.SH NAME
monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script
.PD
-.SH SYNOPSIS
-.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ...
-.PD
.SH DESCRIPTION
.PP
-MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh
-authentication and encryption. OpenPGP keys are tracked via GnuPG,
-and added to the ssh authorized_keys and known_hosts files to be used
-for authentication and encryption of ssh connection.
-
\fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used
to trigger a monkeysphere update of the known_hosts file for the hosts
-that are being connected to.
+that are being connected to. It is meant to be run as an ssh
+ProxyCommand. This can either be done by specifying the proxy command
+on the command line:
+
+.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ...
+
+or by adding the following line to your ~/.ssh/config script:
+
+.B ProxyCommand monkeysphere-ssh-proxycommand %h %p
+
+The script is very simple, and can easily be incorporated into other
+ProxyCommand scripts. All it does is first runs
+
+.B monkeysphere update-known-hosts HOST
+
+and then
+
+.B exec nc HOST PORT
+
+Run the following command for more info:
+
+.B less $(which monkeysphere-ssh-proxycommand)
.PD
.SH AUTHOR
Written by Jameson Rollins <jrollins@fifthhorseman.net>
# retrieve all keys with given user id from keyserver
# FIXME: need to figure out how to retrieve all matching keys
# (not just first 5)
-gpg_fetch_keys() {
+gpg_fetch_userid() {
local id
id="$1"
echo 1,2,3,4,5 | \
return 0
}
+# get the full fingerprint of a key ID
+get_key_fingerprint() {
+ local keyID
+
+ keyID="$1"
+
+ gpg --list-key --with-colons --fixed-list-mode \
+ --with-fingerprint "$keyID" | grep "$keyID" | \
+ grep '^fpr:' | cut -d: -f10
+}
+
+
# convert escaped characters from gpg output back into original
# character
# FIXME: undo all escape character translation in with-colons gpg output
requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]")
# fetch keys from keyserver, return 1 if none found
- gpg_fetch_keys "$userID" || return 1
+ gpg_fetch_userid "$userID" || return 1
# output gpg info for (exact) userid and store
gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \
echo "$cacheDir"/"$userIDHash"."$pubKeyID"
}
+# update the cache for userid, and prompt to add file to
+# authorized_user_ids file if the userid is found in gpg
+# and not already in file.
+update_userid() {
+ local userID
+ local cacheDir
+ local userIDKeyCache
+
+ userID="$1"
+ cacheDir="$2"
+
+ log "processing userid: '$userID'"
+ userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
+ if [ -z "$userIDKeyCache" ] ; then
+ return 1
+ fi
+ if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+ echo "the following userid is not in the authorized_user_ids file:"
+ echo " $userID"
+ read -p "would you like to add it? [Y|n]: " OK; OK=${OK:=Y}
+ if [ ${OK/y/Y} = 'Y' ] ; then
+ log -n "adding userid to authorized_user_ids file... "
+ echo "$userID" >> "$AUTHORIZED_USER_IDS"
+ echo "done."
+ else
+ log "authorized_user_ids file untouched."
+ fi
+ fi
+}
+
# process a host for addition to a known_host file
process_host() {
local host
done
}
-# update the cache for userid, and prompt to add file to
-# authorized_user_ids file if the userid is found in gpg
-# and not already in file.
-update_userid() {
- local userID
- local cacheDir
- local userIDKeyCache
-
- userID="$1"
- cacheDir="$2"
-
- log "processing userid: '$userID'"
- userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
- if [ -z "$userIDKeyCache" ] ; then
- return 1
- fi
- if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
- echo "the following userid is not in the authorized_user_ids file:"
- echo " $userID"
- read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y}
- if [ ${OK/y/Y} = 'Y' ] ; then
- log -n " adding userid to authorized_user_ids file... "
- echo "$userID" >> "$AUTHORIZED_USER_IDS"
- echo "done."
- fi
- fi
-}
-
# retrieve key from web of trust, and set owner trust to "full"
# if key is found.
trust_key() {
# get the key from the key server
- gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'"
+ if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then
+ log "could not retrieve key '$keyID'"
+ return 1
+ fi
+
+ # get key fingerprint
+ fingerprint=$(get_key_fingerprint "$keyID")
+
+ # import "full" trust for fingerprint into gpg
+ echo ${fingerprint}:5: | gpg --import-ownertrust
+ if [ $? = 0 ] ; then
+ log "owner trust updated."
+ else
+ failure "there was a problem changing owner trust."
+ fi
+}
+
+# publish server key to keyserver
+publish_server_key() {
+ read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N}
+ if [ ${OK/y/Y} != 'Y' ] ; then
+ failure "aborting."
+ fi
- # edit the key to change trust
- # FIXME: need to figure out how to automate this,
- # in a batch mode or something.
- gpg --edit-key "$keyID"
+ # publish host key
+ # FIXME: need to figure out better way to identify host key
+ # dummy command so as not to publish fakes keys during testing
+ # eventually:
+ #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f)
+ echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)"
}
mkdir -p -m 0700 "$MS_HOME"
mkdir -p "$hostKeysCacheDir"
mkdir -p "$userKeysCacheDir"
+touch "$AUTHORIZED_USER_IDS"
case $COMMAND in
'update-known_hosts'|'update-known-hosts'|'k')
fi
;;
+ 'update-userids'|'u')
+ if [ -z "$1" ] ; then
+ failure "you must specify at least one userid."
+ fi
+ for userID ; do
+ update_userid "$userID" "$userKeysCacheDir"
+ done
+ ;;
+
'update-authorized_keys'|'update-authorized-keys'|'a')
MODE='authorized_keys'
# make sure authorized_user_ids file exists
if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then
- failure "authorized_user_ids file is empty or does not exist."
+ failure "$AUTHORIZED_USER_IDS is empty."
fi
# set user-controlled authorized_keys file path
update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir"
;;
- 'update-userids'|'u')
- if [ -z "$1" ] ; then
- failure "you must specify at least one userid."
- fi
- for userID ; do
- update_userid "$userID" "$userKeysCacheDir"
- done
- ;;
-
'gen-ae-subkey'|'g')
keyID="$1"
if [ -z "$keyID" ] ; then
*)
failure "Unknown command: '$COMMAND'
-Type 'cereal-admin help' for usage."
+Type '$PGRM help' for usage."
;;
esac
echo "$keyParameters" | gpg --batch --gen-key
}
-# publish server key to keyserver
-publish_key() {
- read -p "publish key to $KEYSERVER? [Y|n]: " OK; OK=${OK:=Y}
- if [ ${OK/y/Y} != 'Y' ] ; then
- failure "aborting."
- fi
-
- keyID=$(gpg --list-key --with-colons ="$USERID" 2> /dev/null | grep '^pub:' | cut -d: -f5)
-
- # dummy command so as not to publish fakes keys during testing
- # eventually:
- #gpg --send-keys --keyserver "$KEYSERVER" "$keyID"
- echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $keyID"
-}
-
########################################################################
# MAIN
########################################################################
;;
'publish-key'|'p')
- publish_key
+ publish_server_key
;;
'trust-keys'|'t')
*)
failure "Unknown command: '$COMMAND'
-Type 'cereal-admin help' for usage."
+Type '$PGRM help' for usage."
;;
esac
projects / monkeysphere.git / commitdiff