src/subcommands/ma/update-users

   1 #!/usr/bin/env bash
   2
   3 # Monkeysphere authentication update-users subcommand
   4 #
   5 # The monkeysphere scripts are written by:
   6 # Jameson Rollins <jrollins@fifthhorseman.net>
   7 # Jamie McClelland <jm@mayfirst.org>
   8 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
   9 #
  10 # They are Copyright 2008, and are all released under the GPL, version 3
  11 # or later.
  12
  13 update_users() {
  14
  15 if [ "$1" ] ; then
  16     # get users from command line
  17     unames="$@"
  18 else
  19     # or just look at all users if none specified
  20     unames=$(getent passwd | cut -d: -f1)
  21 fi
  22
  23 RETCODE=0
  24
  25 # set mode
  26 MODE="authorized_keys"
  27
  28 # set gnupg home
  29 GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
  30
  31 # check to see if the gpg trust database has been initialized
  32 if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
  33     failure "GNUPG trust database uninitialized.  Please see MONKEYSPHERE-SERVER(8)."
  34 fi
  35
  36 # make sure the authorized_keys directory exists
  37 mkdir -p "${SYSDATADIR}/authorized_keys"
  38
  39 # loop over users
  40 for uname in $unames ; do
  41     # check all specified users exist
  42     if ! id "$uname" >/dev/null ; then
  43         log error "----- unknown user '$uname' -----"
  44         continue
  45     fi
  46
  47     log verbose "----- user: $uname -----"
  48
  49     # make temporary directory
  50     TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
  51
  52     # trap to delete temporary directory on exit
  53     trap "rm -rf $TMPLOC" EXIT
  54
  55     # create temporary authorized_user_ids file
  56     TMP_AUTHORIZED_USER_IDS="${TMPLOC}/authorized_user_ids"
  57     touch "$TMP_AUTHORIZED_USER_IDS"
  58
  59      # create temporary authorized_keys file
  60     AUTHORIZED_KEYS="${TMPLOC}/authorized_keys"
  61     touch "$AUTHORIZED_KEYS"
  62
  63     # set restrictive permissions on the temporary files
  64     # FIXME: is there a better way to do this?
  65     chmod 0700 "$TMPLOC"
  66     chmod 0600 "$AUTHORIZED_KEYS"
  67     chmod 0600 "$TMP_AUTHORIZED_USER_IDS"
  68     chown -R "$MONKEYSPHERE_USER" "$TMPLOC"
  69
  70     # process authorized_user_ids file
  71     log debug "checking for authorized_user_ids..."
  72     # translating ssh-style path variables
  73     authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
  74     if [ -s "$authorizedUserIDs" ] ; then
  75         # check permissions on the authorized_user_ids file path
  76         if check_key_file_permissions "$uname" "$authorizedUserIDs" ; then
  77             # copy user authorized_user_ids file to temporary
  78             # location
  79             cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
  80
  81             # export needed variables
  82             export AUTHORIZED_KEYS
  83             export TMP_AUTHORIZED_USER_IDS
  84
  85             # process authorized_user_ids file, as monkeysphere user
  86             su_monkeysphere_user \
  87                 ". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
  88             RETURN="$?"
  89         else
  90             log debug "not processing authorized_user_ids."
  91         fi
  92     else
  93         log debug "empty or absent authorized_user_ids file."
  94     fi
  95
  96     # add user-controlled authorized_keys file if specified translate
  97     # ssh-style path variables
  98     rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
  99     if [ "$rawAuthorizedKeys" != 'none' ] ; then
 100         log debug "checking for raw authorized_keys..."
 101         if [ -s "$rawAuthorizedKeys" ] ; then
 102             # check permissions on the authorized_keys file path
 103             if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then
 104                 log verbose "adding raw authorized_keys file... "
 105                 cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
 106             else
 107                 log debug "not adding raw authorized_keys file."
 108             fi
 109         else
 110             log debug "empty or absent authorized_keys file."
 111         fi
 112     fi
 113
 114     # move the new authorized_keys file into place
 115     if [ -s "$AUTHORIZED_KEYS" ] ; then
 116         # openssh appears to check the contents of the authorized_keys
 117         # file as the user in question, so the file must be readable
 118         # by that user at least.
 119
 120         # but in general, we don't want the user tampering with this
 121         # file directly, so we'll adopt this approach: Own the file by
 122         # the monkeysphere-server invoker (usually root, but should be
 123         # the same uid that sshd is launched as); change the group of
 124         # the file so that members of the user's group can read it.
 125
 126         # FIXME: is there a better way to do this?
 127         chown $(whoami) "$AUTHORIZED_KEYS" && \
 128             chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \
 129             chmod g+r "$AUTHORIZED_KEYS" && \
 130             mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \
 131             {
 132             log error "Failed to install authorized_keys for '$uname'!"
 133             rm -f "${SYSDATADIR}/authorized_keys/${uname}"
 134             # indicate that there has been a failure:
 135             RETURN=1
 136         }
 137     else
 138         rm -f "${SYSDATADIR}/authorized_keys/${uname}"
 139     fi
 140
 141     # unset the trap
 142     trap - EXIT
 143
 144     # destroy temporary directory
 145     rm -rf "$TMPLOC"
 146 done
 147
 148 }