X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere-server;h=154c1462915739110f2af49269d05b43caa6ed11;hb=1fa2912aac2636bc6a4d8eda089c0e285f88d141;hp=fd7b58330ae6fc58a5696958ccbb122713e99bdd;hpb=be186e427ac34812e2b2a55489ae55fe2341f6a0;p=monkeysphere.git diff --git a/src/monkeysphere-server b/src/monkeysphere-server index fd7b583..154c146 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # monkeysphere-server: MonkeySphere server admin tool # @@ -28,36 +28,66 @@ GREP_OPTIONS= usage() { cat < [args] -Monkeysphere server admin tool. +MonkeySphere server admin tool. subcommands: - update-users (s) [USER]... update user authorized_keys file - gen-key (g) generate gpg key for the server - publish-key (p) publish server gpg to keyserver - trust-key (t) KEYID [KEYID]... mark keyid as trusted - update-user-userids (u) USER UID [UID]... add/update userid for user - help (h,?) this help + update-users (s) [USER]... update users authorized_keys files + gen-key (g) [HOSTNAME] generate gpg key for the server + show-fingerprint (f) show server's host key fingerprint + publish-key (p) publish server key to keyserver + trust-keys (t) KEYID... mark keyids as trusted + help (h,?) this help EOF } # generate server gpg key gen_key() { - KEY_TYPE=${KEY_TYPE:-RSA} - KEY_LENGTH=${KEY_LENGTH:-2048} - KEY_USAGE=${KEY_USAGE:-encrypt,auth} - SERVICE=${SERVICE:-ssh} - HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} + local hostName - USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} + hostName=${1:-$(hostname --fqdn)} - echo "key parameters:" + # set key defaults + KEY_TYPE=${KEY_TYPE:-"RSA"} + KEY_LENGTH=${KEY_LENGTH:-"2048"} + KEY_USAGE=${KEY_USAGE:-"auth"} cat < = key expires in n days + w = key expires in n weeks + m = key expires in n months + y = key expires in n years +EOF + read -p "Key is valid for? ($EXPIRE) " EXPIRE; EXPIRE=${EXPIRE:-"0"} + + SERVICE=${SERVICE:-"ssh"} + USERID=${USERID:-"$SERVICE"://"$hostName"} + + # set key parameters + keyParameters=$(cat < /dev/null | grep '^pub:' | cut -d: -f5) + log -n "generating server key... " + echo "$keyParameters" | gpg --batch --gen-key + loge "done." + fingerprint_server_key +} - # dummy command so as not to publish fakes keys during testing - # eventually: - #gpg --send-keys --keyserver "$KEYSERVER" "$keyID" - echo "gpg --send-keys --keyserver $KEYSERVER $keyID" +fingerprint_server_key() { + gpg --fingerprint --list-secret-keys =ssh://$(hostname --fqdn) } ######################################################################## @@ -109,104 +132,108 @@ MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere-server.conf} [ -e "$MS_CONF" ] && . "$MS_CONF" # set empty config variable with defaults -GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} -KEYSERVER=${KEYSERVER:-subkeys.pgp.net} -REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} -USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys} -STAGING_AREA=${STAGING_AREA:-"$LIB"/stage} +GNUPGHOME=${GNUPGHOME:-"${MS_HOME}/gnupg"} +KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} +CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"} +REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} +AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"%h/.config/monkeysphere/authorized_user_ids"} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"} export GNUPGHOME +# make sure the monkeysphere home directory exists +mkdir -p "${MS_HOME}/authorized_user_ids" # make sure gpg home exists with proper permissions mkdir -p -m 0700 "$GNUPGHOME" +# make sure the authorized_keys directory exists +mkdir -p "${CACHE}/authorized_keys" case $COMMAND in - 'update-users'|'s') + 'update-users'|'update-user'|'s') if [ "$1" ] ; then + # get users from command line unames="$@" else - unames=$(ls -1 "$MS_HOME"/authorized_user_ids) + # or just look at all users if none specified + unames=$(getent passwd | cut -d: -f1) fi + # loop over users for uname in $unames ; do MODE="authorized_keys" - authorizedUserIDs="$MS_HOME"/authorized_user_ids/"$uname" - cacheDir="$STAGING_AREA"/"$uname"/user_keys - msAuthorizedKeys="$STAGING_AREA"/"$uname"/authorized_keys - # make sure authorized_user_ids file exists - if [ ! -s "$authorizedUserIDs" ] ; then - log "authorized_user_ids file for '$uname' is empty or does not exist." + # set authorized_user_ids variable, + # translate ssh-style path variables + authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") + + # skip user if authorized_user_ids file does not exist + if [ ! -f "$authorizedUserIDs" ] ; then continue fi - log "processing authorized_keys for user '$uname'..." + log "----- user: $uname -----" - process_authorized_ids "$authorizedUserIDs" "$cacheDir" + # temporary authorized_keys file + AUTHORIZED_KEYS=$(mktemp) - # write output key file - log "writing monkeysphere authorized_keys file... " - touch "$msAuthorizedKeys" - if [ "$(ls "$cacheDir")" ] ; then - log -n "adding gpg keys... " - cat "$cacheDir"/* > "$msAuthorizedKeys" - echo "done." - else - log "no gpg keys to add." + # skip if the user's authorized_user_ids file is empty + if [ ! -s "$authorizedUserIDs" ] ; then + log "authorized_user_ids file '$authorizedUserIDs' is empty." + continue fi - if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then - userHome=$(getent passwd "$uname" | cut -d: -f6) - userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$userHome"} - if [ -s "$userAuthorizedKeys" ] ; then - log -n "adding user authorized_keys file... " - cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" - echo "done." + + # process authorized_user_ids file + log "processing authorized_user_ids file..." + process_authorized_user_ids "$authorizedUserIDs" + + # add user-controlled authorized_keys file path if specified + if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" != '-' ] ; then + userAuthorizedKeys=$(translate_ssh_variables "$uname" "$USER_CONTROLLED_AUTHORIZED_KEYS") + if [ -f "$userAuthorizedKeys" ] ; then + log -n "adding user's authorized_keys file... " + cat "$userAuthorizedKeys" >> "$AUTHORIZED_KEYS" + loge "done." fi fi - log "monkeysphere authorized_keys file generated:" - log "$msAuthorizedKeys" + + # move the temp authorized_keys file into place + mv -f "$AUTHORIZED_KEYS" "${CACHE}/authorized_keys/${uname}" + + log "authorized_keys file updated." done + + log "----- done. -----" ;; 'gen-key'|'g') - gen_key + gen_key "$1" + ;; + + 'show-fingerprint'|'f') + fingerprint_server_key ;; 'publish-key'|'p') - publish_key + publish_server_key ;; - 'trust-key'|'t') + 'trust-keys'|'trust-key'|'t') if [ -z "$1" ] ; then - failure "you must specify at least one key to trust." + failure "You must specify at least one key to trust." fi + + # process key IDs for keyID ; do trust_key "$keyID" done ;; - 'update-user-userids'|'u') - uname="$1" - shift - if [ -z "$uname" ] ; then - failure "you must specify user." - fi - if [ -z "$1" ] ; then - failure "you must specify at least one userid." - fi - AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" - userKeysCacheDir="$STAGING_AREA"/"$uname"/user_keys - for userID ; do - update_userid "$userID" "$userKeysCacheDir" - done - ;; - 'help'|'h'|'?') usage ;; *) failure "Unknown command: '$COMMAND' -Type 'cereal-admin help' for usage." +Type '$PGRM help' for usage." ;; esac