summaryrefslogtreecommitdiff
path: root/src/common
diff options
context:
space:
mode:
authorJameson Graef Rollins <jrollins@phys.columbia.edu>2008-06-13 15:36:11 -0400
committerJameson Graef Rollins <jrollins@phys.columbia.edu>2008-06-13 16:43:07 -0400
commitad0a9cc0958b30f5be851453ea22c151097fad0c (patch)
tree47b0f796ad7127f556e28880e72839fde13d3276 /src/common
parent0c2c01095b4e3e707a08e9ff6ebe61f18689bcaa (diff)
More cleanup:
- Batch mode for trust_key function. - fix some loggging. - Clean up publish_server_key function -> STILL NON-FUNCTIONING - more work on monkeysphere-ssh-proxycommand man page
Diffstat (limited to 'src/common')
-rw-r--r--src/common108
1 files changed, 73 insertions, 35 deletions
diff --git a/src/common b/src/common
index 0f98923..d56028f 100644
--- a/src/common
+++ b/src/common
@@ -42,7 +42,7 @@ cutline() {
# retrieve all keys with given user id from keyserver
# FIXME: need to figure out how to retrieve all matching keys
# (not just first 5)
-gpg_fetch_keys() {
+gpg_fetch_userid() {
local id
id="$1"
echo 1,2,3,4,5 | \
@@ -69,6 +69,18 @@ check_capability() {
return 0
}
+# get the full fingerprint of a key ID
+get_key_fingerprint() {
+ local keyID
+
+ keyID="$1"
+
+ gpg --list-key --with-colons --fixed-list-mode \
+ --with-fingerprint "$keyID" | grep "$keyID" | \
+ grep '^fpr:' | cut -d: -f10
+}
+
+
# convert escaped characters from gpg output back into original
# character
# FIXME: undo all escape character translation in with-colons gpg output
@@ -139,7 +151,7 @@ process_user_id() {
requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]")
# fetch keys from keyserver, return 1 if none found
- gpg_fetch_keys "$userID" || return 1
+ gpg_fetch_userid "$userID" || return 1
# output gpg info for (exact) userid and store
gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \
@@ -261,6 +273,36 @@ process_user_id() {
echo "$cacheDir"/"$userIDHash"."$pubKeyID"
}
+# update the cache for userid, and prompt to add file to
+# authorized_user_ids file if the userid is found in gpg
+# and not already in file.
+update_userid() {
+ local userID
+ local cacheDir
+ local userIDKeyCache
+
+ userID="$1"
+ cacheDir="$2"
+
+ log "processing userid: '$userID'"
+ userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
+ if [ -z "$userIDKeyCache" ] ; then
+ return 1
+ fi
+ if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+ echo "the following userid is not in the authorized_user_ids file:"
+ echo " $userID"
+ read -p "would you like to add it? [Y|n]: " OK; OK=${OK:=Y}
+ if [ ${OK/y/Y} = 'Y' ] ; then
+ log -n "adding userid to authorized_user_ids file... "
+ echo "$userID" >> "$AUTHORIZED_USER_IDS"
+ echo "done."
+ else
+ log "authorized_user_ids file untouched."
+ fi
+ fi
+}
+
# process a host for addition to a known_host file
process_host() {
local host
@@ -392,42 +434,38 @@ process_userids_from_authorized_keys() {
done
}
-# update the cache for userid, and prompt to add file to
-# authorized_user_ids file if the userid is found in gpg
-# and not already in file.
-update_userid() {
- local userID
- local cacheDir
- local userIDKeyCache
-
- userID="$1"
- cacheDir="$2"
-
- log "processing userid: '$userID'"
- userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
- if [ -z "$userIDKeyCache" ] ; then
- return 1
- fi
- if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
- echo "the following userid is not in the authorized_user_ids file:"
- echo " $userID"
- read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y}
- if [ ${OK/y/Y} = 'Y' ] ; then
- log -n " adding userid to authorized_user_ids file... "
- echo "$userID" >> "$AUTHORIZED_USER_IDS"
- echo "done."
- fi
- fi
-}
-
# retrieve key from web of trust, and set owner trust to "full"
# if key is found.
trust_key() {
# get the key from the key server
- gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'"
+ if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then
+ log "could not retrieve key '$keyID'"
+ return 1
+ fi
+
+ # get key fingerprint
+ fingerprint=$(get_key_fingerprint "$keyID")
+
+ # import "full" trust for fingerprint into gpg
+ echo ${fingerprint}:5: | gpg --import-ownertrust
+ if [ $? = 0 ] ; then
+ log "owner trust updated."
+ else
+ failure "there was a problem changing owner trust."
+ fi
+}
+
+# publish server key to keyserver
+publish_server_key() {
+ read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N}
+ if [ ${OK/y/Y} != 'Y' ] ; then
+ failure "aborting."
+ fi
- # edit the key to change trust
- # FIXME: need to figure out how to automate this,
- # in a batch mode or something.
- gpg --edit-key "$keyID"
+ # publish host key
+ # FIXME: need to figure out better way to identify host key
+ # dummy command so as not to publish fakes keys during testing
+ # eventually:
+ #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f)
+ echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)"
}