From: Daniel Kahn Gillmor Date: Sat, 16 Aug 2008 14:45:49 +0000 (-0400) Subject: Merge commit 'jrollins/master' X-Git-Tag: monkeysphere_0.8-1~3^2~7 X-Git-Url: https://codewiz.org/gitweb?a=commitdiff_plain;h=df0e87db1b2f8a8c762d1a1f9ce3c7cd22845b46;hp=ae661bf9fd9ce62069a99bb9de16df8b44beee8a;p=monkeysphere.git Merge commit 'jrollins/master' --- diff --git a/debian/changelog b/debian/changelog index e6dfccd..af4d94b 100644 --- a/debian/changelog +++ b/debian/changelog @@ -5,7 +5,6 @@ monkeysphere (0.8-1) UNRELEASED; urgency=low of my own. * More monkeysphere-server diagnostics * monkeysphere --gen-subkey now guesses what KeyID you meant. - * set up host-key revocation * added Recommends: ssh-askpass to ensure monkeysphere --gen-subkey works [ Jameson Graef Rollins ] @@ -15,8 +14,10 @@ monkeysphere (0.8-1) UNRELEASED; urgency=low be removed from key files. * enabled host key publication. * added checking of gpg.conf for keyserver + * new functions to add/revoke host key user IDs + * improved list-certifiers function (now non-priviledged) - -- Daniel Kahn Gillmor Fri, 15 Aug 2008 16:06:31 -0400 + -- Jameson Graef Rollins Fri, 15 Aug 2008 15:57:14 -0700 monkeysphere (0.7-1) experimental; urgency=low diff --git a/src/common b/src/common index 24decae..bb988f7 100644 --- a/src/common +++ b/src/common @@ -69,20 +69,20 @@ file_hash() { md5sum "$1" 2> /dev/null } -# convert escaped characters from gpg output back into original -# character -# FIXME: undo all escape character translation in with-colons gpg output -unescape() { - echo "$1" | sed 's/\\x3a/:/g' +# convert escaped characters in pipeline from gpg output back into +# original character +# FIXME: undo all escape character translation in with-colons gpg +# output +gpg_unescape() { + sed 's/\\x3a/:/g' } -# convert nasty chars into gpg-friendly form +# convert nasty chars into gpg-friendly form in pipeline # FIXME: escape everything, not just colons! -escape() { - echo "$1" | sed 's/:/\\x3a/g' +gpg_escape() { + sed 's/:/\\x3a/g' } - # remove all lines with specified string from specified file remove_line() { local file @@ -405,7 +405,7 @@ process_user_id() { continue fi # if the user ID does not match, skip - if [ "$(unescape "$uidfpr")" != "$userID" ] ; then + if [ "$(echo "$uidfpr" | gpg_unescape)" != "$userID" ] ; then continue fi # if the user ID validity is not ok, skip diff --git a/src/monkeysphere b/src/monkeysphere index 57597e2..f959a38 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -37,12 +37,12 @@ usage: $PGRM [options] [args] MonkeySphere client tool. subcommands: - update-known_hosts (k) [HOST]... update known_hosts file - update-authorized_keys (a) update authorized_keys file - gen-subkey (g) KEYID generate an 'a' capable subkey - -l|--length BITS key length in bits (2048) - -e|--expire EXPIRE date to expire - help (h,?) this help + update-known_hosts (k) [HOST]... update known_hosts file + update-authorized_keys (a) update authorized_keys file + gen-subkey (g) KEYID generate an 'a' capable subkey + --length (-l) BITS key length in bits (2048) + --expire (-e) EXPIRE date to expire + help (h,?) this help EOF } diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 2b9b744..fcd3114 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -40,9 +40,9 @@ subcommands: update-users (u) [USER]... update user authorized_keys files gen-key (g) [NAME[:PORT]] generate gpg key for the server - -l|--length BITS key length in bits (2048) - -e|--expire EXPIRE date to expire - -r|--revoker FINGERPRINT add a revoker + --length (-l) BITS key length in bits (2048) + --expire (-e) EXPIRE date to expire + --revoker (-r) FINGERPRINT add a revoker add-hostname (n+) NAME[:PORT] add hostname user ID to server key revoke-hostname (n-) NAME[:PORT] revoke hostname user ID show-key (s) output all server host key information @@ -51,15 +51,16 @@ subcommands: diagnostics (d) report on server monkeysphere status add-id-certifier (c+) KEYID import and tsign a certification key - -n|--domain DOMAIN limit ID certifications to DOMAIN - -t|--trust TRUST trust level of certifier (full) - -d|--depth DEPTH trust depth for certifier (1) + --domain (-n) DOMAIN limit ID certifications to DOMAIN + --trust (-t) TRUST trust level of certifier (full) + --depth (-d) DEPTH trust depth for certifier (1) remove-id-certifier (c-) KEYID remove a certification key list-id-certifiers (c) list certification keys gpg-authentication-cmd CMD gnupg-authentication command - -h|--help|help (h,?) this help + help (h,?) this help + EOF } @@ -100,17 +101,20 @@ gpg_authentication() { su_monkeysphere_user "gpg $@" } -# output key information -show_server_key() { - gpg_host --list-secret-keys --fingerprint -} - # output just key fingerprint fingerprint_server_key() { - gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \ + gpg_host --list-secret-keys --fingerprint \ + --with-colons --fixed-list-mode 2> /dev/null | \ grep '^fpr:' | head -1 | cut -d: -f10 } +# output key information +show_server_key() { + local fingerprint + fingerprint=$(fingerprint_server_key) + gpg_host --fingerprint --list-secret-key "$fingerprint" +} + # update authorized_keys for users update_users() { if [ "$1" ] ; then @@ -371,89 +375,143 @@ EOF # add hostname user ID to server key add_hostname() { + local userID + local fingerprint + local tmpuidMatch + local line + local adduidCommand + if [ -z "$1" ] ; then failure "You must specify a hostname to add." fi userID="ssh://${1}" - if [ "$(gpg_host --list-key "=${userID}")" ] ; then + fingerprint=$(fingerprint_server_key) + + # match to only ultimately trusted user IDs + tmpuidMatch="u:$(echo $userID | gpg_escape)" + + # find the index of the requsted user ID + # NOTE: this is based on circumstantial evidence that the order of + # this output is the appropriate index + if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ + | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then failure "Host userID '$userID' already exists." fi - fingerprint=$(fingerprint_server_key) + echo "The following user ID will be added to the host key:" + echo " $userID" + read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N} + if [ ${OK/y/Y} != 'Y' ] ; then + failure "User ID not added." + fi + # edit-key script command to add user ID adduidCommand=$(cat <