# Whether to add user controlled authorized_keys file to
# monkeysphere-generated authorized_keys file. Should be path to file
# where '%h' will be replaced by the home directory of the user.
+# To not add any user-controlled file, put "-"
#USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys
#REQUIRED_USER_KEY_CAPABILITY="a"
# Path to user-controlled authorized_keys file to add to
-# Monkeysphere-generated authorized_keys file. If empty, then no
-# user-controlled file will be added.
+# Monkeysphere-generated authorized_keys file.
+# To not add any user-controlled file, put "-"
#USER_CONTROLLED_AUTHORIZED_KEYS=~/.ssh/authorized_keys
# User known_hosts file
#USER_KNOWN_HOSTS=~/.ssh/known_hosts
-# Whether or not to hash the generated known_hosts lines
-# (empty mean "no").
-#HASH_KNOWN_HOSTS=
-
+# Whether or not to hash the generated known_hosts lines.
+# Should be "true" or "false"
+#HASH_KNOWN_HOSTS=true
# (not just first 5)
gpg_fetch_userid() {
local userID
- userID="$1"
- # if CHECK_KEYSERVER variable set, check the keyserver
- # for the user ID
- if [ "CHECK_KEYSERVER" ] ; then
- echo 1,2,3,4,5 | \
- gpg --quiet --batch --command-fd 0 --with-colons \
- --keyserver "$KEYSERVER" \
- --search ="$userID" >/dev/null 2>&1
+ userID="$1"
- # otherwise just return true
+ log "checking keyserver $KEYSERVER..."
+ echo 1,2,3,4,5 | \
+ gpg --quiet --batch --command-fd 0 --with-colons \
+ --keyserver "$KEYSERVER" \
+ --search ="$userID" >/dev/null 2>&1
+ if [ "$?" = 0 ] ; then
+ log " user ID found on keyserver."
+ return 0
else
- return
+ log " user ID not found on keyserver."
+ return 1
fi
}
fi
requiredPubCapability=$(echo "$requiredCapability" | tr "[:lower:]" "[:upper:]")
- # fetch keys from keyserver, return 1 if none found
- gpg_fetch_userid "$userID" || return 1
+ # if CHECK_KEYSERVER variable set, check the keyserver
+ # for the user ID
+ if [ "$CHECK_KEYSERVER" = "true" ] ; then
+ gpg_fetch_userid "$userID"
+ fi
# output gpg info for (exact) userid and store
gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
else
log "no gpg keys to add."
fi
- if [ "$userAuthorizedKeys" -a -s "$userAuthorizedKeys" ] ; then
+ if [ "$userAuthorizedKeys" != "-" -a -s "$userAuthorizedKeys" ] ; then
log -n "adding user authorized_keys file... "
cat "$userAuthorizedKeys" >> "$msAuthorizedKeys"
echo "done."
AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
+CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"}
REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"}
REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
-USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
+USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"}
USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"}
failure "known_hosts file '$USER_KNOWN_HOSTS' is empty."
fi
log "processing known_hosts file..."
- process_known_hosts "$USER_KNOWN_HOSTS"
+ process_known_hosts
fi
;;
failure "$AUTHORIZED_USER_IDS is empty."
fi
- # set user-controlled authorized_keys file path
- userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$HOME"}
-
# update authorized_keys
- update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir"
+ update_authorized_keys "$msAuthorizedKeys" "$USER_CONTROLLED_AUTHORIZED_KEYS" "$userKeysCacheDir"
;;
'gen-subkey'|'g')
subcommands:
update-users (s) [USER]... update users authorized_keys files
- gen-key (g) generate gpg key for the server
+ gen-key (g) [HOSTNAME] generate gpg key for the server
publish-key (p) publish server key to keyserver
trust-keys (t) KEYID... mark keyids as trusted
update-user-userids (u) USER UID... add/update user IDs for a user
# generate server gpg key
gen_key() {
+ local hostName
+
+ hostName=${1:-$(hostname --fqdn)}
+
# set key defaults
KEY_TYPE=${KEY_TYPE:-"RSA"}
KEY_LENGTH=${KEY_LENGTH:-"2048"}
KEY_USAGE=${KEY_USAGE:-"auth,encrypt"}
- SERVICE=${SERVICE:-"ssh"}
- HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)}
+ cat <<EOF
+Please specify how long the key should be valid.
+ 0 = key does not expire
+ <n> = key expires in n days
+ <n>w = key expires in n weeks
+ <n>m = key expires in n months
+ <n>y = key expires in n years
+EOF
+ read -p "Key is valid for? ($EXPIRE) " EXPIRE; EXPIRE=${EXPIRE:-"0"}
- USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"}
+ SERVICE=${SERVICE:-"ssh"}
+ USERID=${USERID:-"$SERVICE"://"$hostName"}
# set key parameters
keyParameters=$(cat <<EOF
Key-Length: $KEY_LENGTH
Key-Usage: $KEY_USAGE
Name-Real: $USERID
+Expire-Date: $EXPIRE
EOF
)
EOF
)
- log "generating server key..."
+ log -n "generating server key... "
echo "$keyParameters" | gpg --batch --gen-key
+ echo "done."
}
########################################################################
[ -e "$MS_CONF" ] && . "$MS_CONF"
# set empty config variable with defaults
-GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg}
-KEYSERVER=${KEYSERVER:-subkeys.pgp.net}
+GNUPGHOME=${GNUPGHOME:-"${MS_HOME}/gnupg"}
+KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
-USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys}
+USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
export GNUPGHOME
;;
'gen-key'|'g')
- gen_key
+ gen_key "$1"
;;
'publish-key'|'p')
# check for the host key in the known_hosts file
hostKey=$(ssh-keygen -F "$HOST")
-# if the host key is not found in the known_hosts file,
-# check the keyserver
-if [ -z "$hostKey" ] ; then
+# if the host key is found in the known_hosts file,
+# don't check the keyserver
+if [ "$hostKey" ] ; then
+ CHECK_KEYSERVER="false"
+else
CHECK_KEYSERVER="true"
fi
+export CHECK_KEYSERVER
# update the known_hosts file for the host
monkeysphere update-known-hosts "$HOST"