From: Jameson Graef Rollins <jrollins@phys.columbia.edu>
Date: Thu, 19 Jun 2008 03:48:37 +0000 (-0400)
Subject: Update to new agreed default host key usage flag (only "a" required
X-Git-Tag: monkeysphere_0.1-1~16^2~3
X-Git-Url: https://codewiz.org/gitweb?p=monkeysphere.git;a=commitdiff_plain;h=dcba8ebebf480a051f2b872f89ccbe68ad642f61

Update to new agreed default host key usage flag (only "a" required
for users and hosts).
Update TODO file.
Some other small changes.
---

diff --git a/doc/TODO b/doc/TODO
index 905d198..0402b46 100644
--- a/doc/TODO
+++ b/doc/TODO
@@ -4,13 +4,11 @@ Next-Steps Monkeysphere Projects:
 Handle unknown hosts in such a way that they're not always removed
    from known_hosts file.  Ask user to lsign the host key?
 
-Handle multiple multiple hostnames (multiple user IDs?) when
-   generating host keys with gen-key.
+Handle multiple hostnames (multiple user IDs?) when generating host
+   keys with gen-key.
 
 Make sure alternate ports are handled for known_hosts.
 
-Add environment variables sections to man pages.
-
 Script to import private key into ssh agent.
 
 Provide a friendly interactive UI for marginal or failing client-side
@@ -49,3 +47,28 @@ Make it easier to do domain-relative ssh host trust signatures with
    "tsign" in gpg(1).
 
 Fix the order of questions when user does a tsign in gpg or gpg2.
+
+File bug against ssh-keygen about how "-R" option removes comments
+   from known_hosts file.
+
+File bug against ssh-keygen to see if we can get it to write to hash a
+   known_hosts file to/from stdout/stdin.
+
+Note all threat model reductions (with diagrams).
+
+Add environment variables sections to man pages.
+
+Environment variable scoping.
+
+Move environment variable precedence before conf file.
+
+Handle lockfiles when modifying known_hosts or authorized_keys.
+
+When using ssh-proxycommand, if only host keys found are expired or
+   revoked, then output loud warning with prompt, or fail hard.
+
+Update monkeysphere-ssh-proxycommand man page with new keyserver
+   checking policy info.
+
+Update monkeysphere-ssh-proxycommand man page with info about
+   no-connect option.
diff --git a/etc/monkeysphere.conf b/etc/monkeysphere.conf
index 17c1a14..f2ba4a7 100644
--- a/etc/monkeysphere.conf
+++ b/etc/monkeysphere.conf
@@ -15,7 +15,7 @@
 #   s = sign
 #   c = certify
 #   a = authentication
-#REQUIRED_HOST_KEY_CAPABILITY="e a"
+#REQUIRED_HOST_KEY_CAPABILITY="a"
 #REQUIRED_USER_KEY_CAPABILITY="a"
 
 # ssh known_hosts file
@@ -27,3 +27,7 @@
 
 # ssh authorized_keys file
 #AUTHORIZED_KEYS=~/.ssh/known_hosts
+
+# This overrides other environment variables
+# NOTE: there is leakage
+#CHECK_KEYRING=true
diff --git a/src/common b/src/common
index ac43f0a..9b06b1d 100644
--- a/src/common
+++ b/src/common
@@ -73,7 +73,7 @@ unescape() {
 }
 
 # remove all lines with specified string from specified file
-remove_file_line() {
+remove_line() {
     local file
     local string
 
@@ -395,7 +395,7 @@ remove_userid() {
 
     # remove user ID from file
     log -n " removing user ID '$userID'... "
-    remove_file_line "$AUTHORIZED_USER_IDS" "^${userID}$"
+    remove_line "$AUTHORIZED_USER_IDS" "^${userID}$"
     loge "done."
 }
 
@@ -416,7 +416,7 @@ process_host_known_hosts() {
     while read -r ok keyid ; do
 	sshKey=$(gpg2ssh "$keyid")
 	# remove the old host key line
-	remove_file_line "$KNOWN_HOSTS" "$sshKey"
+	remove_line "$KNOWN_HOSTS" "$sshKey"
 	# if key OK, add new host line
 	if [ "$ok" -eq '0' ] ; then
 	    # hash if specified
@@ -449,7 +449,7 @@ process_uid_authorized_keys() {
     while read -r ok keyid ; do
 	sshKey=$(gpg2ssh "$keyid")
 	# remove the old host key line
-	remove_file_line "$AUTHORIZED_KEYS" "$sshKey"
+	remove_line "$AUTHORIZED_KEYS" "$sshKey"
 	# if key OK, add new host line
 	if [ "$ok" -eq '0' ] ; then
 	    ssh2authorized_keys "$userID" "$sshKey" >> "$AUTHORIZED_KEYS"
diff --git a/src/monkeysphere b/src/monkeysphere
index 6853f58..a6cecfd 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -115,7 +115,7 @@ AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
 GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
 KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
 CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"}
-REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"}
+REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"a"}
 REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
 KNOWN_HOSTS=${KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
 AUTHORIZED_KEYS=${AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"}