do the grep'ing + # FIXME: can we show uid validity somehow? + gpg --list-keys --fingerprint \ + --list-options show-unusable-uids 2>/dev/null \ + | grep -v "^${GNUPGHOME}/pubring.gpg$" \ + | egrep -v '^-+$' + + # list the pgp fingerprint echo "OpenPGP fingerprint: $HOST_FINGERPRINT" + # list the ssh fingerprint echo -n "ssh fingerprint: " ssh-keygen -l -f /dev/stdin \ <<<$(openpgp2ssh <"$HOST_KEY_FILE" 2>/dev/null) \ | awk '{ print $1, $2, $4 }' - # FIXME: other relevant key parameters? + # remove the tmp file + trap - EXIT + rm -rf "$GNUPGHOME" } ######################################################################## # MAIN ######################################################################## -# unset variables that should be defined only in config file -unset KEYSERVER -unset MONKEYSPHERE_USER - # load configuration file -[ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] && . "$MONKEYSPHERE_HOST_CONFIG" +[ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] \ + && . "$MONKEYSPHERE_HOST_CONFIG" # set empty config variable with ones from the environment, or with # defaults -LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=${LOG_LEVEL:="INFO"}} -KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="pool.sks-keyservers.net"}} -AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:=${AUTHORIZED_USER_IDS:="%h/.monkeysphere/authorized_user_ids"}} -RAW_AUTHORIZED_KEYS=${MONKEYSPHERE_RAW_AUTHORIZED_KEYS:=${RAW_AUTHORIZED_KEYS:="%h/.ssh/authorized_keys"}} -MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkeysphere"}} +LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=$LOG_LEVEL} +KEYSERVER=${MONKEYSPHERE_KEYSERVER:=$KEYSERVER} +CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=$CHECK_KEYSERVER} +MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=$MONKEYSPHERE_USER} +PROMPT=${MONKEYSPHERE_PROMPT:=$PROMPT} # other variables -CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"} GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"} # export variables needed in su invocation export DATE -export MODE export LOG_LEVEL -export MONKEYSPHERE_USER export KEYSERVER +export CHECK_KEYSERVER +export MONKEYSPHERE_USER +export PROMPT export GNUPGHOME_HOST export GNUPGHOME -export HOST_FINGERPRINT= +export HOST_FINGERPRINT # get subcommand COMMAND="$1" @@ -221,65 +234,68 @@ shift case $COMMAND in 'show-key'|'show'|'s') - load_fingerprint check_host_no_key show_key ;; 'set-expire'|'extend-key'|'e') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/set_expire" set_expire "$@" ;; 'add-hostname'|'add-name'|'n+') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/add_hostname" add_hostname "$@" ;; 'revoke-hostname'|'revoke-name'|'n-') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/revoke_hostname" revoke_hostname "$@" ;; 'add-revoker'|'o') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/add_revoker" add_revoker "$@" ;; 'revoke-key'|'r') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/revoke_key" revoke_key "$@" ;; 'publish-key'|'publish'|'p') - load_fingerprint check_host_no_key + load_fingerprint source "${MHSHAREDIR}/publish_key" publish_key ;; 'import-key'|'i') - load_fingerprint check_host_key source "${MHSHAREDIR}/import_key" import_key "$@" ;; 'diagnostics'|'d') + load_fingerprint source "${MHSHAREDIR}/diagnostics" diagnostics ;; + 'update-gpg-pub-file') + update_gpg_pub_file + ;; + 'version'|'v') echo "$VERSION" ;;