Add 'remove_userid' function, inverse of 'update_userids'.

Also, tweaked some of the output and man pages.

diff --git a/debian/control b/debian/control
index afd5bfa9371997aebf8902db7734866761e9c223..d4d25c6cd2c75e2db71df111117fd73e857efb96 100644 (file)
--- a/debian/control
+++ b/debian/control
@@ -10,7 +10,7 @@ Dm-Upload-Allowed: yes
 
 Package: monkeysphere
 Architecture: any
 
 Package: monkeysphere
 Architecture: any

-Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), ${shlibs:Depends}
+Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), moreutils, ${shlibs:Depends}

 Recommends: netcat
 Enhances: openssh-client, openssh-server
 Description: use the OpenPGP web of trust to verify ssh connections
 Recommends: netcat
 Enhances: openssh-client, openssh-server
 Description: use the OpenPGP web of trust to verify ssh connections

diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1
index d00a9db07b2d4765346ae47c4a20d867bfe17374..762f008b4d0a7be3d426de3b60939877bdb1cf47 100644 (file)
--- a/man/man1/monkeysphere.1
+++ b/man/man1/monkeysphere.1
@@ -31,25 +31,32 @@ listed in the known_hosts file will be processed.  `k' may be used in
 place of `update-known_hosts'.
 .TP
 .B update-userids [USERID]...
 place of `update-known_hosts'.
 .TP
 .B update-userids [USERID]...

-Add/update a userid in the authorized_user_ids file.  The user IDs
+Add/update a user ID to the authorized_user_ids file.  The user IDs

 specified should be exact matches to OpenPGP user IDs.  For each
 specified user ID, gpg will be queried for a key associated with that
 user ID, querying a keyserver if none is found in the user's keychain.
 If a key is found, it will be added to the user_keys cache (see KEY
 CACHES) and the user ID will be added to the user's
 specified should be exact matches to OpenPGP user IDs.  For each
 specified user ID, gpg will be queried for a key associated with that
 user ID, querying a keyserver if none is found in the user's keychain.
 If a key is found, it will be added to the user_keys cache (see KEY
 CACHES) and the user ID will be added to the user's

-authorized_user_ids file (if it wasn't already present).
+authorized_user_ids file (if it wasn't already present).  `u' may be
+used in place of `update-userids'.
+.TP
+.B remove-userids [USERID]...
+Remove a user ID from the authorized_user_ids file.  The user IDs
+specified should be exact matches to OpenPGP user IDs.  `r' may be
+used in place of `remove-userids'.

 .TP
 .B update-authorized_keys
 Update the monkeysphere authorized_keys file.  The monkeysphere
 authorized_keys file will be regenerated from the valid keys in the
 user_key cache, and the user's independently controlled
 .TP
 .B update-authorized_keys
 Update the monkeysphere authorized_keys file.  The monkeysphere
 authorized_keys file will be regenerated from the valid keys in the
 user_key cache, and the user's independently controlled

-authorized_keys file (usually ~/.ssh/authorized_keys).
+authorized_keys file (usually ~/.ssh/authorized_keys).  `a' may be
+used in place of `update-authorized_keys'.

 .TP
 .B gen-ae-subkey KEYID
 Generate an `ae` capable subkey.  For the primary key with the
 specified key ID, generate a subkey with "authentication" and
 "encryption" capability that can be used for MonkeySphere
 .TP
 .B gen-ae-subkey KEYID
 Generate an `ae` capable subkey.  For the primary key with the
 specified key ID, generate a subkey with "authentication" and
 "encryption" capability that can be used for MonkeySphere

-transactions.
+transactions.  `g' may be used in place of `gen-ae-subkey'.

 .TP
 .B help
 Output a brief usage summary.  `h' or `?' may be used in place of
 .TP
 .B help
 Output a brief usage summary.  `h' or `?' may be used in place of

diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8
index cc07077cea47e5f8ad38609013a748d39ad8cc5e..8f626108807ae9c3535f1137817bb575df517ce9 100644 (file)
--- a/man/man8/monkeysphere-server.8
+++ b/man/man8/monkeysphere-server.8
@@ -19,18 +19,27 @@ be used for authentication and encryption of ssh connection.
 Update the admin-controlled authorized_keys files for user.  For each
 user specified, update the user's authorized_keys file in
 /var/cache/monkeysphere/USER.  See `man monkeysphere' for more info.
 Update the admin-controlled authorized_keys files for user.  For each
 user specified, update the user's authorized_keys file in
 /var/cache/monkeysphere/USER.  See `man monkeysphere' for more info.

+`k' may be used in place of `update-known_hosts'.

 .TP
 .B gen-key
 .TP
 .B gen-key

-Generate a gpg key for the host.
+Generate a gpg key for the host.  `g' may be used in place of
+`gen-key'.

 .TP
 .B publish-key
 .TP
 .B publish-key

-Publish the host's gpg key to a keyserver.
+Publish the host's gpg key to a keyserver.  `p' may be used in place
+of `publish-key'

 .TP
 .B trust-keys KEYID...
 .TP
 .B trust-keys KEYID...

-Mark key specified with KEYID with full owner trust.
+Mark key specified with KEYID with full owner trust.  `t' may be used
+in place of `trust-keys'.

 .TP
 .B update-user-userids USER USERID...
 .TP
 .B update-user-userids USER USERID...

-Add/update a userid in the authorized_user_ids file for USER.
+Add/update a user ID to the authorized_user_ids file for USER.  `u' may
+be used in place of `update-user-userids'.
+.TP
+.B remove-user-userids USER USERID...
+Remove a user ID from the authorized_user_ids file for USER.  `r' may
+be used in place of `remove-user-userids'.

 .TP
 .B help
 Output a brief usage summary.  `h' or `?' may be used in place of
 .TP
 .B help
 Output a brief usage summary.  `h' or `?' may be used in place of

diff --git a/src/common b/src/common
index d56028fa6e7b36d1d926b1c9366f50a45e3cc4e8..01e6f32093da85de5004ea29b62ec220c7d82bd9 100644 (file)
--- a/src/common
+++ b/src/common
@@ -240,6 +240,9 @@ process_user_id() {
     # hash userid for cache file name
     userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }')
 
     # hash userid for cache file name
     userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }')
 

+    # make sure the cache directory exists
+    mkdir -p "$cacheDir"
+

     # touch/clear key cache file
     # (will be left empty if there are noacceptable keys)
     > "$cacheDir"/"$userIDHash"."$pubKeyID"
     # touch/clear key cache file
     # (will be left empty if there are noacceptable keys)
     > "$cacheDir"/"$userIDHash"."$pubKeyID"


@@ -285,16 +288,16 @@ update_userid() {
     cacheDir="$2"
 
     log "processing userid: '$userID'"
     cacheDir="$2"
 
     log "processing userid: '$userID'"

+

     userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
     userIDKeyCache=$(process_user_id "$userID" "$cacheDir")

+

     if [ -z "$userIDKeyCache" ] ; then
        return 1
     fi
     if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
     if [ -z "$userIDKeyCache" ] ; then
        return 1
     fi
     if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then

-       echo "the following userid is not in the authorized_user_ids file:"
-       echo "  $userID"
-       read -p "would you like to add it? [Y|n]: " OK; OK=${OK:=Y}
+       read -p "user ID not currently authorized.  authorize? [Y|n]: " OK; OK=${OK:=Y}

        if [ ${OK/y/Y} = 'Y' ] ; then
        if [ ${OK/y/Y} = 'Y' ] ; then

-           log -n "adding userid to authorized_user_ids file... "
+           log -n "adding user ID to authorized_user_ids file... "

            echo "$userID" >> "$AUTHORIZED_USER_IDS"
            echo "done."
        else
            echo "$userID" >> "$AUTHORIZED_USER_IDS"
            echo "done."
        else


@@ -303,6 +306,24 @@ update_userid() {
     fi
 }
 
     fi
 }
 

+# remove a userid from the authorized_user_ids file
+remove_userid() {
+    local userID
+
+    userID="$1"
+
+    log "processing userid: '$userID'"
+
+    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+       log "user ID not currently authorized."
+       return 1
+    fi
+
+    log -n "removing user ID '$userID'... "
+    grep -v "$userID" "$AUTHORIZED_USER_IDS" | sponge "$AUTHORIZED_USER_IDS"
+    echo "done."
+}
+

 # process a host for addition to a known_host file
 process_host() {
     local host
 # process a host for addition to a known_host file
 process_host() {
     local host


@@ -373,7 +394,8 @@ update_authorized_keys() {
        cat "$userAuthorizedKeys" >> "$msAuthorizedKeys"
        echo "done."
     fi
        cat "$userAuthorizedKeys" >> "$msAuthorizedKeys"
        echo "done."
     fi

-    log "monkeysphere authorized_keys file generated: $msAuthorizedKeys"
+    log "monkeysphere authorized_keys file generated:"
+    log "$msAuthorizedKeys"

 }
 
 # process an authorized_*_ids file
 }
 
 # process an authorized_*_ids file

diff --git a/src/monkeysphere b/src/monkeysphere
index 997ca582a0dc0d936f117b217e067074fe83e82a..1ba51d79619de218f1c50bf205e752ec50232145 100755 (executable)
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -35,7 +35,8 @@ MonkeySphere client tool.
 
 subcommands:
   update-known_hosts (k) [HOST]...  update known_hosts file
 
 subcommands:
   update-known_hosts (k) [HOST]...  update known_hosts file

-  update-userids (u) [USERID]...    add/update userid
+  update-userids (u) [USERID]...    add/update user IDs
+  remove-userids (r) [USERID]...    remove user IDs

   update-authorized_keys (a)        update authorized_keys file
   gen-ae-subkey (g) KEYID           generate an 'ae' capable subkey
   help (h,?)                        this help
   update-authorized_keys (a)        update authorized_keys file
   gen-ae-subkey (g) KEYID           generate an 'ae' capable subkey
   help (h,?)                        this help


@@ -164,13 +165,26 @@ case $COMMAND in
        fi
        ;;
 
        fi
        ;;
 

-    'update-userids'|'u')
+    'update-userids'|'update-userid'|'u')

        if [ -z "$1" ] ; then
            failure "you must specify at least one userid."
        fi
        for userID ; do
            update_userid "$userID" "$userKeysCacheDir"
        done
        if [ -z "$1" ] ; then
            failure "you must specify at least one userid."
        fi
        for userID ; do
            update_userid "$userID" "$userKeysCacheDir"
        done

+       log "run the following to update your monkeysphere authorized_keys file:"
+       log "$PGRM update-authorized_keys"
+       ;;
+
+    'remove-userids'|'remove-userid'|'r')
+       if [ -z "$1" ] ; then
+           failure "you must specify at least one userid."
+       fi
+       for userID ; do
+           remove_userid "$userID"
+       done
+       log "run the following to update your monkeysphere authorized_keys file:"
+       log "$PGRM update-authorized_keys"

        ;;
 
     'update-authorized_keys'|'update-authorized-keys'|'a')
        ;;
 
     'update-authorized_keys'|'update-authorized-keys'|'a')

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 922aad34df3b4ad56f920b70d675012a84ed4e55..13221c5bcb6c029a51e73347751dc9fd8b270297 100755 (executable)
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -35,7 +35,8 @@ subcommands:
   gen-key (g)                           generate gpg key for the server
   publish-key (p)                       publish server key to keyserver
   trust-keys (t) KEYID...               mark keyids as trusted
   gen-key (g)                           generate gpg key for the server
   publish-key (p)                       publish server key to keyserver
   trust-keys (t) KEYID...               mark keyids as trusted

-  update-user-userids (u) USER UID...   add/update userids for a user
+  update-user-userids (u) USER UID...   add/update user IDs for a user
+  remove-user-userids (r) USER UID...   remove user IDs for a user

   help (h,?)                            this help
 
 EOF
   help (h,?)                            this help
 
 EOF


@@ -179,7 +180,7 @@ case $COMMAND in
        done
        ;;
 
        done
        ;;
 

-    'update-user-userids'|'u')
+    'update-user-userids'|'update-user-userid'|'u')

        uname="$1"
        shift
        if [ -z "$uname" ] ; then
        uname="$1"
        shift
        if [ -z "$uname" ] ; then


@@ -200,6 +201,34 @@ case $COMMAND in
        for userID ; do
            update_userid "$userID" "$cacheDir"
        done
        for userID ; do
            update_userid "$userID" "$cacheDir"
        done

+
+       log "run the following to update user's authorized_keys file:"
+       log "$PGRM update-users $uname"
+       ;;
+
+    'remove-user-userids'|'remove-user-userid'|'r')
+       uname="$1"
+       shift
+       if [ -z "$uname" ] ; then
+           failure "you must specify user."
+       fi
+       if [ -z "$1" ] ; then
+           failure "you must specify at least one userid."
+       fi
+
+       # set variables for the user
+       AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname"
+
+        # make sure user's authorized_user_ids file exists
+       touch "$AUTHORIZED_USER_IDS"
+
+       # process the user IDs
+       for userID ; do
+           remove_userid "$userID"
+       done
+
+       log "run the following to update user's authorized_keys file:"
+       log "$PGRM update-users $uname"

        ;;
 
     'help'|'h'|'?')
        ;;
 
     'help'|'h'|'?')