X-Git-Url: https://codewiz.org/gitweb?p=monkeysphere.git;a=blobdiff_plain;f=src%2Fmonkeysphere;h=6db4827c15a5ea8fc9248cf2a4c1e0f9e6cd5d79;hp=8ddfe7fdc93513d5552c93f40407206777f85825;hb=e71c7bb4dff26178f714cd0fcdbb3058effa4066;hpb=4d54f1d8b9a3d9ee4e6bd0b0d9fdccb99e6a6245 diff --git a/src/monkeysphere b/src/monkeysphere index 8ddfe7f..6db4827 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -1,29 +1,34 @@ -#!/bin/bash +#!/usr/bin/env bash -# monkeysphere: MonkeySphere client tool +# monkeysphere: Monkeysphere client tool # # The monkeysphere scripts are written by: # Jameson Rollins +# Jamie McClelland +# Daniel Kahn Gillmor +# Micah Anderson # -# They are Copyright 2008, and are all released under the GPL, version 3 +# They are Copyright 2008-2009, and are all released under the GPL, version 3 # or later. ######################################################################## +set -e + PGRM=$(basename $0) -SHARE=${MONKEYSPHERE_SHARE:-"/usr/share/monkeysphere"} -export SHARE -. "${SHARE}/common" || exit 1 +SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"} +export SYSSHAREDIR +. "${SYSSHAREDIR}/common" || exit 1 + +# sharedir for host functions +MSHAREDIR="${SYSSHAREDIR}/m" -# date in UTF format if needed +# UTC date in ISO 8601 format if needed DATE=$(date -u '+%FT%T') # unset some environment variables that could screw things up unset GREP_OPTIONS -# default return code -RETURN=0 - # set the file creation mask to be only owner rw umask 077 @@ -32,170 +37,145 @@ umask 077 ######################################################################## usage() { - cat <&2 usage: $PGRM [options] [args] -MonkeySphere client tool. +Monkeysphere client tool. subcommands: - update-known_hosts (k) [HOST]... update known_hosts file - update-authorized_keys (a) update authorized_keys file - gen-subkey (g) KEYID generate an 'a' capable subkey - -l|--length BITS key length in bits (2048) - -e|--expire EXPIRE date to expire - help (h,?) this help + update-known_hosts (k) [HOST]... update known_hosts file + update-authorized_keys (a) update authorized_keys file + gen-subkey (g) [KEYID] generate an authentication subkey + --length (-l) BITS key length in bits (2048) + ssh-proxycommand monkeysphere ssh ProxyCommand + subkey-to-ssh-agent (s) store authentication subkey in ssh-agent + version (v) show version number + help (h,?) this help EOF } -# generate a subkey with the 'a' usage flags set -# FIXME: this needs some tweaking to clean it up -gen_subkey(){ - local keyLength - local keyExpire - local keyID - local gpgOut - local userID - - # set default key parameter values - keyLength= - keyExpire= - - # get options - TEMP=$(getopt -o l:e: -l length:,expire: -n "$PGRM" -- "$@") - - if [ $? != 0 ] ; then - exit 1 - fi +# user gpg command to define common options +gpg_user() { + gpg --no-greeting --quiet --no-tty "$@" +} - # Note the quotes around `$TEMP': they are essential! - eval set -- "$TEMP" - - while true ; do - case "$1" in - -l|--length) - keyLength="$2" - shift 2 - ;; - -e|--expire) - keyExpire="$2" - shift 2 - ;; - --) - shift - ;; - *) - break - ;; - esac - done +# take a secret key ID and check that only zero or one ID is provided, +# and that it corresponds to only a single secret key ID +check_gpg_sec_key_id() { + local gpgSecOut + + case "$#" in + 0) + gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons 2>/dev/null | egrep '^sec:') + ;; + 1) + gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons "$keyID" | egrep '^sec:') || failure + ;; + *) + failure "You must specify only a single primary key ID." + ;; + esac + + # check that only a single secret key was found + case $(echo "$gpgSecOut" | grep -c '^sec:') in + 0) + failure "No secret keys found. Create an OpenPGP key with the following command: + gpg --gen-key" + ;; + 1) + echo "$gpgSecOut" | cut -d: -f5 + ;; + *) + echo "Multiple primary secret keys found:" + echo "$gpgSecOut" | cut -d: -f5 + echo "Please specify which primary key to use." + failure + ;; + esac +} - if [ -z "$1" ] ; then - # find all secret keys - keyID=$(gpg --with-colons --list-secret-keys | grep ^sec | cut -f5 -d:) - # if multiple sec keys exist, fail - if (( $(echo "$keyID" | wc -l) > 1 )) ; then - echo "Multiple secret keys found:" - echo "$keyID" - failure "Please specify which primary key to use." +# check that a valid authentication subkey does not already exist +check_gpg_authentication_subkey() { + local keyID + local IFS + local line + local type + local validity + local usage + + keyID="$1" + + # check that a valid authentication key does not already exist + IFS=$'\n' + for line in $(gpg_user --fixed-list-mode --list-keys --with-colons "$keyID") ; do + type=$(echo "$line" | cut -d: -f1) + validity=$(echo "$line" | cut -d: -f2) + usage=$(echo "$line" | cut -d: -f12) + + # look at keys only + if [ "$type" != 'pub' -a "$type" != 'sub' ] ; then + continue fi - else - keyID="$1" - fi - if [ -z "$keyID" ] ; then - failure "You have no secret key available. You should create an OpenPGP -key before joining the monkeysphere. You can do this with: - gpg --gen-key" - fi - - # get key output, and fail if not found - gpgOut=$(gpg --quiet --fixed-list-mode --list-secret-keys --with-colons \ - "$keyID") || failure - - # fail if multiple sec lines are returned, which means the id - # given is not unique - if [ $(echo "$gpgOut" | grep '^sec:' | wc -l) -gt '1' ] ; then - failure "Key ID '$keyID' is not unique." - fi - - # prompt if an authentication subkey already exists - if echo "$gpgOut" | egrep "^(sec|ssb):" | cut -d: -f 12 | grep -q a ; then - echo "An authentication subkey already exists for key '$keyID'." - read -p "Are you sure you would like to generate another one? (y/N) " OK; OK=${OK:N} - if [ "${OK/y/Y}" != 'Y' ] ; then - failure "aborting." + # check for authentication capability + if ! check_capability "$usage" 'a' ; then + continue fi - fi - - # set subkey defaults - # prompt about key expiration if not specified - if [ -z "$keyExpire" ] ; then - cat < = key expires in n days - w = key expires in n weeks - m = key expires in n months - y = key expires in n years -EOF - while [ -z "$keyExpire" ] ; do - read -p "Key is valid for? (0) " keyExpire - if ! test_gpg_expire ${keyExpire:=0} ; then - echo "invalid value" - unset keyExpire + # if authentication key is valid, prompt to continue + if [ "$validity" = 'u' ] ; then + echo "A valid authentication key already exists for primary key '$keyID'." 1>&2 + if [ "$PROMPT" = "true" ] ; then + read -p "Are you sure you would like to generate another one? (y/N) " OK; OK=${OK:N} + if [ "${OK/y/Y}" != 'Y' ] ; then + failure "aborting." + fi + break + else + failure "aborting." fi - done - elif ! test_gpg_expire "$keyExpire" ; then - failure "invalid key expiration value '$keyExpire'." - fi - - # generate the list of commands that will be passed to edit-key - editCommands=$(cat <