-monkeysphere (0.8-1) UNRELEASED; urgency=low
+monkeysphere (0.10-1) experimental; urgency=low
+
+ * Fix bug in previous uid processing bug fix (stupid stupid).
+
+ -- Jameson Graef Rollins <jrollins@phys.columbia.edu> Mon, 18 Aug 2008 13:16:15 -0700
+
+monkeysphere (0.9-1) experimental; urgency=low
+
+ [ Daniel Kahn Gillmor ]
+ * implemented "monkeysphere-server extend-key" to adjust expiration
+ date of host key.
+ * removed "monkeysphere-server fingerprint". Use "monkeysphere-server
+ show-key" instead.
+
+ [ Jameson Graef Rollins ]
+ * fixed bug in user id processing that prevented bad primary keys from
+ being properly removed.
+
+ -- Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net> Mon, 18 Aug 2008 15:42:12 -0400
+
+monkeysphere (0.8-1) experimental; urgency=low
[ Daniel Kahn Gillmor ]
* debian/control: switched Vcs-Git to use "centralized" git repo instead
of my own.
* More monkeysphere-server diagnostics
* monkeysphere --gen-subkey now guesses what KeyID you meant.
+ * added Recommends: ssh-askpass to ensure monkeysphere --gen-subkey
+ works sensibly under X11
[ Jameson Graef Rollins ]
- * fix another bug for when ssh key files are missing.
+ * fix another bug when known_hosts files are missing.
* sort processed keys so that "good" keys are processed after "bad"
keys. This will prevent malicious bad keys from causing good keys to
be removed from key files.
* enabled host key publication.
+ * added checking of gpg.conf for keyserver
+ * new functions to add/revoke host key user IDs
+ * improved list-certifiers function (now non-privileged)
- -- Jameson Graef Rollins <jrollins@phys.columbia.edu> Fri, 15 Aug 2008 00:48:22 -0700
+ -- Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net> Mon, 18 Aug 2008 12:43:37 -0400
monkeysphere (0.7-1) experimental; urgency=low
Package: monkeysphere
Architecture: any
Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), moreutils, lockfile-progs, adduser, ${shlibs:Depends}
-Recommends: netcat | socat
+Recommends: netcat | socat, ssh-askpass
Enhances: openssh-client, openssh-server
Description: use the OpenPGP web of trust to verify ssh connections
SSH key-based authentication is tried-and-true, but it lacks a true
* changes to this system (first command at top, last at bottom) *
******************************************************************************
+2008-08-18 - dkg
+ * moved monkeysphere apt repo entry to
+ /etc/apt/sources.list.d/monkeysphere.list
+ * aptitude update && aptitude full-upgrade (including monkeysphere
+ 0.8-1)
+
+2008-08-16 - jrollins
+ * removed stale branches from jrollins from the master repo
+ * aptitude update && aptitude full-upgrade
+ * restarted services to clear up dependencies on old libraries
+
2008-08-13 - dkg
* aptitude update && aptitude full-upgrade
* restarted services to clear up dependencies on old libraries
were found but none were acceptable. `a' may be used in place of
`update-authorized_keys'.
.TP
-.B gen-subkey KEYID
-Generate an authentication subkey. For the primary key with the
-specified key ID, generate a subkey with "authentication" capability
-that can be used for monkeysphere transactions. An expiration length
-can be specified with the `-e' or `--expire' option (prompt
-otherwise). `g' may be used in place of `gen-subkey'.
+.B gen-subkey [KEYID]
+Generate an authentication subkey for a private key in your GnuPG
+keyring. For the primary key with the specified key ID, generate a
+subkey with "authentication" capability that can be used for
+monkeysphere transactions. An expiration length can be specified with
+the `-e' or `--expire' option (prompt otherwise). If no key ID is
+specified, but only one key exists in the secret keyring, that key
+will be used. `g' may be used in place of `gen-subkey'.
.TP
.B help
Output a brief usage summary. `h' or `?' may be used in place of
used in place of `update-users'.
.TP
.B gen-key [HOSTNAME]
-Generate a OpenPGP key pair for the host. If HOSTNAME is not
-specified, then the system fully-qualified domain name will be user.
-An alternate key bit length can be specified with the `-l' or
-`--length' option (default 2048). An expiration length can be
-specified with the `-e' or `--expire' option (prompt otherwise). A
-key revoker fingerprint can be specified with the `-r' or `--revoker'
-option. `g' may be used in place of `gen-key'.
+Generate a OpenPGP key for the host. If HOSTNAME is not specified,
+then the system fully-qualified domain name will be user. An
+alternate key bit length can be specified with the `-l' or `--length'
+option (default 2048). An expiration length can be specified with the
+`-e' or `--expire' option (prompt otherwise). The expiration format
+is the same as that of \fBextend-key\fP, below. A key revoker
+fingerprint can be specified with the `-r' or `--revoker' option. `g'
+may be used in place of `gen-key'.
+.TP
+.B extend-key EXPIRE
+Extend the validity of the OpenPGP key for the host until EXPIRE from
+the present. If EXPIRE is not specified, then the user will be
+prompted for the extension term. Expiration is specified like GnuPG
+does:
+.nf
+ 0 = key does not expire
+ <n> = key expires in n days
+ <n>w = key expires in n weeks
+ <n>m = key expires in n months
+ <n>y = key expires in n years
+.fi
+`e' may be used in place of `extend-key'.
.TP
.B add-hostname HOSTNAME
Add a hostname user ID to the server host key. `n+' may be used in
Output gpg information about host's OpenPGP key. `s' may be used in
place of `show-key'.
.TP
-.B fingerprint
-Output just the fingerprint for the host's OpenPGP key. `f' may be
-used in place of `fingerprint'.
-.TP
.B publish-key
Publish the host's OpenPGP key to the keyserver. `p' may be used in
place of `publish-key'.
md5sum "$1" 2> /dev/null
}
-# convert escaped characters from gpg output back into original
-# character
-# FIXME: undo all escape character translation in with-colons gpg output
-unescape() {
- echo "$1" | sed 's/\\x3a/:/g'
+# convert escaped characters in pipeline from gpg output back into
+# original character
+# FIXME: undo all escape character translation in with-colons gpg
+# output
+gpg_unescape() {
+ sed 's/\\x3a/:/g'
+}
+
+# convert nasty chars into gpg-friendly form in pipeline
+# FIXME: escape everything, not just colons!
+gpg_escape() {
+ sed 's/:/\\x3a/g'
+}
+
+# prompt for GPG-formatted expiration, and emit result on stdout
+get_gpg_expiration() {
+ local keyExpire=
+
+ cat >&2 <<EOF
+Please specify how long the key should be valid.
+ 0 = key does not expire
+ <n> = key expires in n days
+ <n>w = key expires in n weeks
+ <n>m = key expires in n months
+ <n>y = key expires in n years
+EOF
+ while [ -z "$keyExpire" ] ; do
+ read -p "Key is valid for? (0) " keyExpire
+ if ! test_gpg_expire ${keyExpire:=0} ; then
+ echo "invalid value" >&2
+ unset keyExpire
+ fi
+ done
+ echo "$keyExpire"
}
# remove all lines with specified string from specified file
;;
'uid') # user ids
if [ "$lastKey" != pub ] ; then
- log " - got a user ID after a sub key! user IDs should only follow primary keys!"
- continue
- fi
- # don't bother with a uid if there is no valid or reasonable primary key.
- if [ "$keyOK" != true ] ; then
+ log " - got a user ID after a sub key?! user IDs should only follow primary keys!"
continue
fi
# if an acceptable user ID was already found, skip
- if [ "$uidOK" ] ; then
- continue
- fi
- # if the user ID does not match, skip
- if [ "$(unescape "$uidfpr")" != "$userID" ] ; then
+ if [ "$uidOK" = 'true' ] ; then
continue
fi
- # if the user ID validity is not ok, skip
- if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
+ # if the user ID does matches...
+ if [ "$(echo "$uidfpr" | gpg_unescape)" = "$userID" ] ; then
+ # and the user ID validity is ok
+ if [ "$validity" = 'u' -o "$validity" = 'f' ] ; then
+ # mark user ID acceptable
+ uidOK=true
+ fi
+ else
continue
fi
- # mark user ID acceptable
- uidOK=true
-
# output a line for the primary key
# 0 = ok, 1 = bad
if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then
MonkeySphere client tool.
subcommands:
- update-known_hosts (k) [HOST]... update known_hosts file
- update-authorized_keys (a) update authorized_keys file
- gen-subkey (g) KEYID generate an 'a' capable subkey
- -l|--length BITS key length in bits (2048)
- -e|--expire EXPIRE date to expire
- help (h,?) this help
+ update-known_hosts (k) [HOST]... update known_hosts file
+ update-authorized_keys (a) update authorized_keys file
+ gen-subkey (g) [KEYID] generate an authentication subkey
+ --length (-l) BITS key length in bits (2048)
+ --expire (-e) EXPIRE date to expire
+ help (h,?) this help
EOF
}
# generate a subkey with the 'a' usage flags set
-# FIXME: this needs some tweaking to clean it up
gen_subkey(){
local keyLength
local keyExpire
)
log "generating subkey..."
- echo "$editCommands" | gpg --expert --command-fd 0 --edit-key "$keyID"
+ fifoDir=$(mktemp -d)
+ (umask 077 && mkfifo "$fifoDir/pass")
+ echo "$editCommands" | gpg --passphrase-fd 3 3< "$fifoDir/pass" --expert --command-fd 0 --edit-key "$keyID" &
+
+ if [ "$DISPLAY" ] && which ssh-askpass >/dev/null; then
+ ssh-askpass "Please enter your passphrase for $keyID: " > "$fifoDir/pass"
+ else
+ read -s -p "Please enter your passphrase for $keyID: " PASS
+ echo "$PASS" > "$fifoDir/pass"
+ fi
+ rm -rf "$fifoDir"
+ wait
log "done."
}
# set empty config variables with ones from the environment, or from
# config file, or with defaults
GNUPGHOME=${MONKEYSPHERE_GNUPGHOME:=${GNUPGHOME:="${HOME}/.gnupg"}}
-KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="subkeys.pgp.net"}}
+KEYSERVER=${MONKEYSPHERE_KEYSERVER:="$KEYSERVER"}
+# if keyserver not specified in env or monkeysphere.conf,
+# look in gpg.conf
+if [ -z "$KEYSERVER" ] ; then
+ if [ -f "${GNUPGHOME}/gpg.conf" ] ; then
+ KEYSERVER=$(grep -e "^[[:space:]]*keyserver " "${GNUPGHOME}/gpg.conf" | tail -1 | awk '{ print $2 }')
+ fi
+fi
+# if it's still not specified, use the default
+KEYSERVER=${KEYSERVER:="subkeys.pgp.net"}
CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
KNOWN_HOSTS=${MONKEYSPHERE_KNOWN_HOSTS:=${KNOWN_HOSTS:="${HOME}/.ssh/known_hosts"}}
HASH_KNOWN_HOSTS=${MONKEYSPHERE_HASH_KNOWN_HOSTS:=${HASH_KNOWN_HOSTS:="true"}}
gen_subkey "$@"
;;
- 'help'|'h'|'?')
+ '--help'|'help'|'-h'|'h'|'?')
usage
;;
#
# The monkeysphere scripts are written by:
# Jameson Rollins <jrollins@fifthhorseman.net>
+# Daniel Kahn Gillmor <dkg@fifthhorseman.net>
#
# They are Copyright 2008, and are all released under the GPL, version 3
# or later.
update-users (u) [USER]... update user authorized_keys files
gen-key (g) [NAME[:PORT]] generate gpg key for the server
- -l|--length BITS key length in bits (2048)
- -e|--expire EXPIRE date to expire
- -r|--revoker FINGERPRINT add a revoker
+ --length (-l) BITS key length in bits (2048)
+ --expire (-e) EXPIRE date to expire
+ --revoker (-r) FINGERPRINT add a revoker
+ extend-key (e) EXPIRE extend expiration to EXPIRE
add-hostname (n+) NAME[:PORT] add hostname user ID to server key
revoke-hostname (n-) NAME[:PORT] revoke hostname user ID
show-key (s) output all server host key information
- fingerprint (f) output just the key fingerprint
publish-key (p) publish server host key to keyserver
diagnostics (d) report on server monkeysphere status
add-id-certifier (c+) KEYID import and tsign a certification key
- -n|--domain DOMAIN limit ID certifications to DOMAIN
- -t|--trust TRUST trust level of certifier (full)
- -d|--depth DEPTH trust depth for certifier (1)
+ --domain (-n) DOMAIN limit ID certifications to DOMAIN
+ --trust (-t) TRUST trust level of certifier (full)
+ --depth (-d) DEPTH trust depth for certifier (1)
remove-id-certifier (c-) KEYID remove a certification key
list-id-certifiers (c) list certification keys
gpg-authentication-cmd CMD gnupg-authentication command
- -h|--help|help (h,?) this help
+ help (h,?) this help
+
EOF
}
su_monkeysphere_user "gpg $@"
}
-# output key information
-show_server_key() {
- gpg_host --list-secret-keys --fingerprint
-}
-
# output just key fingerprint
fingerprint_server_key() {
- gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \
+ gpg_host --list-secret-keys --fingerprint \
+ --with-colons --fixed-list-mode 2> /dev/null | \
grep '^fpr:' | head -1 | cut -d: -f10
}
+# output key information
+show_server_key() {
+ local fingerprint
+ local tmpkey
+
+ fingerprint=$(fingerprint_server_key)
+ gpg_authentication "--fingerprint --list-key $fingerprint"
+
+ # dumping to a file named ' ' so that the ssh-keygen output
+ # doesn't claim any potentially bogus hostname(s):
+ tmpkey=$(mktemp -d)
+ gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ "
+ echo -n "ssh fingerprint: "
+ (cd "$tmpkey" && ssh-keygen -l -f ' ')
+ rm -rf "$tmpkey"
+ echo -n "OpenPGP fingerprint: "
+ echo "$fingerprint"
+}
+
# update authorized_keys for users
update_users() {
if [ "$1" ] ; then
# prompt about key expiration if not specified
if [ -z "$keyExpire" ] ; then
- cat <<EOF
-Please specify how long the key should be valid.
- 0 = key does not expire
- <n> = key expires in n days
- <n>w = key expires in n weeks
- <n>m = key expires in n months
- <n>y = key expires in n years
-EOF
- while [ -z "$keyExpire" ] ; do
- read -p "Key is valid for? (0) " keyExpire
- if ! test_gpg_expire ${keyExpire:=0} ; then
- echo "invalid value"
- unset keyExpire
- fi
- done
- elif ! test_gpg_expire "$keyExpire" ; then
+ keyExpire=$(get_gpg_expiration)
+ fi
+ if ! test_gpg_expire "$keyExpire" ; then
failure "invalid key expiration value '$keyExpire'."
fi
log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key"
}
+# extend the lifetime of a host key:
+extend_key() {
+ local fpr=$(fingerprint_server_key)
+ local extendTo="$1"
+
+ if [ -z "$fpr" ] ; then
+ failure "You don't appear to have a MonkeySphere host key on this server. Try 'monkeysphere-server gen-key' first."
+ fi
+
+ if [ -z "$extendTo" ]; then
+ extendTo=$(get_gpg_expiration)
+ fi
+ if ! test_gpg_expire "$extendTo" ; then
+ failure "invalid expiration value '$extendTo'."
+ fi
+
+ gpg_host --quiet --command-fd 0 --edit-key "$fpr" <<EOF
+expire
+$extendTo
+save
+EOF
+ echo "NOTE: Host key expiration date adjusted, but not yet published."
+ echo "Run '$PGRM publish-key' to publish the new expiration date."
+}
+
# add hostname user ID to server key
add_hostname() {
+ local userID
+ local fingerprint
+ local tmpuidMatch
+ local line
+ local adduidCommand
+
if [ -z "$1" ] ; then
failure "You must specify a hostname to add."
fi
userID="ssh://${1}"
- if [ "$(gpg_host --list-key "=${userID}")" ] ; then
+ fingerprint=$(fingerprint_server_key)
+
+ # match to only ultimately trusted user IDs
+ tmpuidMatch="u:$(echo $userID | gpg_escape)"
+
+ # find the index of the requsted user ID
+ # NOTE: this is based on circumstantial evidence that the order of
+ # this output is the appropriate index
+ if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \
+ | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then
failure "Host userID '$userID' already exists."
fi
- fingerprint=$(fingerprint_server_key)
+ echo "The following user ID will be added to the host key:"
+ echo " $userID"
+ read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N}
+ if [ ${OK/y/Y} != 'Y' ] ; then
+ failure "User ID not added."
+ fi
+ # edit-key script command to add user ID
adduidCommand=$(cat <<EOF
adduid
$userID
-O
save
EOF
)
- # add uid
- echo "$adduidCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
+ # execute edit-key script
+ if echo "$adduidCommand" | \
+ gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
+ # update trust db
+ gpg_host --check-trustdb
+
+ show_server_key
- echo "NOTE: new host userID has not been published."
- echo "Use '$PGRM publish-key' to publish these changes."
+ echo "NOTE: User ID added to key, but key not published."
+ echo "Run '$PGRM publish-key' to publish the new user ID."
+ else
+ failure "Problem adding user ID."
+ fi
}
# revoke hostname user ID to server key
revoke_hostname() {
+ local userID
+ local fingerprint
+ local tmpuidMatch
+ local line
+ local uidIndex
+ local message
+ local revuidCommand
+
if [ -z "$1" ] ; then
failure "You must specify a hostname to revoke."
fi
- failure "Sorry, not yet implemented."
+ echo "WARNING: There is a known bug in this function."
+ echo "This function has been known to occasionally revoke the wrong user ID."
+ echo "Please see the following bug report for more information:"
+ echo "http://monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/"
+ read -p "Are you sure you would like to proceed? (y/N) " OK; OK=${OK:=N}
+ if [ ${OK/y/Y} != 'Y' ] ; then
+ failure "aborting."
+ fi
+
+ userID="ssh://${1}"
+
+ fingerprint=$(fingerprint_server_key)
+
+ # match to only ultimately trusted user IDs
+ tmpuidMatch="u:$(echo $userID | gpg_escape)"
+
+ # find the index of the requsted user ID
+ # NOTE: this is based on circumstantial evidence that the order of
+ # this output is the appropriate index
+ if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \
+ | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then
+ uidIndex=${line%%:*}
+ else
+ failure "No non-revoked user ID '$userID' is found."
+ fi
+
+ echo "The following host key user ID will be revoked:"
+ echo " $userID"
+ read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N}
+ if [ ${OK/y/Y} != 'Y' ] ; then
+ failure "User ID not revoked."
+ fi
+
+ message="Hostname removed by monkeysphere-server $DATE"
+
+ # edit-key script command to revoke user ID
+ revuidCommand=$(cat <<EOF
+$uidIndex
+revuid
+y
+4
+$message
+
+y
+save
+EOF
+ )
+
+ # execute edit-key script
+ if echo "$revuidCommand" | \
+ gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
+ # update trust db
+ gpg_host --check-trustdb
+
+ show_server_key
- echo "NOTE: host userID revokation has not been published."
- echo "Use '$PGRM publish-key' to publish these changes."
+ echo "NOTE: User ID revoked, but revocation not published."
+ echo "Run '$PGRM publish-key' to publish the revocation."
+ else
+ failure "Problem revoking user ID."
+ fi
}
# publish server key to keyserver
publish_server_key() {
read -p "Really publish host key to $KEYSERVER? (y/N) " OK; OK=${OK:=N}
if [ ${OK/y/Y} != 'Y' ] ; then
- failure "aborting."
+ failure "key not published."
fi
# find the key fingerprint
fingerprint=$(fingerprint_server_key)
# publish host key
- gpg_authentication "--keyserver $KEYSERVER --send-keys $fingerprint"
+ gpg_authentication "--keyserver $KEYSERVER --send-keys '0x${fingerprint}!'"
}
diagnostics() {
local uid
local fingerprint
local badhostkeys
+ local sshd_config
- seckey=$(fingerprint_server_key)
+ # FIXME: what's the correct, cross-platform answer?
+ sshd_config=/etc/ssh/sshd_config
+ seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
keysfound=$(echo "$seckey" | grep -c ^sec:)
curdate=$(date +%s)
# warn when anything is 2 months away from expiration
if [ "$expire" ]; then
if (( "$expire" < "$curdate" )); then
echo "! Host key is expired."
- # FIXME: recommend a way to resolve this other than re-keying?
+ echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
elif (( "$expire" < "$warndate" )); then
echo "! Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
- # FIXME: recommend a way to resolve this?
+ echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
fi
fi
# have a way to do that after key generation?)
# Ensure that the ssh_host_rsa_key file is present and non-empty:
+ echo
echo "Checking host SSH key..."
if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
echo "! The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty."
fi
# propose changes needed for sshd_config (if any)
- if ! grep -q "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
- echo "! /etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
- echo " - Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
+ if ! grep -q "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$" "$sshd_config"; then
+ echo "! $sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
+ echo " - Recommendation: add a line to $sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
fi
- if badhostkeys=$(grep -i '^HostKey' | grep -q -v "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$") ; then
- echo "! /etc/sshd_config refers to some non-monkeysphere host keys:"
+ if badhostkeys=$(grep -i '^HostKey' "$sshd_config" | grep -q -v "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$") ; then
+ echo "! $sshd_config refers to some non-monkeysphere host keys:"
echo "$badhostkeys"
- echo " - Recommendation: remove the above HostKey lines from /etc/ssh/sshd_config"
+ echo " - Recommendation: remove the above HostKey lines from $sshd_config"
fi
fi
fi
# FIXME: make sure that at least one identity certifier exists
+ echo
echo "Checking for MonkeySphere-enabled public-key authentication for users ..."
# Ensure that User ID authentication is enabled:
- if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$" /etc/ssh/sshd_config; then
- echo "! /etc/ssh/sshd_config does not point to monkeysphere authorized keys."
- echo " - Recommendation: add a line to /etc/ssh/sshd_config: 'AuthorizedKeysFile ${VARLIB}/authorized_keys/%u'"
+ if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$" "$sshd_config"; then
+ echo "! $sshd_config does not point to monkeysphere authorized keys."
+ echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${VARLIB}/authorized_keys/%u'"
fi
- if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' | grep -q -v "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$") ; then
- echo "! /etc/sshd_config refers to non-monkeysphere authorized_keys files:"
+ if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -q -v "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$") ; then
+ echo "! $sshd_config refers to non-monkeysphere authorized_keys files:"
echo "$badauthorizedkeys"
- echo " - Recommendation: remove the above AuthorizedKeysFile lines from /etc/ssh/sshd_config"
+ echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config"
fi
}
export keyID
# get the key from the key server
- gpg_authentication "--keyserver $KEYSERVER --recv-key '$keyID'"
+ gpg_authentication "--keyserver $KEYSERVER --recv-key '0x${keyID}!'"
# get the full fingerprint of a key ID
- fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint $keyID" | \
+ fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint 0x${keyID}!" | \
grep '^fpr:' | grep "$keyID" | cut -d: -f10)
+ if [ -z "$fingerprint" ] ; then
+ failure "Key '$keyID' not found."
+ fi
+
+ echo
echo "key found:"
- gpg_authentication "--fingerprint $fingerprint"
+ gpg_authentication "--fingerprint 0x${fingerprint}!"
- echo "Are you sure you want to add this key as a certifier of"
- read -p "users on this system? (y/N) " OK; OK=${OK:-N}
+ echo "Are you sure you want to add the above key as a"
+ read -p "certifier of users on this system? (y/N) " OK; OK=${OK:-N}
if [ "${OK/y/Y}" != 'Y' ] ; then
- failure "aborting."
+ failure "Identity certifier not added."
fi
# export the key to the host keyring
- gpg_authentication "--export $keyID" | gpg_host --import
+ gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
if [ "$trust" == marginal ]; then
trustval=1
elif [ "$trust" == full ]; then
trustval=2
else
- failure "trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)"
+ failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)."
fi
# ltsign command
)
# ltsign the key
- echo "$ltsignCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
+ if echo "$ltsignCommand" | \
+ gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
- # update the trustdb for the authentication keyring
- gpg_authentication "--check-trustdb"
+ # update the trustdb for the authentication keyring
+ gpg_authentication "--check-trustdb"
+
+ echo
+ echo "Identity certifier added."
+ else
+ failure "Problem adding identify certifier."
+ fi
}
# delete a certifiers key from the host keyring
failure "You must specify the key ID of a key to remove."
fi
- # delete the requested key (with prompting)
- gpg_host --delete-key "$keyID"
+ if gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then
+ read -p "Really remove above listed identity certifier? (y/N) " OK; OK=${OK:-N}
+ if [ "${OK/y/Y}" != 'Y' ] ; then
+ failure "Identity certifier not removed."
+ fi
+ else
+ failure
+ fi
+
+ # delete the requested key
+ if gpg_authentication "--delete-key --batch --yes 0x${keyID}!" ; then
+ # delete key from host keyring as well
+ gpg_host --delete-key --batch --yes "0x${keyID}!"
+ # update the trustdb for the authentication keyring
+ gpg_authentication "--check-trustdb"
- # update the trustdb for the authentication keyring
- gpg_authentication "--check-trustdb"
+ echo
+ echo "Identity certifier removed."
+ else
+ failure "Problem removing identity certifier."
+ fi
}
# list the host certifiers
list_certifiers() {
- gpg_host --list-keys
+ local keys
+ local key
+
+ # find trusted keys in authentication keychain
+ keys=$(gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \
+ grep ^pub: | cut -d: -f2,5 | egrep '^(u|f):' | cut -d: -f2)
+
+ # output keys
+ for key in $keys ; do
+ gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key"
+ done
}
# issue command to gpg-authentication keyring
gen_key "$@"
;;
+ 'extend-key'|'e')
+ extend_key "$@"
+ ;;
+
'add-hostname'|'add-name'|'n+')
add_hostname "$@"
;;
show_server_key
;;
- 'show-fingerprint'|'fingerprint'|'f')
- fingerprint_server_key
- ;;
-
'publish-key'|'publish'|'p')
publish_server_key
;;
--- /dev/null
+[[meta title="Add man pages to web site"]]
+
+We should publish the various monkeysphere man pages in browsable form
+somewhere under http://monkeysphere.info/. Ideally, this would be
+updated automatically from the sources for the official man pages
+themselves.
+
+This strikes me as an ikiwiki subproject (implementing a man2html wiki
+compilation language perhaps?).
+
+Interestingly, [ikiwiki's own man page](http://ikiwiki.info/usage/)
+appears to be written in markdown and then converted to nroff.
mkfifo "$TMPDIR/passphrase"
kname="MonkeySphere Key $KEYID"
mkfifo "$TMPDIR/$kname"
- ssh-agent "Please enter the passphrase for MonkeySphere key $KEYID" >"$TMPDIR/passphrase" &
- gpg --passphrase-fd 3 3<"$TMPDIR/passphrase" --export-options export-reset-subkey-passwd,export-minimal,no-export-attributes --export-secret-subkeys "$KEYID"\! | openpgp2ssh "$KEYID" > "$TMPDIR/$kname"
+ ssh-askpass "Please enter the passphrase for MonkeySphere key $KEYID" >"$TMPDIR/passphrase" &
+ gpg --passphrase-fd 3 3<"$TMPDIR/passphrase" \
+ --export-options export-reset-subkey-passwd,export-minimal,no-export-attributes \
+ --export-secret-subkeys "$KEYID"\! | openpgp2ssh "$KEYID" > "$TMPDIR/$kname" &
(cd "$TMPDIR" && ssh-add -c "$kname")
rm -rf "$TMPDIR"
interested, you can run this hacky script but we make no guarantees.
-- Sir Jam Jam
+
+---
+
+I just realized that i think i can test for the presence of [GNU-dummy
+support in
+GnuTLS](http://lists.gnu.org/archive/html/gnutls-devel/2008-08/msg00005.html),
+which means that we can cleanly test whether the proposed [handling of
+passphrase-locked secret
+keys](bugs/handle-passphrase-locked-secret-keys/) is functional. With
+that in mind, I'd like to propose that we could resolve this bug
+simply by adding a new subcommand: `monkeysphere authkey-to-agent`,
+which would fail in the absence of a functionally-patched GnuTLS.
+
+Would this proposal be sufficient to resolve this bug?
+
+--dkg
--- /dev/null
+[[meta title="list-identity-certfiers should run as the non-privileged user"]]
+
+Right now, `monkeysphere-server list-identity-certifiers` runs as the
+superuser, and just lists the keys in the host's keyring. This might
+not be the actual list of valid id certifiers, for a number of reasons:
+
+* the keys themselves might have been revoked by the owner
+
+* the id-certifiers might have been added with a different trust
+ level, or a regexp/domain limitation.
+
+It would make more sense to derive the list of trusted certifiers
+directly from the keyrings as seen by the non-privileged
+`monkeysphere` user, since this user's keyrings are what are going to
+judge the validity of various user IDs.
+
+---
+
+[[bugs/done]] 2008-08-16 in a29b35e69d0fab5f2de42ed5edd9512a6552e75a
Alternately, we could use `--passwd-fd` and `ssh-agent`, along the
lines i proposed [for handling passphrase-locked secret
keys](/bugs/handle-passphrase-locked-secret-keys).
+
+---
+
+[[bugs/done]] as of 2008-08-15 16:48:26-0400 (to be released in 0.8-1)
+
+I opted to go with the `ssh-askpass` route, and fall back to echoing
+stuff to a fifo directly if `ssh-askpass` is not available.
* default value of subkeys.pgp.net
-- Sir Jam Jam
+
+---
+
+[[bugs/done]] 2008-08-15 in ab5cfab5be64cfb5e01c2b660587da43b3097cad
option to get the output. Or - maybe these should be environmental variables?
In any event - someway to suppress informational output would be a useful
improvement.
+
+------
+
+I'd be fine with silent mode as a default, with a more verbose mode
+accessible to the user who desires it.
+
+I'd prefer an environment variable (e.g. `MONKEYSPHERE_VERBOSE` or
+`MONKEYSPHERE_DEBUG`) over a command-line (e.g. `--verbose`) option,
+personally. It's more in keeping with the model we've used in general
+so far.
+
+--dkg
to ensure that the new User IDs are published.
--dkg
+
+[[bugs/done]] on 2008-08-15 15:00:02-0400 in 84b775ff0b36ec4b86e6708844ad2d678eced403
--- /dev/null
+[[meta title="revoke-hostname function revokes wrong hostname user ID"]]
+
+It appears that the monkeysphere-server revoke-hostname function will
+occasionaly revoke the wrong hostname. I say occasionally, but it
+seems to be doing it pretty consistently for me at the moment:
+
+ servo:~ 0$ sudo monkeysphere-server n- servo.finestructure.net
+ The following host key user ID will be revoked:
+ ssh://servo.finestructure.net
+ Are you sure you would like to revoke this user ID? (y/N) y
+ gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc.
+ This is free software: you are free to change and redistribute it.
+ There is NO WARRANTY, to the extent permitted by law.
+
+ Secret key is available.
+
+ pub 1024R/9EEAC276 created: 2008-07-10 expires: never usage: CA
+ trust: ultimate validity: ultimate
+ [ultimate] (1) ssh://localhost.localdomain
+ [ultimate] (2). ssh://servo.finestructure.net
+ [ revoked] (3) ssh://jamie.rollins
+ [ revoked] (4) asdfsdflkjsdf
+ [ revoked] (5) ssh://asdfsdlf.safsdf
+ [ revoked] (6) ssh://bar.baz
+ [ revoked] (7) ssh://foo.bar
+ [ revoked] (8) ssh://
+
+
+ pub 1024R/9EEAC276 created: 2008-07-10 expires: never usage: CA
+ trust: ultimate validity: ultimate
+ [ultimate] (1)* ssh://localhost.localdomain
+ [ultimate] (2). ssh://servo.finestructure.net
+ [ revoked] (3) ssh://jamie.rollins
+ [ revoked] (4) asdfsdflkjsdf
+ [ revoked] (5) ssh://asdfsdlf.safsdf
+ [ revoked] (6) ssh://bar.baz
+ [ revoked] (7) ssh://foo.bar
+ [ revoked] (8) ssh://
+
+ Please select the reason for the revocation:
+ 0 = No reason specified
+ 4 = User ID is no longer valid
+ Q = Cancel
+ (Probably you want to select 4 here)
+ Enter an optional description; end it with an empty line:
+ Reason for revocation: User ID is no longer valid
+ Hostname removed by monkeysphere-server 2008-08-16T17:34:02
+
+ pub 1024R/9EEAC276 created: 2008-07-10 expires: never usage: CA
+ trust: ultimate validity: ultimate
+ [ revoked] (1) ssh://localhost.localdomain
+ [ultimate] (2). ssh://servo.finestructure.net
+ [ revoked] (3) ssh://jamie.rollins
+ [ revoked] (4) asdfsdflkjsdf
+ [ revoked] (5) ssh://asdfsdlf.safsdf
+ [ revoked] (6) ssh://bar.baz
+ [ revoked] (7) ssh://foo.bar
+ [ revoked] (8) ssh://
+
+ gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
+ gpg: depth: 0 valid: 1 signed: 2 trust: 0-, 0q, 0n, 0m, 0f, 1u
+ gpg: depth: 1 valid: 2 signed: 0 trust: 0-, 0q, 0n, 0m, 2f, 0u
+ gpg: next trustdb check due at 2012-01-07
+ sec 1024R/9EEAC276 2008-07-10
+ Key fingerprint = C094 43E0 6882 8BE2 E9AD 516C 45CF 974D 9EEA C276
+ uid ssh://servo.finestructure.net
+ uid [ revoked] ssh://localhost.localdomain
+ uid [ revoked] ssh://jamie.rollins
+ uid [ revoked] asdfsdflkjsdf
+ uid [ revoked] ssh://asdfsdlf.safsdf
+ uid [ revoked] ssh://bar.baz
+ uid [ revoked] ssh://foo.bar
+ uid [ revoked] ssh://
+
+ NOTE: User ID revoked, but revokation not published.
+ Run 'monkeysphere-server publish-key' to publish the revocation.
+ servo:~ 0$
+
+Clearly this is unacceptable. gpg does not let you can't specify a
+uid to revoke from the command line. The uid revokation can only be
+done through edit-key. We do edit-key scripting in other contexts,
+but to revoke a user id you have to specify the uid by "number". We
+currently try to guess the number from the ordering of the output of
+list-key. However, this output does not appear to coincide with the
+ordering in edit-key. I don't have a good solution or fix at the
+moment. Suggestions are most welcome. It may just require some trial
+and error with edit-key to come up with something workable.
+
+This underlines the problem that gpg is currently not very well suited
+for manipulating gpg keyrings non-interactively. It's possible that I
+just haven't figured out how to do it yet, but it's not very clear if
+it is possible. It would be nice to have some alternate tools to use.
+
+-- Big Jimmy.
[Jameson Graef Rollins](http://cmrg.fifthhorseman.net/wiki/jrollins):
- git clone http://lair.fifthhorseman.net/~jrollins/git/monkeysphere.git monkeysphere
+ git clone git://lair.fifthhorseman.net/~jrollins/monkeysphere monkeysphere
[Daniel Kahn Gillmor](http://cmrg.fifthhorseman.net/wiki/dkg):
are tracked via GnuPG, and managed in the `known_hosts` and
`authorized_keys` files used by OpenSSH for connection authentication.
-[[bugs]] | [[download]] | [[news]] | [[documentation|doc]]
+[why?](/why) | [[bugs]] | [[download]] | [[news]] | [[documentation|doc]]
## Conceptual overview ##
"`PubkeyAuthentication`"), rather than relying on a password exchange.
But again, the public part of the key needs to be transmitted to the
server through a secure out-of-band channel (usually via a separate
-password-based SSH connection) in order for this type of
-authentication to work
+password-based SSH connection or a (hopefully signed) e-mail to the
+system administrator) in order for this type of authentication to
+work.
[OpenSSH](http://openssh.com/) currently provides a functional way to
-managing the RSA and DSA keys required for these interactions through
-the `known_hosts` and `authorized_keys` files. However, it lacks
-any type of [Public Key Infrastructure
+manage the RSA and DSA keys required for these interactions through
+the `known_hosts` and `authorized_keys` files. However, it lacks any
+type of [Public Key Infrastructure
(PKI)](http://en.wikipedia.org/wiki/Public_Key_Infrastructure) that
can verify that the keys being used really are the one required or
expected.
--- /dev/null
+[[meta title="MonkeySphere 0.8-1 released!"]]
+
+MonkeySphere 0.8-1 has been released. This release contains bugfixes,
+some UI re-arrangement, and new features for `monkeysphere-server`,
+among other things. [[download]] it now!
--- /dev/null
+[[meta title="MonkeySphere 0.9-1 released!"]]
+
+# MonkeySphere 0.9-1 released! #
+
+MonkeySphere 0.9-1 has been released. This release contains a serious
+bugfix related to host key expiration, and provides the ability for
+server administrators to extend the lifetime of their keys.
+[[download]] it now!
--- /dev/null
+[[meta title="Why should you be interested in the MonkeySphere?"]]
+
+# Why should you be interested in the MonkeySphere? #
+
+## As an `ssh` user ##
+
+Do you use `ssh` to connect to remote machines? Are you tired of
+seeing messages like this?
+
+ The authenticity of host 'foo.example.org (192.0.2.3)' can't be established.
+ RSA key fingerprint is 17:f4:2b:22:90:d4:98:9a:a2:c5:95:4e:4a:89:be:90.
+ Are you sure you want to continue connecting (yes/no)?
+
+Do you actually tediously check the fingerprint against a
+cryptographically-signed message from the admin, or do you just cross
+your fingers and type "yes"? Do you wish there was a better way to do
+it? Shouldn't our tools be able to figure this out automatically?
+
+Do you use `ssh`'s public key authentication for convenience and/or
+added security? Have you ever worried about what might happen if you
+lose control of your key? (Or did you have a key that was compromised
+by [the OpenSSL debacle](http://bugs.debian.org/363516)?) How many
+accounts/machines would you need to clean up to ensure that your old,
+bad key is no longer in use?
+
+Have you ever wished you could phase out an old key and start using a
+new one without having to comb through every single account you have
+ever connected to?
+
+## As an `sshd` administrator ##
+
+If you are a system administrator, have you ever tried to re-key an
+SSH server? How did you ease the change along to your users? How did
+you keep them from getting the big scary warning messages?
+
+Have you ever wanted to allow a colleague key-based access to a
+machine, *without* needing to have a copy of their public key on hand?
+
+Have you ever wanted to be able to revoke the ability of a user's key
+to authenticate across the entire infrastructure you manage, without
+touching each host by hand?
+
+## What's the connection? ##
+
+These questions all stem from rough edges we run up against in regular
+use of SSH that could be improved by a decent [Public Key
+Infrastructure (or
+PKI)](http://dictionary.die.net/public%20key%20infrastructure). A PKI
+at its core is a mechanism to provide answers to a few basic
+questions:
+
+* Do we know who a key actually belongs to? How do we know?
+* Is the key still valid for use?
+
+Given a clearly stated set of initial assumptions, functional
+cryptographic tools, and a PKI, these questions can be clearly
+answered in an automated fashion. We should not need to ask humans to
+do complicated, error-prone things (e.g. checking host key
+fingerprints) except in relatively rare situations (e.g. when two
+people meet in person for the first time).
+
+The good news is that this is all possible, and available with free
+tools!
+
+## Examples ##
+
+Bob is an `ssh` user, and has just been given an account on
+`foo.example.org` by Alice, the `example.org` system administrator,
+who he knows.
+
+Bob already trusts Alice to properly identify all `example.org`
+servers. Alice already knows who Bob is, and the new machine `foo`
+knows that it can rely on Alice's certifications because Alice is its
+administrator.
+
+Alice can set up the new `bob` account on `foo.example.org` without
+needing to give Bob a new passphrase to remember, and without needing
+to even know Bob's current SSH key. She simply tells `foo` that `Bob
+<bob@example.net>` should have access to the `bob` account.
+
+Bob's first connection to his new `bob` account on `foo.example.org`
+is seamless, because all the steps are already in place! Using the
+MonkeySphere, Bob never has to "accept" an unintelligible host key or
+type a password.
+
+When Bob decides to change the key he uses for SSH authentication, he
+can do so at once: he generates a new key, revokes his old key, and
+publishes these changes to the public keyservers. The next time he's
+ready to log into `foo.example.org`, it accepts his new key -- and it
+*won't* accept his old key any longer.
+
+The same thing works for Alice when she decides to re-key
+`foo.example.org` (let's say Alice learned that Eve has compromised
+the old key). Alice generates a new key, revokes the old one,
+publishes the changes, and the next time Bob connects, he connects as
+smoothly as ever. And if Eve tries to use the old host key to
+masquerade as `foo`, Bob's SSH client will refuse to let him connect!
+
+Alice can even quit as `example.org` system administrator, and revoke
+her certifications of all `example.org` hosts. As long as Bob knows
+and trusts the new `example.org` system administrator to identify
+hosts in that domain, there's no problem.
+
+## Why OpenPGP? ##
+
+We believe that OpenPGP is the right PKI to use for this project. It
+allows a very flexible trust model, ranging all over the map, at the
+choice of the user:
+
+* individual per-host certifications by each client (much like the
+ stock OpenSSH behavior),
+
+* strict centralized Certificate Authorities (much like proposed X.509
+ models), and
+
+* a more human-centric model that recognizes individual differences in
+ ranges of trust and acceptance.
+
+Even if Bob *doesn't* trust Alice to identify *all* `example.org`
+hosts, his first connection to `foo.example.org` should give him more
+than an unintelligible string to accept or reject. It should also
+give him the information that Alice (and perhaps her colleague
+Charles) have certified the key. This is far more useful information
+than the current infrastructure allows, and is more meaningful to
+actual humans using these tools than some message like "Certified by
+GloboTrust".
projects / monkeysphere.git / commitdiff