summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
fa49fb6)
Change default for user to be "a", and host to be "e a".
# MonkeySphere server configuration file.
# MonkeySphere server configuration file.
+# This is an sh-style shell configuration file. Variable names should
+# be separated from their assignements by a single '=' and no spaces.
+
# GPG home directory for server
#GNUPGHOME=/etc/monkeysphere/gnupg
# GPG keyserver to search for keys
#KEYSERVER=subkeys.pgp.net
# GPG home directory for server
#GNUPGHOME=/etc/monkeysphere/gnupg
# GPG keyserver to search for keys
#KEYSERVER=subkeys.pgp.net
-# Required key capabilities
+# Required user key capabilities
# Must be quoted, lowercase, space-seperated list of the following:
# e = encrypt
# s = sign
# c = certify
# a = authentication
# Must be quoted, lowercase, space-seperated list of the following:
# e = encrypt
# s = sign
# c = certify
# a = authentication
-#REQUIRED_KEY_CAPABILITY="e a"
+#REQUIRED_USER_KEY_CAPABILITY="a"
# Whether to add user controlled authorized_keys file to
# monkeysphere-generated authorized_keys file. Should be path to file
# Whether to add user controlled authorized_keys file to
# monkeysphere-generated authorized_keys file. Should be path to file
-# where '%h' will be substituted for the user's home directory.
+# where '%h' will be replaced by the home directory of the user.
#USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys
#USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys
# MonkeySphere system-wide client configuration file.
# MonkeySphere system-wide client configuration file.
+# This is an sh-style shell configuration file. Variable names should
+# be separated from their assignements by a single '=' and no spaces.
+
# authorized_user_ids file
#AUTHORIZED_USER_IDS=~/.config/monkeysphere/authorized_user_ids
# authorized_user_ids file
#AUTHORIZED_USER_IDS=~/.config/monkeysphere/authorized_user_ids
# s = sign
# c = certify
# a = authentication
# s = sign
# c = certify
# a = authentication
-#REQUIRED_KEY_CAPABILITY="e a"
+#REQUIRED_HOST_KEY_CAPABILITY="e a"
+#REQUIRED_USER_KEY_CAPABILITY="a"
# Path to user-controlled authorized_keys file to add to
# Monkeysphere-generated authorized_keys file. If empty, then no
# Path to user-controlled authorized_keys file to add to
# Monkeysphere-generated authorized_keys file. If empty, then no
-# Shared bash functions for the monkeysphere
+# Shared sh functions for the monkeysphere
#
# Written by
# Jameson Rollins <jrollins@fifthhorseman.net>
#
# Copyright 2008, released under the GPL, version 3 or later
#
# Written by
# Jameson Rollins <jrollins@fifthhorseman.net>
#
# Copyright 2008, released under the GPL, version 3 or later
-# all caps variables are meant to be user supplied (ie. from config
+# all-caps variables are meant to be user supplied (ie. from config
# file) and are considered global
########################################################################
# file) and are considered global
########################################################################
# userid and key policy checking
# the following checks policy on the returned keys
# - checks that full key has appropriate valididy (u|f)
# userid and key policy checking
# the following checks policy on the returned keys
# - checks that full key has appropriate valididy (u|f)
-# - checks key has specified capability (REQUIRED_KEY_CAPABILITY)
+# - checks key has specified capability (REQUIRED_*_KEY_CAPABILITY)
# - checks that particular desired user id has appropriate validity
# see /usr/share/doc/gnupg/DETAILS.gz
# expects global variable: "MODE"
process_user_id() {
local userID
local cacheDir
# - checks that particular desired user id has appropriate validity
# see /usr/share/doc/gnupg/DETAILS.gz
# expects global variable: "MODE"
process_user_id() {
local userID
local cacheDir
+ local requiredCapability
local requiredPubCapability
local gpgOut
local line
local requiredPubCapability
local gpgOut
local line
userID="$1"
cacheDir="$2"
userID="$1"
cacheDir="$2"
- requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]")
+ # set the required key capability based on the mode
+ if [ "$MODE" = 'known_hosts' ] ; then
+ requiredCapability="$REQUIRED_HOST_KEY_CAPABILITY"
+ elif [ "$MODE" = 'authorized_keys' ] ; then
+ requiredCapability="$REQUIRED_USER_KEY_CAPABILITY"
+ fi
+ requiredPubCapability=$(echo "$requiredCapability" | tr "[:lower:]" "[:upper:]")
# fetch keys from keyserver, return 1 if none found
gpg_fetch_userid "$userID" || return 1
# fetch keys from keyserver, return 1 if none found
gpg_fetch_userid "$userID" || return 1
keyOK=true
# add primary key ID to key list if it has required capability
keyOK=true
# add primary key ID to key list if it has required capability
- if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then
+ if check_capability "$capability" $requiredCapability ; then
keyIDs[${#keyIDs[*]}]="$keyid"
fi
;;
keyIDs[${#keyIDs[*]}]="$keyid"
fi
;;
;;
'sub') # sub keys
# add sub key ID to key list if it has required capability
;;
'sub') # sub keys
# add sub key ID to key list if it has required capability
- if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then
+ if check_capability "$capability" $requiredCapability ; then
keyIDs[${#keyIDs[*]}]="$keyid"
fi
;;
keyIDs[${#keyIDs[*]}]="$keyid"
fi
;;
update_userid() {
local userID
local cacheDir
update_userid() {
local userID
local cacheDir
userID="$1"
cacheDir="$2"
log "processing userid: '$userID'"
userID="$1"
cacheDir="$2"
log "processing userid: '$userID'"
- userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
+ keyCachePath=$(process_user_id "$userID" "$cacheDir")
- if [ -z "$userIDKeyCache" ] ; then
+ if [ -z "$keyCachePath" ] ; then
return 1
fi
if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
return 1
fi
if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
process_host() {
local host
local cacheDir
process_host() {
local host
local cacheDir
host="$1"
cacheDir="$2"
log "processing host: '$host'"
host="$1"
cacheDir="$2"
log "processing host: '$host'"
- hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir")
+ keyCachePath=$(process_user_id "ssh://${host}" "$cacheDir")
if [ $? = 0 ] ; then
ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS"
if [ $? = 0 ] ; then
ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS"
- cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS"
+ cat "$keyCachePath" >> "$USER_KNOWN_HOSTS"
# EXPERIMENTAL (unused) process userids found in authorized_keys file
# go through line-by-line, extract monkeysphere userids from comment
# fields, and process each userid
# EXPERIMENTAL (unused) process userids found in authorized_keys file
# go through line-by-line, extract monkeysphere userids from comment
# fields, and process each userid
-process_userids_from_authorized_keys() {
+process_authorized_keys() {
local authorizedKeys
local cacheDir
local userID
local authorizedKeys
local cacheDir
local userID
AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
-REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"}
+REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"}
+REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"}
USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"}
# set empty config variable with defaults
GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg}
KEYSERVER=${KEYSERVER:-subkeys.pgp.net}
# set empty config variable with defaults
GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg}
KEYSERVER=${KEYSERVER:-subkeys.pgp.net}
-REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"}
+REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys}
export GNUPGHOME
USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys}
export GNUPGHOME