* More monkeysphere-server diagnostics
* monkeysphere --gen-subkey now guesses what KeyID you meant.
- -- Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net> Thu, 07 Aug 2008 13:31:14 -0400
+ [ Jameson Graef Rollins ]
+ * fix another bug for when ssh key files are missing.
+ * sort processed keys so that "good" keys are processed after "bad"
+ keys. This will prevent malicious bad keys from causing good keys to
+ be removed from key files.
+ * enabled host key publication.
+
+ -- Jameson Graef Rollins <jrollins@phys.columbia.edu> Fri, 15 Aug 2008 00:48:22 -0700
monkeysphere (0.7-1) experimental; urgency=low
* changes to this system (first command at top, last at bottom) *
******************************************************************************
+2008-08-13 - dkg
+ * aptitude update && aptitude full-upgrade
+ * restarted services to clear up dependencies on old libraries
+
2008-08-07 - dkg
* aptitude update && aptitude dist-upgrade
* removed debian's experimental from the sources.list
key revoker fingerprint can be specified with the `-r' or `--revoker'
option. `g' may be used in place of `gen-key'.
.TP
-.B show-fingerprint
-Show the fingerprint for the host's OpenPGP key. `f' may be used in place of
-`show-fingerprint'.
+.B add-hostname HOSTNAME
+Add a hostname user ID to the server host key. `n+' may be used in
+place of `add-hostname'.
+.TP
+.B revoke-hostname HOSTNAME
+Revoke a hostname user ID from the server host key. `n-' may be used
+in place of `revoke-hostname'.
+.TP
+.B show-key
+Output gpg information about host's OpenPGP key. `s' may be used in
+place of `show-key'.
+.TP
+.B fingerprint
+Output just the fingerprint for the host's OpenPGP key. `f' may be
+used in place of `fingerprint'.
.TP
.B publish-key
Publish the host's OpenPGP key to the keyserver. `p' may be used in
@example.org domain"). A certifier trust level can be specified with
the `-t' or `--trust' option (possible values are `marginal' and
`full' (default is `full')). A certifier trust depth can be specified
-with the `-d' or `--depth' option (default is 1). `a' may be used in
+with the `-d' or `--depth' option (default is 1). `c+' may be used in
place of `add-identity-certifier'.
.TP
.B remove-identity-certifier KEYID
Instruct system to ignore user identity certifications made by KEYID.
-`r' may be used in place of `remove-identity-certifier'.
+`c-' may be used in place of `remove-identity-certifier'.
.TP
.B list-identity-certifiers
-List key IDs trusted by the system to certify user identities. `l'
+List key IDs trusted by the system to certify user identities. `c'
may be used in place of `list-identity-certifiers'.
.TP
.B gpg-authentication-cmd
return 0
}
+# hash of a file
+file_hash() {
+ md5sum "$1" 2> /dev/null
+}
+
# convert escaped characters from gpg output back into original
# character
# FIXME: undo all escape character translation in with-colons gpg output
fi
;;
esac
- done
+ done | sort -t: -k1 -n -r
+ # NOTE: this last sort is important so that the "good" keys (key
+ # flag '0') come last. This is so that they take precedence when
+ # being processed in the key files over "bad" keys (key flag '1')
}
# process a single host in the known_host file
local tmpfile
host="$1"
+ userID="ssh://${host}"
log "processing: $host"
- userID="ssh://${host}"
-
nKeys=0
nKeysOK=0
IFS=$'\n'
- for line in $(process_user_id "ssh://${host}") ; do
+ for line in $(process_user_id "${userID}") ; do
# note that key was found
nKeys=$((nKeys+1))
lockfile-create "$KNOWN_HOSTS"
# note pre update file checksum
- fileCheck="$(cat "$KNOWN_HOSTS" | md5sum)"
+ fileCheck="$(file_hash "$KNOWN_HOSTS")"
for host ; do
# process the host
lockfile-remove "$KNOWN_HOSTS"
# note if the known_hosts file was updated
- if [ "$(cat "$KNOWN_HOSTS" | md5sum)" != "$fileCheck" ] ; then
+ if [ "$(file_hash "$KNOWN_HOSTS")" != "$fileCheck" ] ; then
log "known_hosts file updated."
fi
lockfile-create "$AUTHORIZED_KEYS"
# note pre update file checksum
- fileCheck="$(cat "$AUTHORIZED_KEYS" | md5sum)"
+ fileCheck="$(file_hash "$AUTHORIZED_KEYS")"
# remove any monkeysphere lines from authorized_keys file
remove_monkeysphere_lines "$AUTHORIZED_KEYS"
lockfile-remove "$AUTHORIZED_KEYS"
# note if the authorized_keys file was updated
- if [ "$(cat "$AUTHORIZED_KEYS" | md5sum)" != "$fileCheck" ] ; then
+ if [ "$(file_hash "$AUTHORIZED_KEYS")" != "$fileCheck" ] ; then
log "authorized_keys file updated."
fi
subcommands:
update-users (u) [USER]... update user authorized_keys files
- gen-key (g) [HOSTNAME] generate gpg key for the server
+ gen-key (g) [NAME[:PORT]] generate gpg key for the server
-l|--length BITS key length in bits (2048)
-e|--expire EXPIRE date to expire
-r|--revoker FINGERPRINT add a revoker
- show-fingerprint (f) show server's host key fingerprint
- publish-key (p) publish server's host key to keyserver
- diagnostics (d) report on the server's monkeysphere status
-
- add-identity-certifier (a) KEYID import and tsign a certification key
- -n|--domain DOMAIN limit ID certifications to IDs in DOMAIN
+ add-hostname (n+) NAME[:PORT] add hostname user ID to server key
+ revoke-hostname (n-) NAME[:PORT] revoke hostname user ID
+ show-key (s) output all server host key information
+ fingerprint (f) output just the key fingerprint
+ publish-key (p) publish server host key to keyserver
+ diagnostics (d) report on server monkeysphere status
+
+ add-id-certifier (c+) KEYID import and tsign a certification key
+ -n|--domain DOMAIN limit ID certifications to DOMAIN
-t|--trust TRUST trust level of certifier (full)
-d|--depth DEPTH trust depth for certifier (1)
- remove-identity-certifier (r) KEYID remove a certification key
- list-identity-certifiers (l) list certification keys
+ remove-id-certifier (c-) KEYID remove a certification key
+ list-id-certifiers (c) list certification keys
gpg-authentication-cmd CMD gnupg-authentication command
su_monkeysphere_user "gpg $@"
}
+# output key information
+show_server_key() {
+ gpg_host --list-secret-keys --fingerprint
+}
+
+# output just key fingerprint
+fingerprint_server_key() {
+ gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \
+ grep '^fpr:' | head -1 | cut -d: -f10
+}
+
# update authorized_keys for users
update_users() {
if [ "$1" ] ; then
# output the server fingerprint
fingerprint_server_key "=${userID}"
- # find the key fingerprint of the server primary key
- fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
- grep '^fpr:' | head -1 | cut -d: -f10)
+ # find the key fingerprint of the newly generated key
+ fingerprint=$(fingerprint_server_key)
# export host ownertrust to authentication keyring
log "setting ultimate owner trust for server key..."
log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key"
}
-# gpg output key fingerprint
-fingerprint_server_key() {
- gpg_host --fingerprint --list-secret-keys
+# add hostname user ID to server key
+add_hostname() {
+ if [ -z "$1" ] ; then
+ failure "You must specify a hostname to add."
+ fi
+
+ userID="ssh://${1}"
+
+ if [ "$(gpg_host --list-key "=${userID}")" ] ; then
+ failure "Host userID '$userID' already exists."
+ fi
+
+ fingerprint=$(fingerprint_server_key)
+
+ adduidCommand=$(cat <<EOF
+adduid
+$userID
+
+
+O
+save
+EOF
+ )
+
+ # add uid
+ echo "$adduidCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
+
+ echo "NOTE: new host userID has not been published."
+ echo "Use '$PGRM publish-key' to publish these changes."
+}
+
+# revoke hostname user ID to server key
+revoke_hostname() {
+ if [ -z "$1" ] ; then
+ failure "You must specify a hostname to revoke."
+ fi
+
+ failure "Sorry, not yet implemented."
+
+ echo "NOTE: host userID revokation has not been published."
+ echo "Use '$PGRM publish-key' to publish these changes."
}
# publish server key to keyserver
publish_server_key() {
- read -p "Really publish key to $KEYSERVER? (y/N) " OK; OK=${OK:=N}
+ read -p "Really publish host key to $KEYSERVER? (y/N) " OK; OK=${OK:=N}
if [ ${OK/y/Y} != 'Y' ] ; then
failure "aborting."
fi
+ # find the key fingerprint
+ fingerprint=$(fingerprint_server_key)
+
# publish host key
- # FIXME: need to figure out better way to identify host key
- # dummy command so as not to publish fakes keys during testing
- # eventually:
- #gpg_authentication "--keyserver $KEYSERVER --send-keys $(hostname -f)"
- echo "NOT PUBLISHED (to avoid permanent publication errors during monkeysphere development)."
- echo "The following command should publish the key:"
- echo "monkeysphere-server gpg-authentication-cmd '--keyserver $KEYSERVER --send-keys $(hostname -f)'"
- exit 255
+ gpg_authentication "--keyserver $KEYSERVER --send-keys $fingerprint"
}
diagnostics() {
local fingerprint
local badhostkeys
- seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
+ seckey=$(fingerprint_server_key)
keysfound=$(echo "$seckey" | grep -c ^sec:)
curdate=$(date +%s)
# warn when anything is 2 months away from expiration
echo "$badauthorizedkeys"
echo " - Recommendation: remove the above AuthorizedKeysFile lines from /etc/ssh/sshd_config"
fi
-
-
}
# retrieve key from web of trust, import it into the host keyring, and
gen_key "$@"
;;
- 'show-fingerprint'|'f')
+ 'add-hostname'|'add-name'|'n+')
+ add_hostname "$@"
+ ;;
+
+ 'revoke-hostname'|'revoke-name'|'n-')
+ revoke_hostname "$@"
+ ;;
+
+ 'show-key'|'show'|'s')
+ show_server_key
+ ;;
+
+ 'show-fingerprint'|'fingerprint'|'f')
fingerprint_server_key
;;
- 'publish-key'|'p')
+ 'publish-key'|'publish'|'p')
publish_server_key
;;
diagnostics
;;
- 'add-identity-certifier'|'add-certifier'|'a')
- add_certifier "$1"
+ 'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
+ add_certifier "$@"
;;
- 'remove-identity-certifier'|'remove-certifier'|'r')
- remove_certifier "$1"
+ 'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
+ remove_certifier "$@"
;;
- 'list-identity-certifiers'|'list-certifiers'|'list-certifier'|'l')
+ 'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
list_certifiers "$@"
;;
else
# if the host key is found in the known_hosts file...
# FIXME: this only works for default known_hosts location
- hostKey=$(ssh-keygen -F "$HOST")
+ hostKey=$(ssh-keygen -F "$HOST" 2>/dev/null)
if [ "$hostKey" ] ; then
# do not check the keyserver
--- /dev/null
+[[meta title="monkeysphere-server publish-key does not work"]]
+
+Currently, if you try to run `monkeysphere-server publish-key`, you
+can get the following output:
+
+ Really publish key to subkeys.pgp.net? (y/N) y
+ NOT PUBLISHED (to avoid permanent publication errors during monkeysphere development).
+ The following command should publish the key:
+ monkeysphere-server gpg-authentication-cmd '--keyserver subkeys.pgp.net --send-keys foo.example.org'
+
+I think we've demonstrated that this system works enough to warrant
+using the public keyserver infrastructure.
+
+I suggest that we should actually enable this feature explicitly.
+(leaving in the prompt is fine, though it would be nice to be able to
+`--force` it or something).
+
+---
+
+[[bugs/done]] 2008-08-15 in 6fb350a883fa4d8b1bc9b5e01cc3b01c96354d08
--- /dev/null
+[[meta title="MonkeySphere needs to be able to cleanly export passphrase-locked secret keys from the GPG keyring"]]
+
+At the moment, the only tool we have to export passphrase-locked
+secret keys from the GPG keyring is `gpg` itself (and `gpg2`, which
+has roughly the same behavior).
+
+As a result, we have the `seckey2sshagent` hack, which is unfriendly
+and awkward to use.
+
+Ideally, `openpgp2ssh` would be able to convert passphrase-locked
+secret keys into clean subkeys. However, i've tried to do this via
+GnuTLS, and that library is not ready for this.
+
+OpenCDK, which is the component of GnuTLS which reads OpenPGP-style
+keys, cannot cope with encrypted secret key material. I have had
+[some
+success](http://lists.gnu.org/archive/html/gnutls-devel/2008-06/msg00092.html)
+in getting GnuTLS's OpenCDK to accept the existence of encrypted
+secret key packets, [i learned that OpenCDK as included in GnuTLS is
+incapable of dealing with the encrypted packets
+themselves](http://lists.gnu.org/archive/html/gnutls-devel/2008-07/msg00012.html).
+
+
+Some possible resolutions:
+
+---------
+
+If we can assume that the passphrase-encrypted key we want to use is
+actually a subkey, and if we could fix GnuTLS to ignore the use of the
+"gnu-dummy S2K" produced by `gpg --export-secret-subkeys` for the
+primary key, then something like the following script should actually
+work for reasonable values of `$KEYID`:
+
+ TMPDIR=$(mktemp -d)
+ uname 077
+ mkfifo "$TMPDIR/passphrase"
+ kname="MonkeySphere Key $KEYID"
+ mkfifo "$TMPDIR/$kname"
+ ssh-agent "Please enter the passphrase for MonkeySphere key $KEYID" >"$TMPDIR/passphrase" &
+ gpg --passphrase-fd 3 3<"$TMPDIR/passphrase" --export-options export-reset-subkey-passwd,export-minimal,no-export-attributes --export-secret-subkeys "$KEYID"\! | openpgp2ssh "$KEYID" > "$TMPDIR/$kname"
+ (cd "$TMPDIR" && ssh-add -c "$kname")
+ rm -rf "$TMPDIR"
+
+Good news! [I've crafted a patch for GnuTLS to enable it to read
+exported subkeys using this GNU
+extension](http://lists.gnu.org/archive/html/gnutls-devel/2008-08/msg00005.html),
+so if we can get it incorporated into upstream (and/or into debian),
+we have a possible solution, as long as the authentication key is a
+subkey, and not a primary key.
+
+---------
+
+Ben Laurie and Rachel Willmer's
+[OpenPGPSDK](http://openpgp.nominet.org.uk) is a candidate: this is a
+C-based library that intends to implement RFC 4880 functionality.
+
+We could potentially re-write `openpgp2ssh` using this library, and it
+*should* be able to handle everything we need from the OpenPGP side
+(though it might need to be re-linked to OpenSSL to handle PEM-encoded
+exports.
+
+Concerns:
+
+* OpenPGPSDK is not in debian yet, and doesn't currently (2008-08-13)
+ build with gcc 4.2 or 4.3.
+
+* OpenPGPSDK uses the apache license and appears to link to OpenSSL,
+ which has a GPL-incompatible license. I think this would mean that
+ `openpgp2ssh` could not remain GPL (though the rest of the
+ monkeysphere could).
+
+---------
+
+We could try to use perl. The last time i checked, the pure-perl
+OpenPGP implementations all depended on Math::PARI, which [is not in
+debian](http://bugs.debian.org/440527). The most likely candidate is
+[Crypt::OpenPGP](http://search.cpan.org/~btrott/Crypt-OpenPGP),
+despite [some
+bugginess](http://cpanratings.perl.org/dist/Crypt-OpenPGP).
+
+Concerns:
+
+* the aforementioned buggy reviews
+
+* there's a lot of dependency chasing to get anything like this
+ available in debian.
+
+---------
+
+Other alternatives?
cat: /home/foo/.ssh/known_hosts: No such file or directory
this should be fixable with a simple test.
+
+------
+
+Fixed in 70674cae8b3d69d0e750125387b26c0d5857c5ba.
+
+[[bugs/done]] 2008-08-12
If we're not OK with relying on the agent, `--gen-subkey` needs
fixing.
+
+---
+
+I think requiring the agent and using it for getting the passphrase is
+fine. That should make this bug fairly easy to fix, so I'll get on
+it.
+
+-- BJ (jgr)
+
+---
+
+Alternately, we could use `--passwd-fd` and `ssh-agent`, along the
+lines i proposed [for handling passphrase-locked secret
+keys](/bugs/handle-passphrase-locked-secret-keys).
down the line, but it's not a particular easy task at the moment.
-- Big Jimmy.
+
+---
+
+I've [posted to the `openssh-unix-dev` list to see if there is a
+possibility of openssh making our lives easier
+here](http://marc.info/?l=openssh-unix-dev&m=121804767122918&w=2), but
+i haven't had much of a response yet.
+
+--dkg
+++ /dev/null
-[[meta title="Monkeysphere should consult keyserver setting in gpg.conf"]]
-
-Currently, monkeysphere-ssh-proxycommand checks the following places to
-determine which keyserver to use (in order of priority):
-
- * environment variable (MONKEYSPHERE_KEYSERVER)
- * KEYSERVER variable in ~/.config/monkeysphere/monkeysphere.conf
- * default value of subkeys.pgp.net
-
-It would be useful if monkeysphere also consulted ~/.gnupg/gpg.conf, using the
-following order instead:
-
- * environment variable (MONKEYSPHERE_KEYSERVER)
- * KEYSERVER variable in ~/.config/monkeysphere/monkeysphere.conf
- * keyserver variable in ~/.gnupg/gpg.conf
- * default value of subkeys.pgp.net
-
-- Sir Jam Jam
For example: `george.riseup.net` is now also known as
`monkeysphere.info`. It'd be nice to have a convenient way to add
that hostname to the key without mucking around with gpg directly.
+
+---
+
+So how do we imagine the behavior here? I assume that basically it
+would just add/remove user ID's to/from the host key locally. I guess
+we will continue to rely on the "publish-key" subcommand to actually
+publish all changes to the keys.
+
+-- BJ (jgr)
+
+---
+
+I think [when we reorganize the `monkeysphere-server`
+shortcuts](reorganize-monkeysphere-server-shortcuts) it'll make it
+clearer what the right interface should be.
+
+As for what should actually happen, i think that the server should
+actively revoke old User IDs, rather than removing them. It should
+probably prompt the administrator to re-publish the host key as well,
+to ensure that the new User IDs are published.
+
+ --dkg
--- /dev/null
+[[meta title="Reorganize monkeysphere-server shortcuts"]]
+
+Currently, `monkeysphere-server` supports three subcommands to adjust
+the "identity certifiers":
+
+* `add-identity-certifier` (`a`)
+* `remove-identity-certifier` (`r`)
+* `list-identity-certifier` (`l`)
+
+Since [we also want to be able to add/remove multiple
+hostnames](multiple-hostnames), i think we should change the shortcuts
+from `a`, `r`, and `l` to `c+`, `c-`, and `c`.
+
+This would let us create new subcommands like:
+
+* `add-host-name` (`n+`)
+* `revoke-host-name` (`n-`)
+* `list-host-names` (`n`)
+
+---
+
+[[bugs/done]] 2008-08-14 in 0181b6fc50824941e4f7ac3f535a216b8189568e
before you connect to the host. Here's how...
--dkg
+
+---
+
+So do we agree that george is doing what we want, and we can therefore
+close this bug?
+
+-- BJ (jgr)
+
+---
+
+I'm fine with closing this bug, unless we want to set up the limited
+shell access/welcome letter like i described above. If we want to do
+that, it'd be worth keeping it open until those scripts are written.
+
+I envision a script you'd invoke like:
+
+ root@george# addmsuser foo 'Foo T. Bar <foo@example.org>'
+
+Which would create the `foo` account, populate
+`~foo/.config/monkeysphere/authorized_user_ids`, make a note in a log
+someplace, and send a welcome letter.
+
+--dkg
+
+---
+
+That idea really seems like a lot more trouble than it's worth to me,
+and I'm not really willing to maintain it myself, but if someone else
+wants to handle that, that would be fine with me.
+
+-- jgr
[Daniel Kahn Gillmor](http://cmrg.fifthhorseman.net/wiki/dkg):
- git clone http://lair.fifthhorseman.net/~dkg/git/monkeysphere.git monkeysphere
+ git clone git://lair.fifthhorseman.net/~dkg/monkeysphere monkeysphere
[Micah Anderson]
projects / monkeysphere.git / commitdiff