X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere-server;h=99e5f8007c5b3cba871c76eb685c2648e788002d;hb=ec9ded739045d9532fbc4883bbeb37f7aa940ac6;hp=31bce7da81ac31de8f333879cd0a5b31e128a83b;hpb=8cf936aa9d62f6e8655904375a2d8217f559947a;p=monkeysphere.git diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 31bce7d..99e5f80 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -4,6 +4,7 @@ # # The monkeysphere scripts are written by: # Jameson Rollins +# Daniel Kahn Gillmor # # They are Copyright 2008, and are all released under the GPL, version 3 # or later. @@ -40,26 +41,27 @@ subcommands: update-users (u) [USER]... update user authorized_keys files gen-key (g) [NAME[:PORT]] generate gpg key for the server - -l|--length BITS key length in bits (2048) - -e|--expire EXPIRE date to expire - -r|--revoker FINGERPRINT add a revoker + --length (-l) BITS key length in bits (2048) + --expire (-e) EXPIRE date to expire + --revoker (-r) FINGERPRINT add a revoker + extend-key (e) EXPIRE extend expiration to EXPIRE add-hostname (n+) NAME[:PORT] add hostname user ID to server key revoke-hostname (n-) NAME[:PORT] revoke hostname user ID show-key (s) output all server host key information - fingerprint (f) output just the key fingerprint publish-key (p) publish server host key to keyserver diagnostics (d) report on server monkeysphere status add-id-certifier (c+) KEYID import and tsign a certification key - -n|--domain DOMAIN limit ID certifications to DOMAIN - -t|--trust TRUST trust level of certifier (full) - -d|--depth DEPTH trust depth for certifier (1) + --domain (-n) DOMAIN limit ID certifications to DOMAIN + --trust (-t) TRUST trust level of certifier (full) + --depth (-d) DEPTH trust depth for certifier (1) remove-id-certifier (c-) KEYID remove a certification key list-id-certifiers (c) list certification keys gpg-authentication-cmd CMD gnupg-authentication command - -h|--help|help (h,?) this help + help (h,?) this help + EOF } @@ -102,15 +104,28 @@ gpg_authentication() { # output just key fingerprint fingerprint_server_key() { - gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \ + gpg_host --list-secret-keys --fingerprint \ + --with-colons --fixed-list-mode 2> /dev/null | \ grep '^fpr:' | head -1 | cut -d: -f10 } # output key information show_server_key() { local fingerprint + local tmpkey + fingerprint=$(fingerprint_server_key) - gpg_host --fingerprint --list-secret-key "$fingerprint" + gpg_authentication "--fingerprint --list-key $fingerprint" + + # dumping to a file named ' ' so that the ssh-keygen output + # doesn't claim any potentially bogus hostname(s): + tmpkey=$(mktemp -d) + gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ " + echo -n "ssh fingerprint: " + (cd "$tmpkey" && ssh-keygen -l -f ' ') + rm -rf "$tmpkey" + echo -n "OpenPGP fingerprint: " + echo "$fingerprint" } # update authorized_keys for users @@ -294,22 +309,9 @@ gen_key() { # prompt about key expiration if not specified if [ -z "$keyExpire" ] ; then - cat < = key expires in n days - w = key expires in n weeks - m = key expires in n months - y = key expires in n years -EOF - while [ -z "$keyExpire" ] ; do - read -p "Key is valid for? (0) " keyExpire - if ! test_gpg_expire ${keyExpire:=0} ; then - echo "invalid value" - unset keyExpire - fi - done - elif ! test_gpg_expire "$keyExpire" ; then + keyExpire=$(get_gpg_expiration) + fi + if ! test_gpg_expire "$keyExpire" ; then failure "invalid key expiration value '$keyExpire'." fi @@ -371,10 +373,37 @@ EOF log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key" } +# extend the lifetime of a host key: +extend_key() { + local fpr=$(fingerprint_server_key) + local extendTo="$1" + + if [ -z "$fpr" ] ; then + failure "You don't appear to have a MonkeySphere host key on this server. Try 'monkeysphere-server gen-key' first." + fi + + if [ -z "$extendTo" ]; then + extendTo=$(get_gpg_expiration) + fi + if ! test_gpg_expire "$extendTo" ; then + failure "invalid expiration value '$extendTo'." + fi + + gpg_host --quiet --command-fd 0 --edit-key "$fpr" < /dev/null)" ] ; then + fingerprint=$(fingerprint_server_key) + + # match to only ultimately trusted user IDs + tmpuidMatch="u:$(echo $userID | gpg_escape)" + + # find the index of the requsted user ID + # NOTE: this is based on circumstantial evidence that the order of + # this output is the appropriate index + if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ + | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then failure "Host userID '$userID' already exists." fi echo "The following user ID will be added to the host key:" - echo " '$userID'" + echo " $userID" read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N} if [ ${OK/y/Y} != 'Y' ] ; then - failure "user ID not added." + failure "User ID not added." fi - fingerprint=$(fingerprint_server_key) - # edit-key script command to add user ID adduidCommand=$(cat < /dev/null | \ - egrep "^(uid|uat):" | cut -d: -f10 | gpg_unescape | cat -n | \ - grep "$userID" | awk '{ print $1 }') - - if [ -z "$uidIndex" ] ; then - failure "User ID '$userID' not found in host key." + if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ + | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then + uidIndex=${line%%:*} + else + failure "No non-revoked user ID '$userID' is found." fi - echo "The following user ID will be revoked from the host key:" - echo " '$userID'" + echo "The following host key user ID will be revoked:" + echo " $userID" read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N} if [ ${OK/y/Y} != 'Y' ] ; then - failure "user ID not revoked." + failure "User ID not revoked." fi + message="Hostname removed by monkeysphere-server $DATE" + # edit-key script command to revoke user ID revuidCommand=$(cat <