Package: monkeysphere
Architecture: any
-Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), ${shlibs:Depends}
+Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), moreutils, ${shlibs:Depends}
Recommends: netcat
Enhances: openssh-client, openssh-server
Description: use the OpenPGP web of trust to verify ssh connections
usr/share/monkeysphere
var/cache/monkeysphere
etc/monkeysphere
+etc/monkeysphere/authorized_user_ids
.SH NAME
monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script
.PD
-.SH SYNOPSIS
-.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ...
-.PD
.SH DESCRIPTION
.PP
-MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh
-authentication and encryption. OpenPGP keys are tracked via GnuPG,
-and added to the ssh authorized_keys and known_hosts files to be used
-for authentication and encryption of ssh connection.
-
\fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used
to trigger a monkeysphere update of the known_hosts file for the hosts
-that are being connected to.
+that are being connected to. It is meant to be run as an ssh
+ProxyCommand. This can either be done by specifying the proxy command
+on the command line:
+
+.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ...
+
+or by adding the following line to your ~/.ssh/config script:
+
+.B ProxyCommand monkeysphere-ssh-proxycommand %h %p
+
+The script is very simple, and can easily be incorporated into other
+ProxyCommand scripts. All it does is first runs
+
+.B monkeysphere update-known-hosts HOST
+
+and then
+
+.B exec nc HOST PORT
+
+Run the following command for more info:
+
+.B less $(which monkeysphere-ssh-proxycommand)
.PD
.SH AUTHOR
Written by Jameson Rollins <jrollins@fifthhorseman.net>
place of `update-known_hosts'.
.TP
.B update-userids [USERID]...
-Add/update a userid in the authorized_user_ids file. The user IDs
+Add/update a user ID to the authorized_user_ids file. The user IDs
specified should be exact matches to OpenPGP user IDs. For each
specified user ID, gpg will be queried for a key associated with that
user ID, querying a keyserver if none is found in the user's keychain.
If a key is found, it will be added to the user_keys cache (see KEY
CACHES) and the user ID will be added to the user's
-authorized_user_ids file (if it wasn't already present).
+authorized_user_ids file (if it wasn't already present). `u' may be
+used in place of `update-userids'.
+.TP
+.B remove-userids [USERID]...
+Remove a user ID from the authorized_user_ids file. The user IDs
+specified should be exact matches to OpenPGP user IDs. `r' may be
+used in place of `remove-userids'.
.TP
.B update-authorized_keys
Update the monkeysphere authorized_keys file. The monkeysphere
authorized_keys file will be regenerated from the valid keys in the
user_key cache, and the user's independently controlled
-authorized_keys file (usually ~/.ssh/authorized_keys).
+authorized_keys file (usually ~/.ssh/authorized_keys). `a' may be
+used in place of `update-authorized_keys'.
.TP
.B gen-ae-subkey KEYID
Generate an `ae` capable subkey. For the primary key with the
specified key ID, generate a subkey with "authentication" and
"encryption" capability that can be used for MonkeySphere
-transactions.
+transactions. `g' may be used in place of `gen-ae-subkey'.
.TP
.B help
Output a brief usage summary. `h' or `?' may be used in place of
Update the admin-controlled authorized_keys files for user. For each
user specified, update the user's authorized_keys file in
/var/cache/monkeysphere/USER. See `man monkeysphere' for more info.
+`k' may be used in place of `update-known_hosts'.
.TP
.B gen-key
-Generate a gpg key for the host.
+Generate a gpg key for the host. `g' may be used in place of
+`gen-key'.
.TP
.B publish-key
-Publish the host's gpg key to a keyserver.
+Publish the host's gpg key to a keyserver. `p' may be used in place
+of `publish-key'
.TP
.B trust-keys KEYID...
-Mark key specified with KEYID with full owner trust.
+Mark key specified with KEYID with full owner trust. `t' may be used
+in place of `trust-keys'.
.TP
.B update-user-userids USER USERID...
-Add/update a userid in the authorized_user_ids file for USER.
+Add/update a user ID to the authorized_user_ids file for USER. `u' may
+be used in place of `update-user-userids'.
+.TP
+.B remove-user-userids USER USERID...
+Remove a user ID from the authorized_user_ids file for USER. `r' may
+be used in place of `remove-user-userids'.
.TP
.B help
Output a brief usage summary. `h' or `?' may be used in place of
exit ${2:-'1'}
}
-# write output to stdout
-log() {
- echo -n "ms: "
- echo "$@"
-}
-
# write output to stderr
-loge() {
+log() {
echo -n "ms: " 1>&2
echo "$@" 1>&2
}
# retrieve all keys with given user id from keyserver
# FIXME: need to figure out how to retrieve all matching keys
# (not just first 5)
-gpg_fetch_keys() {
+gpg_fetch_userid() {
local id
id="$1"
echo 1,2,3,4,5 | \
return 0
}
+# get the full fingerprint of a key ID
+get_key_fingerprint() {
+ local keyID
+
+ keyID="$1"
+
+ gpg --list-key --with-colons --fixed-list-mode \
+ --with-fingerprint "$keyID" | grep "$keyID" | \
+ grep '^fpr:' | cut -d: -f10
+}
+
+
# convert escaped characters from gpg output back into original
# character
# FIXME: undo all escape character translation in with-colons gpg output
requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]")
# fetch keys from keyserver, return 1 if none found
- gpg_fetch_keys "$userID" || return 1
+ gpg_fetch_userid "$userID" || return 1
# output gpg info for (exact) userid and store
gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \
# return 1 if there only "tru" lines are output from gpg
if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then
- loge " key not found."
+ log " key not found."
return 1
fi
# check primary key validity
if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
- loge " unacceptable primary key validity ($validity)."
+ log " unacceptable primary key validity ($validity)."
continue
fi
# check capability is not Disabled...
if check_capability "$capability" 'D' ; then
- loge " key disabled."
+ log " key disabled."
continue
fi
# check overall key capability
# must be Encryption and Authentication
if ! check_capability "$capability" $requiredPubCapability ; then
- loge " unacceptable primary key capability ($capability)."
+ log " unacceptable primary key capability ($capability)."
continue
fi
# hash userid for cache file name
userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }')
+ # make sure the cache directory exists
+ mkdir -p "$cacheDir"
+
# touch/clear key cache file
# (will be left empty if there are noacceptable keys)
> "$cacheDir"/"$userIDHash"."$pubKeyID"
# key cache file
if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then
for keyID in ${keyIDs[@]} ; do
- loge " acceptable key/uid found."
+ log " acceptable key/uid found."
if [ "$MODE" = 'known_hosts' ] ; then
# export the key
echo "$cacheDir"/"$userIDHash"."$pubKeyID"
}
+# update the cache for userid, and prompt to add file to
+# authorized_user_ids file if the userid is found in gpg
+# and not already in file.
+update_userid() {
+ local userID
+ local cacheDir
+ local userIDKeyCache
+
+ userID="$1"
+ cacheDir="$2"
+
+ log "processing userid: '$userID'"
+
+ userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
+
+ if [ -z "$userIDKeyCache" ] ; then
+ return 1
+ fi
+ if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+ read -p "user ID not currently authorized. authorize? [Y|n]: " OK; OK=${OK:=Y}
+ if [ ${OK/y/Y} = 'Y' ] ; then
+ log -n "adding user ID to authorized_user_ids file... "
+ echo "$userID" >> "$AUTHORIZED_USER_IDS"
+ echo "done."
+ else
+ log "authorized_user_ids file untouched."
+ fi
+ fi
+}
+
+# remove a userid from the authorized_user_ids file
+remove_userid() {
+ local userID
+
+ userID="$1"
+
+ log "processing userid: '$userID'"
+
+ if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+ log "user ID not currently authorized."
+ return 1
+ fi
+
+ log -n "removing user ID '$userID'... "
+ grep -v "$userID" "$AUTHORIZED_USER_IDS" | sponge "$AUTHORIZED_USER_IDS"
+ echo "done."
+}
+
# process a host for addition to a known_host file
process_host() {
local host
cacheDir="$2"
# take all the hosts from the known_hosts file (first field),
- # grep out all the hashed hosts (lines starting with '|')
+ # grep out all the hashed hosts (lines starting with '|')...
cut -d ' ' -f 1 "$knownHosts" | \
grep -v '^|.*$' | \
while IFS=, read -r -a hosts ; do
- # process each host
+ # ...and process each host
for host in ${hosts[*]} ; do
process_host "$host" "$cacheDir"
done
cat "$userAuthorizedKeys" >> "$msAuthorizedKeys"
echo "done."
fi
- log "monkeysphere authorized_keys file generated: $msAuthorizedKeys"
+ log "monkeysphere authorized_keys file generated:"
+ log "$msAuthorizedKeys"
}
# process an authorized_*_ids file
done
}
-# update the cache for userid, and prompt to add file to
-# authorized_user_ids file if the userid is found in gpg
-# and not already in file.
-update_userid() {
- local userID
- local cacheDir
- local userIDKeyCache
-
- userID="$1"
- cacheDir="$2"
-
- log "processing userid: '$userID'"
- userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
- if [ -z "$userIDKeyCache" ] ; then
- return 1
- fi
- if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
- echo "the following userid is not in the authorized_user_ids file:"
- echo " $userID"
- read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y}
- if [ ${OK/y/Y} = 'Y' ] ; then
- log -n " adding userid to authorized_user_ids file... "
- echo "$userID" >> "$AUTHORIZED_USER_IDS"
- echo "done."
- fi
- fi
-}
-
# retrieve key from web of trust, and set owner trust to "full"
# if key is found.
trust_key() {
# get the key from the key server
- gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'"
+ if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then
+ log "could not retrieve key '$keyID'"
+ return 1
+ fi
+
+ # get key fingerprint
+ fingerprint=$(get_key_fingerprint "$keyID")
+
+ # import "full" trust for fingerprint into gpg
+ echo ${fingerprint}:5: | gpg --import-ownertrust
+ if [ $? = 0 ] ; then
+ log "owner trust updated."
+ else
+ failure "there was a problem changing owner trust."
+ fi
+}
+
+# publish server key to keyserver
+publish_server_key() {
+ read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N}
+ if [ ${OK/y/Y} != 'Y' ] ; then
+ failure "aborting."
+ fi
- # edit the key to change trust
- # FIXME: need to figure out how to automate this,
- # in a batch mode or something.
- gpg --edit-key "$keyID"
+ # publish host key
+ # FIXME: need to figure out better way to identify host key
+ # dummy command so as not to publish fakes keys during testing
+ # eventually:
+ #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f)
+ echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)"
}
export SHAREDIR
. "${SHAREDIR}/common"
-GLOBAL_CONFIG=${GLOBAL_CONFIG:-"${ETC}"/monkeysphere.conf}
+GLOBAL_CONFIG=${GLOBAL_CONFIG:-"${ETC}/monkeysphere.conf"}
[ -r "$GLOBAL_CONFIG" ] && . "$GLOBAL_CONFIG"
# date in UTF format if needed
usage() {
cat <<EOF
usage: $PGRM <subcommand> [args]
-Monkeysphere client tool.
+MonkeySphere client tool.
subcommands:
update-known_hosts (k) [HOST]... update known_hosts file
- update-userids (u) [USERID]... add/update userid
+ update-userids (u) [USERID]... add/update user IDs
+ remove-userids (r) [USERID]... remove user IDs
update-authorized_keys (a) update authorized_keys file
gen-ae-subkey (g) KEYID generate an 'ae' capable subkey
help (h,?) this help
# return 1 if there only "tru" lines are output from gpg
if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then
- loge " key not found."
+ log " key not found."
return 1
fi
EOF
)
- log "The following key parameters will be used:"
+ echo "The following key parameters will be used:"
echo "$keyParameters"
read -p "generate key? [Y|n]: " OK; OK=${OK:=Y}
shift
# set ms home directory
-MS_HOME=${MS_HOME:-"$HOME"/.config/monkeysphere}
+MS_HOME=${MS_HOME:-"${HOME}/.config/monkeysphere"}
# load configuration file
-MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf}
+MS_CONF=${MS_CONF:-"${MS_HOME}/monkeysphere.conf"}
[ -e "$MS_CONF" ] && . "$MS_CONF"
# set empty config variable with defaults
-AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids}
-GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg}
-KEYSERVER=${KEYSERVER:-subkeys.pgp.net}
+AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
+GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
+KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"}
-USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys}
-USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts}
-HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-}
+USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
+USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
+HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"}
export GNUPGHOME
# stagging locations
-hostKeysCacheDir="$MS_HOME"/host_keys
-userKeysCacheDir="$MS_HOME"/user_keys
-msAuthorizedKeys="$MS_HOME"/authorized_keys
+hostKeysCacheDir="${MS_HOME}/host_keys"
+userKeysCacheDir="${MS_HOME}/user_keys"
+msAuthorizedKeys="${MS_HOME}/authorized_keys"
# make sure gpg home exists with proper permissions
mkdir -p -m 0700 "$GNUPGHOME"
mkdir -p -m 0700 "$MS_HOME"
mkdir -p "$hostKeysCacheDir"
mkdir -p "$userKeysCacheDir"
+touch "$AUTHORIZED_USER_IDS"
case $COMMAND in
'update-known_hosts'|'update-known-hosts'|'k')
MODE='known_hosts'
# touch the known_hosts file to make sure it exists
+ # ssh-keygen complains if it doesn't exist
touch "$USER_KNOWN_HOSTS"
# if hosts are specified on the command line, process just
process_host "$host" "$hostKeysCacheDir"
done
- # otherwise, if no hosts are specified, process the user
- # known_hosts file
+ # otherwise, if no hosts are specified, process every user
+ # in the user's known_hosts file
else
if [ ! -s "$USER_KNOWN_HOSTS" ] ; then
failure "known_hosts file '$USER_KNOWN_HOSTS' is empty."
fi
;;
+ 'update-userids'|'update-userid'|'u')
+ if [ -z "$1" ] ; then
+ failure "you must specify at least one userid."
+ fi
+ for userID ; do
+ update_userid "$userID" "$userKeysCacheDir"
+ done
+ log "run the following to update your monkeysphere authorized_keys file:"
+ log "$PGRM update-authorized_keys"
+ ;;
+
+ 'remove-userids'|'remove-userid'|'r')
+ if [ -z "$1" ] ; then
+ failure "you must specify at least one userid."
+ fi
+ for userID ; do
+ remove_userid "$userID"
+ done
+ log "run the following to update your monkeysphere authorized_keys file:"
+ log "$PGRM update-authorized_keys"
+ ;;
+
'update-authorized_keys'|'update-authorized-keys'|'a')
MODE='authorized_keys'
- # make sure authorized_user_ids file exists
+ # fail if the authorized_user_ids file is empty
if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then
- log "authorized_user_ids file is empty or does not exist."
- exit
+ failure "$AUTHORIZED_USER_IDS is empty."
fi
# set user-controlled authorized_keys file path
update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir"
;;
- 'update-userids'|'u')
- if [ -z "$1" ] ; then
- failure "you must specify at least one userid."
- fi
- for userID ; do
- update_userid "$userID" "$userKeysCacheDir"
- done
- ;;
-
'gen-ae-subkey'|'g')
keyID="$1"
if [ -z "$keyID" ] ; then
*)
failure "Unknown command: '$COMMAND'
-Type 'cereal-admin help' for usage."
+Type '$PGRM help' for usage."
;;
esac
usage() {
cat <<EOF
usage: $PGRM <subcommand> [args]
-Monkeysphere server admin tool.
+MonkeySphere server admin tool.
subcommands:
update-users (s) [USER]... update users authorized_keys files
gen-key (g) generate gpg key for the server
publish-key (p) publish server key to keyserver
trust-keys (t) KEYID... mark keyids as trusted
- update-user-userids (u) USER UID... add/update userids for a user
+ update-user-userids (u) USER UID... add/update user IDs for a user
+ remove-user-userids (r) USER UID... remove user IDs for a user
help (h,?) this help
EOF
)
fi
- log "The following key parameters will be used:"
+ echo "The following key parameters will be used:"
echo "$keyParameters"
read -p "generate key? [Y|n]: " OK; OK=${OK:=Y}
EOF
)
- echo "generating server key..."
+ log "generating server key..."
echo "$keyParameters" | gpg --batch --gen-key
}
-# publish server key to keyserver
-publish_key() {
- read -p "publish key to $KEYSERVER? [Y|n]: " OK; OK=${OK:=Y}
- if [ ${OK/y/Y} != 'Y' ] ; then
- failure "aborting."
- fi
-
- keyID=$(gpg --list-key --with-colons ="$USERID" 2> /dev/null | grep '^pub:' | cut -d: -f5)
-
- # dummy command so as not to publish fakes keys during testing
- # eventually:
- #gpg --send-keys --keyserver "$KEYSERVER" "$keyID"
- echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $keyID"
-}
-
########################################################################
# MAIN
########################################################################
mkdir -p -m 0700 "$GNUPGHOME"
case $COMMAND in
- 'update-users'|'s')
+ 'update-users'|'update-user'|'s')
if [ "$1" ] ; then
unames="$@"
else
log "----- user: $uname -----"
+ # set variables for the user
AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname"
msAuthorizedKeys="$CACHE"/"$uname"/authorized_keys
cacheDir="$CACHE"/"$uname"/user_keys
- # make sure authorized_user_ids file exists
+ # make sure user's authorized_user_ids file exists
+ touch "$AUTHORIZED_USER_IDS"
+
+ # skip if the user's authorized_user_ids file is empty
if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then
- log "authorized_user_ids file for '$uname' is empty or does not exist."
+ log "authorized_user_ids file for '$uname' is empty."
continue
fi
;;
'publish-key'|'p')
- publish_key
+ publish_server_key
;;
- 'trust-keys'|'t')
+ 'trust-keys'|'trust-key'|'t')
if [ -z "$1" ] ; then
failure "you must specify at least one key to trust."
fi
+
+ # process key IDs
for keyID ; do
trust_key "$keyID"
done
;;
- 'update-user-userids'|'u')
+ 'update-user-userids'|'update-user-userid'|'u')
uname="$1"
shift
if [ -z "$uname" ] ; then
if [ -z "$1" ] ; then
failure "you must specify at least one userid."
fi
+
+ # set variables for the user
AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname"
cacheDir="$CACHE"/"$uname"/user_keys
+
+ # make sure user's authorized_user_ids file exists
+ touch "$AUTHORIZED_USER_IDS"
+
+ # process the user IDs
for userID ; do
update_userid "$userID" "$cacheDir"
done
+
+ log "run the following to update user's authorized_keys file:"
+ log "$PGRM update-users $uname"
+ ;;
+
+ 'remove-user-userids'|'remove-user-userid'|'r')
+ uname="$1"
+ shift
+ if [ -z "$uname" ] ; then
+ failure "you must specify user."
+ fi
+ if [ -z "$1" ] ; then
+ failure "you must specify at least one userid."
+ fi
+
+ # set variables for the user
+ AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname"
+
+ # make sure user's authorized_user_ids file exists
+ touch "$AUTHORIZED_USER_IDS"
+
+ # process the user IDs
+ for userID ; do
+ remove_userid "$userID"
+ done
+
+ log "run the following to update user's authorized_keys file:"
+ log "$PGRM update-users $uname"
;;
'help'|'h'|'?')
*)
failure "Unknown command: '$COMMAND'
-Type 'cereal-admin help' for usage."
+Type '$PGRM help' for usage."
;;
esac
projects / monkeysphere.git / commitdiff