diff options
| -rw-r--r-- | doc/TODO | 13 | ||||
| -rwxr-xr-x | src/monkeysphere-server | 9 |
2 files changed, 5 insertions, 17 deletions
@@ -78,28 +78,15 @@ File bug against ssh-keygen about how "-R" option removes comments File bug against ssh-keygen to see if we can get it to write to hash a known_hosts file to/from stdout/stdin. -Add environment variables sections to man pages. - -Environment variable scoping. - -Move environment variable precedence before conf file. - When using ssh-proxycommand, if only host keys found are expired or revoked, then output loud warning with prompt, or fail hard. -Update monkeysphere-ssh-proxycommand man page with new keyserver - checking policy info. - File bug against seahorse about how, when creating new primary keys, it presents option for "RSA (sign only)" but then creates an "esca" key. File bug against enigmail about lack of ability to create subkeys. -Privilege separation: monkeysphere user to handle authn keyring and - generate authorized_keys file (which would be moved into place by - root). Host keyring would be owned by root. - Test and document what happens when any filesystem that the monkeysphere-server relies on and modifies (/tmp, /etc, and /var?) fills up. diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 4d7acc6..19b457f 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -342,6 +342,10 @@ EOF fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \ grep '^fpr:' | head -1 | cut -d: -f10) + # export host ownertrust to authentication keyring + log "setting ultimate owner trust for server key..." + echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust" + # translate the private key to ssh format, and export to a file # for sshs usage. # NOTE: assumes that the primary key is the proper key to use @@ -429,9 +433,6 @@ add_certifier() { fi export keyID - # export host ownertrust to authentication keyring - gpg_host --export-ownertrust | gpg_authentication "--import-ownertrust" - # get the key from the key server gpg_authentication "--keyserver $KEYSERVER --recv-key '$keyID'" @@ -470,7 +471,7 @@ $domain y save EOF -) + ) # ltsign the key echo "$ltsignCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint" |