From: Jameson Graef Rollins <jrollins@phys.columbia.edu>
Date: Fri, 15 Aug 2008 07:33:27 +0000 (-0700)
Subject: add start of add/revoke-hostname functions. revocation needs to be
X-Git-Tag: monkeysphere_0.8-1~22
X-Git-Url: https://codewiz.org/gitweb?a=commitdiff_plain;h=bb35e6ff08dbd33d3f47e9c969eb3da3a9acf18d;p=monkeysphere.git
add start of add/revoke-hostname functions. revocation needs to be
implemented.
---
diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8
index 74e9a10..8e7278b 100644
--- a/man/man8/monkeysphere-server.8
+++ b/man/man8/monkeysphere-server.8
@@ -44,9 +44,21 @@ specified with the `-e' or `--expire' option (prompt otherwise). A
key revoker fingerprint can be specified with the `-r' or `--revoker'
option. `g' may be used in place of `gen-key'.
.TP
-.B show-fingerprint
-Show the fingerprint for the host's OpenPGP key. `f' may be used in place of
-`show-fingerprint'.
+.B add-hostname HOSTNAME
+Add a hostname user ID to the server host key. `n+' may be used in
+place of `add-hostname'.
+.TP
+.B revoke-hostname HOSTNAME
+Revoke a hostname user ID from the server host key. `n-' may be used
+in place of `revoke-hostname'.
+.TP
+.B show-key
+Output gpg information about host's OpenPGP key. `s' may be used in
+place of `show-key'.
+.TP
+.B fingerprint
+Output just the fingerprint for the host's OpenPGP key. `f' may be
+used in place of `fingerprint'.
.TP
.B publish-key
Publish the host's OpenPGP key to the keyserver. `p' may be used in
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 21973dd..598c3f7 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -39,11 +39,14 @@ MonkeySphere server admin tool.
subcommands:
update-users (u) [USER]... update user authorized_keys files
- gen-key (g) [HOSTNAME] generate gpg key for the server
+ gen-key (g) [NAME[:PORT]] generate gpg key for the server
-l|--length BITS key length in bits (2048)
-e|--expire EXPIRE date to expire
-r|--revoker FINGERPRINT add a revoker
- show-fingerprint (f) show server host key fingerprint
+ add-hostname (n+) NAME[:PORT] add hostname user ID to server key
+ revoke-hostname (n-) NAME[:PORT] revoke hostname user ID
+ show-key (s) output all server host key information
+ fingerprint (f) output just the key fingerprint
publish-key (p) publish server host key to keyserver
diagnostics (d) report on server monkeysphere status
@@ -97,6 +100,17 @@ gpg_authentication() {
su_monkeysphere_user "gpg $@"
}
+# output key information
+show_server_key() {
+ gpg_host --list-secret-keys --fingerprint
+}
+
+# output just key fingerprint
+fingerprint_server_key() {
+ gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \
+ grep '^fpr:' | head -1 | cut -d: -f10
+}
+
# update authorized_keys for users
update_users() {
if [ "$1" ] ; then
@@ -339,9 +353,8 @@ EOF
# output the server fingerprint
fingerprint_server_key "=${userID}"
- # find the key fingerprint of the server primary key
- fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
- grep '^fpr:' | head -1 | cut -d: -f10)
+ # find the key fingerprint of the newly generated key
+ fingerprint=$(fingerprint_server_key)
# export host ownertrust to authentication keyring
log "setting ultimate owner trust for server key..."
@@ -356,9 +369,47 @@ EOF
log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key"
}
-# gpg output key fingerprint
-fingerprint_server_key() {
- gpg_host --fingerprint --list-secret-keys
+# add hostname user ID to server key
+add_hostname() {
+ if [ -z "$1" ] ; then
+ failure "You must specify a hostname to add."
+ fi
+
+ userID="ssh://${1}"
+
+ if [ "$(gpg_host --list-key "=${userID}")" ] ; then
+ failure "Host userID '$userID' already exists."
+ fi
+
+ fingerprint=$(fingerprint_server_key)
+
+ adduidCommand=$(cat <<EOF
+adduid
+$userID
+
+
+O
+save
+EOF
+ )
+
+ # add uid
+ echo "$adduidCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
+
+ echo "NOTE: new host userID has not been published."
+ echo "Use '$PGRM publish-key' to publish these changes."
+}
+
+# revoke hostname user ID to server key
+revoke_hostname() {
+ if [ -z "$1" ] ; then
+ failure "You must specify a hostname to revoke."
+ fi
+
+ failure "Sorry, not yet implemented."
+
+ echo "NOTE: host userID revokation has not been published."
+ echo "Use '$PGRM publish-key' to publish these changes."
}
# publish server key to keyserver
@@ -392,7 +443,7 @@ diagnostics() {
local fingerprint
local badhostkeys
- seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
+ seckey=$(fingerprint_server_key)
keysfound=$(echo "$seckey" | grep -c ^sec:)
curdate=$(date +%s)
# warn when anything is 2 months away from expiration
@@ -500,8 +551,6 @@ diagnostics() {
echo "$badauthorizedkeys"
echo " - Recommendation: remove the above AuthorizedKeysFile lines from /etc/ssh/sshd_config"
fi
-
-
}
# retrieve key from web of trust, import it into the host keyring, and
@@ -684,11 +733,23 @@ case $COMMAND in
gen_key "$@"
;;
- 'show-fingerprint'|'f')
+ 'add-hostname'|'add-name'|'n+')
+ add_hostname "$@"
+ ;;
+
+ 'revoke-hostname'|'revoke-name'|'n-')
+ revoke_hostname "$@"
+ ;;
+
+ 'show-key'|'show'|'s')
+ show_server_key
+ ;;
+
+ 'show-fingerprint'|'fingerprint'|'f')
fingerprint_server_key
;;
- 'publish-key'|'p')
+ 'publish-key'|'publish'|'p')
publish_server_key
;;
@@ -697,11 +758,11 @@ case $COMMAND in
;;
'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
- add_certifier "$1"
+ add_certifier "$@"
;;
'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
- remove_certifier "$1"
+ remove_certifier "$@"
;;
'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')