diff options
| -rw-r--r-- | man/man1/monkeysphere-ssh-proxycommand.1 | 2 | ||||
| -rwxr-xr-x | src/monkeysphere-host | 33 | ||||
| -rwxr-xr-x | tests/basic | 5 |
3 files changed, 10 insertions, 30 deletions
diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1 index 1606a5d..65edd0b 100644 --- a/man/man1/monkeysphere-ssh-proxycommand.1 +++ b/man/man1/monkeysphere-ssh-proxycommand.1 @@ -6,7 +6,7 @@ monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script .SH DESCRIPTION -\fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used +\fBmonkeysphere-ssh-proxycommand\fP is an ssh proxy command that can be used to trigger a monkeysphere update of the ssh known_hosts file for a host that is being connected to with ssh. This works by updating the known_hosts file for the host first, before an attempted connection to diff --git a/src/monkeysphere-host b/src/monkeysphere-host index 9eed3ac..bf58616 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -105,16 +105,6 @@ gpg_host() { return "$returnCode" } -# check if user is root -is_root() { - [ $(id -u 2>/dev/null) = '0' ] -} - -# check that user is root, for functions that require root access -check_user() { - is_root || failure "You must be root to run this command." -} - # output just key fingerprint fingerprint_server_key() { # set the pipefail option so functions fails if can't read sec key @@ -138,14 +128,14 @@ show_server_key() { local ret=0 # FIXME: you shouldn't have to be root to see the host key fingerprint - if is_root ; then - check_host_keyring - fingerprintPGP=$(fingerprint_server_key) - gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null - echo "OpenPGP fingerprint: $fingerprintPGP" - else + check_host_keyring + fingerprintPGP=$(fingerprint_server_key) + gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null + if [ $? -ne 0 ] ; then log info "You must be root to see host OpenPGP fingerprint." ret='1' + else + echo "OpenPGP fingerprint: $fingerprintPGP" fi if [ -f "${SYSDATADIR}/ssh_host_rsa_key.pub" ] ; then @@ -257,10 +247,6 @@ gen_key() { # get options while true ; do case "$1" in - -h|--hostname) - hostName="$2" - shift 2 - ;; -l|--length) keyLength="$2" shift 2 @@ -278,6 +264,7 @@ gen_key() { failure "Unknown option '$1'. Type '$PGRM help' for usage." fi + hostName="$1" break ;; esac @@ -752,37 +739,31 @@ case $COMMAND in ;; 'extend-key'|'e') - check_user check_host_keyring extend_key "$@" ;; 'add-hostname'|'add-name'|'n+') - check_user check_host_keyring add_hostname "$@" ;; 'revoke-hostname'|'revoke-name'|'n-') - check_user check_host_keyring revoke_hostname "$@" ;; 'add-revoker'|'o') - check_user check_host_keyring add_revoker "$@" ;; 'revoke-key'|'r') - check_user check_host_keyring revoke_key "$@" ;; 'publish-key'|'publish'|'p') - check_user check_host_keyring publish_server_key ;; diff --git a/tests/basic b/tests/basic index 5ba7a25..7fdca39 100755 --- a/tests/basic +++ b/tests/basic @@ -8,8 +8,7 @@ # Copyright: 2008 # License: GPL v3 or later -# these tests should all be able to -# as a non-privileged user. +# these tests should all be able to run as a non-privileged user. # all subcommands in this script should complete without failure: set -e @@ -193,7 +192,7 @@ echo | monkeysphere-server gen-key --length 1024 --expire 0 testhost # remove the gpg.conf rm "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf -HOSTKEYID=$( monkeysphere-server show-key | tail -n1 | cut -f3 -d\ ) +HOSTKEYID=$( monkeysphere-server show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\ ) # certify it with the "Admin's Key". # (this would normally be done via keyservers) |