Move to /var/lib/monkeysphere instead of /var/cache/monkeysphere.

Improve ms-server update-user function.  Update/fix config files to
remove some unwanted configs, and clarify some things.

3 files changed, 54 insertions, 35 deletions

diff --git a/src/common b/src/common
index 986cc33..ead3736 100644
--- a/src/common
+++ b/src/common
@@ -16,8 +16,6 @@
 # managed directories
 ETC="/etc/monkeysphere"
 export ETC
-CACHE="/var/cache/monkeysphere"
-export CACHE
 
 ########################################################################
 ### UTILITY FUNCTIONS
diff --git a/src/monkeysphere b/src/monkeysphere
index 11254e7..d8d4667 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -128,15 +128,17 @@ MS_CONF=${MS_CONF:-"${MS_HOME}/monkeysphere.conf"}
 [ -e "$MS_CONF" ] && . "$MS_CONF"
 
 # set empty config variable with defaults
-AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
 GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
 KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
 CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"}
-REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"a"}
-REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
 KNOWN_HOSTS=${KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
-AUTHORIZED_KEYS=${AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"}
 HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"}
+AUTHORIZED_KEYS=${AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"}
+
+# other variables
+AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
+REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"a"}
+REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
 
 export GNUPGHOME
 
@@ -146,7 +148,6 @@ mkdir -p -m 0700 "$GNUPGHOME"
 # make sure the user monkeysphere home directory exists
 mkdir -p -m 0700 "$MS_HOME"
 touch "$AUTHORIZED_USER_IDS"
-touch "$AUTHORIZED_KEYS"
 
 case $COMMAND in
     'update-known_hosts'|'update-known-hosts'|'k')
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index db2f428..a198c33 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -11,9 +11,12 @@
 ########################################################################
 PGRM=$(basename $0)
 
-SHAREDIR=${SHAREDIR:-"/usr/share/monkeysphere"}
-export SHAREDIR
-. "${SHAREDIR}/common"
+SHARE=${SHARE:-"/usr/share/monkeysphere"}
+export SHARE
+. "${SHARE}/common"
+
+VARLIB="/var/lib/monkeysphere"
+export VARLIB
 
 # date in UTF format if needed
 DATE=$(date -u '+%FT%T')
@@ -49,8 +52,9 @@ gen_key() {
     local hostName
 
     hostName=${1:-$(hostname --fqdn)}
-    service=${SERVICE:-"ssh"}
-    userID="${service}://${hostName}"
+
+    SERVICE=${SERVICE:-"ssh"}
+    userID="${SERVICE}://${hostName}"
 
     if gpg --list-key ="$userID" > /dev/null 2>&1 ; then
 	failure "Key for '$userID' already exists"
@@ -154,21 +158,20 @@ MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere-server.conf}
 [ -e "$MS_CONF" ] && . "$MS_CONF"
 
 # set empty config variable with defaults
-GNUPGHOME=${GNUPGHOME:-"${MS_HOME}/gnupg"}
 KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
 CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"}
-REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
 AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"%h/.config/monkeysphere/authorized_user_ids"}
-USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
+RAW_AUTHORIZED_KEYS=${RAW_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
 
-export GNUPGHOME
+# other variables
+REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
+GNUPGHOME_HOST=${GNUPGHOME_HOST:-"${VARLIB}/gnupg-host"}
+GNUPGHOME_AUTHENTICATION=${GNUPGHOME_AUTHENTICATION:-"${VARLIB}/gnupg-authentication"}
 
-# make sure the monkeysphere home directory exists
-mkdir -p "${MS_HOME}/authorized_user_ids"
-# make sure gpg home exists with proper permissions
+# set default GNUPGHOME, and make sure the directory exists
+GNUPGHOME="$GNUPGHOME_HOST"
+export GNUPGHOME
 mkdir -p -m 0700 "$GNUPGHOME"
-# make sure the authorized_keys directory exists
-mkdir -p "${CACHE}/authorized_keys"
 
 case $COMMAND in
     'update-users'|'update-user'|'u')
@@ -180,25 +183,43 @@ case $COMMAND in
 	    unames=$(getent passwd | cut -d: -f1)
 	fi
 
+	# set mode
+	MODE="authorized_keys"
+
+        # make sure the authorized_keys directory exists
+	mkdir -p "${VARLIB}/authorized_keys"
+
+	# set GNUPGHOME, and make sure the directory exists
+	GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
+	export GNUPGHOME
+	mkdir -p -m 0700 "$GNUPGHOME"
+
 	# loop over users
 	for uname in $unames ; do
-	    MODE="authorized_keys"
-
 	    # check all specified users exist
 	    if ! getent passwd "$uname" >/dev/null ; then
 		error "----- unknown user '$uname' -----"
 		continue
 	    fi
 
-	    log "----- user: $uname -----"
-
-	    # set authorized_user_ids variable, translating ssh-style
-	    # path variables
+	    # set authorized_user_ids and raw authorized_keys variables,
+	    # translating ssh-style path variables
 	    authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
+	    rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
+
+	    # if neither is found, skip user
+	    if [ ! -s "$authorizedUserIDs" -a ! -s "$rawAuthorizedKeys" ] ; then
+		continue
+	    fi
+
+	    log "----- user: $uname -----"
 
 	    # temporary authorized_keys file
 	    AUTHORIZED_KEYS=$(mktemp)
 
+	    # trap to delete file on exit
+	    trap "rm -f $AUTHORIZE_KEYS" EXIT
+
 	    # process authorized_user_ids file
 	    if [ -s "$authorizedUserIDs" ] ; then
 		log "processing authorized_user_ids file..."
@@ -206,16 +227,16 @@ case $COMMAND in
 	    fi
 
 	    # add user-controlled authorized_keys file path if specified
-	    if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" != '-' ] ; then
-		userAuthorizedKeys=$(translate_ssh_variables "$uname" "$USER_CONTROLLED_AUTHORIZED_KEYS")
-		if [ -s "$userAuthorizedKeys" ] ; then
-		    log -n "adding user's authorized_keys file... "
-		    cat "$userAuthorizedKeys" >> "$AUTHORIZED_KEYS"
+	    if [ "$RAW_AUTHORIZED_KEYS" != '-' ] ; then
+		if [ -s "$rawAuthorizedKeys" ] ; then
+		    log -n "adding raw authorized_keys file... "
+		    cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
 		    loge "done."
 		fi
 	    fi
 
-	    # if the resulting authorized_keys file is not empty
+	    # if the resulting authorized_keys file is not empty, move
+	    # the temp authorized_keys file into place
 	    if [ -s "$AUTHORIZED_KEYS" ] ; then
 		# openssh appears to check the contents of the
                 # authorized_keys file as the user in question, so the
@@ -224,8 +245,7 @@ case $COMMAND in
 		chgrp $(getent passwd "$uname" | cut -f4 -d:) "$AUTHORIZED_KEYS"
 		chmod g+r "$AUTHORIZED_KEYS"
 
-		# move the temp authorized_keys file into place
-		mv -f "$AUTHORIZED_KEYS" "${CACHE}/authorized_keys/${uname}"
+		mv -f "$AUTHORIZED_KEYS" "${VARLIB}/authorized_keys/${uname}"
 
 		log "authorized_keys file updated."