File bug against ssh-keygen to see if we can get it to write to hash a
known_hosts file to/from stdout/stdin.
-Add environment variables sections to man pages.
-
-Environment variable scoping.
-
-Move environment variable precedence before conf file.
-
When using ssh-proxycommand, if only host keys found are expired or
revoked, then output loud warning with prompt, or fail hard.
-Update monkeysphere-ssh-proxycommand man page with new keyserver
- checking policy info.
-
File bug against seahorse about how, when creating new primary keys,
it presents option for "RSA (sign only)" but then creates an "esca"
key.
File bug against enigmail about lack of ability to create subkeys.
-Privilege separation: monkeysphere user to handle authn keyring and
- generate authorized_keys file (which would be moved into place by
- root). Host keyring would be owned by root.
-
Test and document what happens when any filesystem that the
monkeysphere-server relies on and modifies (/tmp, /etc, and /var?)
fills up.
.SH DESCRIPTION
\fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used
-to trigger a monkeysphere update of the known_hosts file for the hosts
-that are being connected to. It is meant to be run as an ssh
-ProxyCommand. This can either be done by specifying the proxy command
-on the command line:
+to trigger a monkeysphere update of the ssh known_hosts file for a
+host that is being connected to with ssh. This works by updating the
+known_hosts file for the host first, before an attempted connection to
+the host is made. Once the known_hosts file has been updated, a TCP
+connection to the host is made by exec'ing netcat(1). Regular ssh
+communication is then done over this netcat TCP connection (see
+ProxyCommand in ssh_config(5) for more info).
+
+This command is meant to be run as the ssh "ProxyCommand". This can
+either be done by specifying the proxy command on the command line:
.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ...
.B monkeysphere-ssh-proxycommand --no-connect "$HOST" "$PORT"
-This will run everything but will not exec netcat to make the tcp
-connection to the host.
+This will run everything except the final exec of netcat to make the
+TCP connection to the host. In this way this command can be added to
+another proxy command that does other stuff, and then makes the
+connection to the host itself.
.SH KEYSERVER CHECKING
.SH ENVIRONMENT VARIABLES
All environment variables defined in monkeysphere(1) can also be used
-for the proxycommand, with one note:
+for the proxy command, with one note:
.TP
MONKEYSPHERE_CHECK_KEYSERVER
.BR monkeysphere (1),
.BR ssh (1),
+.BR ssh_config (5),
+.BR netcat (1),
.BR gpg (1)
To enable host verification via the monkeysphere, you must then
publish the host's key to the Web of Trust using the \fBpublish-key\fP
-command to push the key to a keyserver. Then modify the sshd_config
-to tell sshd where the new server host key is located:
+command to push the key to a keyserver. You must also modify the
+sshd_config on the server to tell sshd where the new server host key
+is located:
HostKey /var/lib/monkeysphere/ssh_host_rsa_key
In order for users logging into the system to be able to verify the
-host via the monkeysphere, at least one person (i.e. a server admin)
-will need to sign the host's key. This is done in the same way that
-key signing is usually done, by pulling the host's key from the
-keyserver, signing the key, and re-publishing the signature. Once
-that is done, users logging into the host will be able to certify the
-host's key via the signature of the host admin.
+host via the monkeysphere, at least one person (e.g. a server admin)
+will need to sign the host's key. This is done using standard key
+signing techniquies, usually by pulling the key from the keyserver,
+signing the key, and re-publishing the signature. Once that is done,
+users logging into the host will be able to certify the host's key via
+the signature of the host admin.
If the server will also handle user authentication through
monkeysphere-generated authorized_keys files, the server must be told
$ monkeysphere-server add-certifier KEYID
where KEYID is the key ID of the server admin, or whoever's signature
-will be certifying users to the system. Certifiers can be later
-remove with the \fBremove-certifier\fP command, and listed with the
+will be certifying users to the system. Certifiers can be removed
+with the \fBremove-certifier\fP command, and listed with the
\fBlist-certifiers\fP command.
Remote user's will then be granted access to a local user account
The \fBupdate-users\fP command can then be used to generate
authorized_keys file for local users based on the authorized user IDs
-listed in the user's authorized_user_ids file:
+listed in the various local user's authorized_user_ids file:
$ monkeysphere-server update-users USER
-sshd can then use these files to grant access to user accounts for
-remote users. If no user is specified, authorized_keys files will be
-generated for all users on the system. You must also tell sshd to
-look at the monkeysphere-generated authorized_keys file for user
-authentication by setting the following in the sshd_config:
+Not specifying a specific user will cause all users on the system to
+updated. sshd can then use these monkeysphere generated
+authorized_keys files to grant access to user accounts for remote
+users. You must also tell sshd to look at the monkeysphere-generated
+authorized_keys file for user authentication by setting the following
+in the sshd_config:
AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u
fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
grep '^fpr:' | head -1 | cut -d: -f10)
+ # export host ownertrust to authentication keyring
+ log "setting ultimate owner trust for server key..."
+ echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
+
# translate the private key to ssh format, and export to a file
# for sshs usage.
# NOTE: assumes that the primary key is the proper key to use
fi
export keyID
- # export host ownertrust to authentication keyring
- gpg_host --export-ownertrust | gpg_authentication "--import-ownertrust"
-
# get the key from the key server
gpg_authentication "--keyserver $KEYSERVER --recv-key '$keyID'"
y
save
EOF
-)
+ )
# ltsign the key
echo "$ltsignCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
projects / monkeysphere.git / commitdiff