X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere-server;h=c4f69850c7650ca9928ad69e701aee45039c9ad0;hb=b024a2d3cacfe2fdb410daa830e04b2d9dfbcf4e;hp=6d57fc4b51a7a8dee648153806f6da9c3813071c;hpb=023b6d1e72f904a0f9147fa5c5a0dffa38be9461;p=monkeysphere.git

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 6d57fc4..c4f6985 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -20,6 +20,11 @@ export SYSSHAREDIR
 SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
 export SYSDATADIR
 
+# monkeysphere temp directory, in sysdatadir to enable atomic moves of
+# authorized_keys files
+MSTMPDIR="${SYSDATADIR}/tmp"
+export MSTMPDIR
+
 # UTC date in ISO 8601 format if needed
 DATE=$(date -u '+%FT%T')
 
@@ -66,8 +71,17 @@ subcommands:
 EOF
 }
 
+# function to run command as monkeysphere user
 su_monkeysphere_user() {
-    su "$MONKEYSPHERE_USER" -c "$@"
+    # if the current user is the monkeysphere user, then just eval
+    # command
+    if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then
+	eval "$@"
+
+    # otherwise su command as monkeysphere user
+    else
+	su "$MONKEYSPHERE_USER" -c "$@"
+    fi
 }
 
 # function to interact with the host gnupg keyring
@@ -103,6 +117,16 @@ gpg_authentication() {
     su_monkeysphere_user "gpg $@"
 }
 
+# function to check for host secret keys
+# fails if host sec key exists, exits true otherwise
+check_host_keyring() {
+    if ! gpg_host --list-secret-keys --fingerprint \
+	--with-colons --fixed-list-mode 2>/dev/null | grep -q '^sec:' ; then
+
+	failure "You don't appear to have a Monkeysphere host key on this server.  Please run 'monkeysphere-server gen-key' first."
+    fi
+}
+
 # output just key fingerprint
 fingerprint_server_key() {
     gpg_host --list-secret-keys --fingerprint \
@@ -118,13 +142,13 @@ show_server_key() {
     fingerprint=$(fingerprint_server_key)
     gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprint"
 
-    # dumping to a file named ' ' so that the ssh-keygen output
-    # doesn't claim any potentially bogus hostname(s):
-    tmpkey=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
-    gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ "
+    # do some crazy "Here Strings" redirection to get the key to
+    # ssh-keygen, since it doesn't read from stdin cleanly
     echo -n "ssh fingerprint: "
-    (cd "$tmpkey" && ssh-keygen -l -f ' ' | awk '{ print $2 }')
-    rm -rf "$tmpkey"
+    ssh-keygen -l -f /dev/stdin \
+	<<<$(gpg_authentication "--export $fingerprint" | \
+	openpgp2ssh "$fingerprint" 2>/dev/null) | \
+	awk '{ print $1, $2, $4 }'
     echo -n "OpenPGP fingerprint: "
     echo "$fingerprint"
 }
@@ -139,6 +163,8 @@ update_users() {
 	unames=$(getent passwd | cut -d: -f1)
     fi
 
+    RETCODE=0
+
     # set mode
     MODE="authorized_keys"
 
@@ -156,39 +182,15 @@ update_users() {
     # loop over users
     for uname in $unames ; do
 	# check all specified users exist
-	if ! getent passwd "$uname" >/dev/null ; then
+	if ! id "$uname" >/dev/null ; then
 	    log error "----- unknown user '$uname' -----"
 	    continue
 	fi
 
-	# set authorized_user_ids and raw authorized_keys variables,
-	# translating ssh-style path variables
-	authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
-	rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
-
-	# if neither is found, skip user
-	if [ ! -s "$authorizedUserIDs" ] ; then
-	    if [ "$rawAuthorizedKeys" = '-' -o ! -s "$rawAuthorizedKeys" ] ; then
-		continue
-	    fi
-	fi
-
 	log verbose "----- user: $uname -----"
 
-        # exit if the authorized_user_ids file is empty
-	if ! check_key_file_permissions "$uname" "$AUTHORIZED_USER_IDS" ; then
-	    log error "Improper permissions on path '$AUTHORIZED_USER_IDS'."
-	    continue
-	fi
-
-	# check permissions on the authorized_keys file path
-	if ! check_key_file_permissions "$uname" "$RAW_AUTHORIZED_KEYS" ; then
-	    log error "Improper permissions on path '$RAW_AUTHORIZED_KEYS'."
-	    continue
-	fi
-
         # make temporary directory
-        TMPLOC=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
+        TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
 
 	# trap to delete temporary directory on exit
 	trap "rm -rf $TMPLOC" EXIT
@@ -208,39 +210,81 @@ update_users() {
         chmod 0600 "$TMP_AUTHORIZED_USER_IDS"
         chown -R "$MONKEYSPHERE_USER" "$TMPLOC"
 
-	# if the authorized_user_ids file exists...
+	# process authorized_user_ids file
+	log debug "checking for authorized_user_ids..."
+	# translating ssh-style path variables
+	authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
 	if [ -s "$authorizedUserIDs" ] ; then
-            # copy user authorized_user_ids file to temporary
-            # location
-	    cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
-
-	    # export needed variables
-	    export AUTHORIZED_KEYS
-	    export TMP_AUTHORIZED_USER_IDS
-
-	    # process authorized_user_ids file, as monkeysphere
-	    # user
-	    su_monkeysphere_user \
-		". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
-	    RETURN="$?"
+	    # check permissions on the authorized_user_ids file path
+	    if check_key_file_permissions "$uname" "$authorizedUserIDs" ; then
+                # copy user authorized_user_ids file to temporary
+                # location
+		cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
+
+		# export needed variables
+		export AUTHORIZED_KEYS
+		export TMP_AUTHORIZED_USER_IDS
+
+		# process authorized_user_ids file, as monkeysphere
+		# user
+		su_monkeysphere_user \
+		    ". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
+		RETURN="$?"
+	    else
+		log debug "not processing authorized_user_ids."
+	    fi
+	else
+	    log debug "empty or absent authorized_user_ids file."
 	fi
 
-	# add user-controlled authorized_keys file path if specified
-	if [ "$rawAuthorizedKeys" != '-' -a -s "$rawAuthorizedKeys" ] ; then
-	    log verbose "adding raw authorized_keys file... "
-	    cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
+	# add user-controlled authorized_keys file if specified
+	# translate ssh-style path variables
+	rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
+	if [ "$rawAuthorizedKeys" != 'none' ] ; then
+	    log debug "checking for raw authorized_keys..."
+	    if [ -s "$rawAuthorizedKeys" ] ; then
+		# check permissions on the authorized_keys file path
+		if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then
+		    log verbose "adding raw authorized_keys file... "
+		    cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
+		else
+		    log debug "not adding raw authorized_keys file."		
+		fi
+	    else
+		log debug "empty or absent authorized_keys file."
+	    fi
 	fi
 
-	# openssh appears to check the contents of the
-        # authorized_keys file as the user in question, so the
-        # file must be readable by that user at least.
-	# FIXME: is there a better way to do this?
-	chown root "$AUTHORIZED_KEYS"
-	chgrp $(getent passwd "$uname" | cut -f4 -d:) "$AUTHORIZED_KEYS"
-	chmod g+r "$AUTHORIZED_KEYS"
+	# move the new authorized_keys file into place
+	if [ -s "$AUTHORIZED_KEYS" ] ; then
+	    # openssh appears to check the contents of the
+	    # authorized_keys file as the user in question, so the
+	    # file must be readable by that user at least.
+
+	    # but in general, we don't want the user tampering with
+	    # this file directly, so we'll adopt this approach: Own
+	    # the file by the monkeysphere-server invoker (usually
+	    # root, but should be the same uid that sshd is launched
+	    # as); change the group of the file so that members of the
+	    # user's group can read it.
+
+	    # FIXME: is there a better way to do this?
+	    chown $(whoami) "$AUTHORIZED_KEYS" && \
+		chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \
+		chmod g+r "$AUTHORIZED_KEYS" && \
+		mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \
+		{ 
+		log error "Failed to install authorized_keys for '$uname'!"
+		rm -f "${SYSDATADIR}/authorized_keys/${uname}"
+		# indicate that there has been a failure:
+		RETURN=1
+		}
+	else
+	    rm -f "${SYSDATADIR}/authorized_keys/${uname}"
+	fi
 
-	# move the resulting authorized_keys file into place
-	mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}"
+	# unset the trap
+	trap - EXIT
 
 	# destroy temporary directory
 	rm -rf "$TMPLOC"
@@ -303,6 +347,7 @@ gen_key() {
     userID="ssh://${hostName}"
 
     # check for presense of key with user ID
+    # FIXME: is this the proper test to be doing here?
     if gpg_host --list-key ="$userID" > /dev/null 2>&1 ; then
 	failure "Key for '$userID' already exists"
     fi
@@ -365,7 +410,11 @@ EOF
     (umask 077 && \
 	gpg_host --export-secret-key "$fingerprint" | \
 	openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key")
-    log info "Private SSH host key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+    log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
+    ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub"
+    log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub"
+    gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
+    log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg"
 }
 
 # extend the lifetime of a host key:
@@ -373,10 +422,6 @@ extend_key() {
     local fpr=$(fingerprint_server_key)
     local extendTo="$1"
 
-    if [ -z "$fpr" ] ; then
-	failure "You don't appear to have a MonkeySphere host key on this server.  Try 'monkeysphere-server gen-key' first."
-    fi
-
     # get the new expiration date
     extendTo=$(get_gpg_expiration "$extendTo")
 
@@ -671,6 +716,10 @@ diagnostics() {
 		echo " - Recommendation: remove the above HostKey lines from $sshd_config"
 		problemsfound=$(($problemsfound+1))
 	    fi
+
+        # FIXME: test (with ssh-keyscan?) that the running ssh
+        # daemon is actually offering the monkeysphere host key.
+
 	fi
     fi
 
@@ -817,9 +866,9 @@ add_certifier() {
     # export the key to the host keyring
     gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
 
-    if [ "$trust" == marginal ]; then
+    if [ "$trust" = marginal ]; then
 	trustval=1
-    elif [ "$trust" == full ]; then
+    elif [ "$trust" = full ]; then
 	trustval=2
     else
 	failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)."
@@ -922,7 +971,7 @@ unset MONKEYSPHERE_USER
 # set empty config variable with ones from the environment, or with
 # defaults
 LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=${LOG_LEVEL:="INFO"}}
-KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="subkeys.pgp.net"}}
+KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="pool.sks-keyservers.net"}}
 AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:=${AUTHORIZED_USER_IDS:="%h/.monkeysphere/authorized_user_ids"}}
 RAW_AUTHORIZED_KEYS=${MONKEYSPHERE_RAW_AUTHORIZED_KEYS:=${RAW_AUTHORIZED_KEYS:="%h/.ssh/authorized_keys"}}
 MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkeysphere"}}
@@ -952,6 +1001,7 @@ shift
 
 case $COMMAND in
     'update-users'|'update-user'|'u')
+	check_host_keyring
 	update_users "$@"
 	;;
 
@@ -960,22 +1010,27 @@ case $COMMAND in
 	;;
 
     'extend-key'|'e')
+	check_host_keyring
 	extend_key "$@"
 	;;
 
     'add-hostname'|'add-name'|'n+')
+	check_host_keyring
 	add_hostname "$@"
 	;;
 
     'revoke-hostname'|'revoke-name'|'n-')
+	check_host_keyring
 	revoke_hostname "$@"
 	;;
 
     'show-key'|'show'|'s')
+	check_host_keyring
 	show_server_key
 	;;
 
     'publish-key'|'publish'|'p')
+	check_host_keyring
 	publish_server_key
 	;;
 
@@ -984,14 +1039,17 @@ case $COMMAND in
 	;;
 
     'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
+	check_host_keyring
 	add_certifier "$@"
 	;;
 
     'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
+	check_host_keyring
 	remove_certifier "$@"
 	;;
 
     'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
+	check_host_keyring
 	list_certifiers "$@"
 	;;