diff options
| -rw-r--r-- | man/man1/monkeysphere-ssh-proxycommand.1 | 31 | ||||
| -rw-r--r-- | src/common | 108 | ||||
| -rwxr-xr-x | src/monkeysphere | 23 | ||||
| -rwxr-xr-x | src/monkeysphere-server | 19 |
4 files changed, 109 insertions, 72 deletions
diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1 index 41a95aa..63b5a5e 100644 --- a/man/man1/monkeysphere-ssh-proxycommand.1 +++ b/man/man1/monkeysphere-ssh-proxycommand.1 @@ -2,19 +2,32 @@ .SH NAME monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script .PD -.SH SYNOPSIS -.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ... -.PD .SH DESCRIPTION .PP -MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh -authentication and encryption. OpenPGP keys are tracked via GnuPG, -and added to the ssh authorized_keys and known_hosts files to be used -for authentication and encryption of ssh connection. - \fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used to trigger a monkeysphere update of the known_hosts file for the hosts -that are being connected to. +that are being connected to. It is meant to be run as an ssh +ProxyCommand. This can either be done by specifying the proxy command +on the command line: + +.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ... + +or by adding the following line to your ~/.ssh/config script: + +.B ProxyCommand monkeysphere-ssh-proxycommand %h %p + +The script is very simple, and can easily be incorporated into other +ProxyCommand scripts. All it does is first runs + +.B monkeysphere update-known-hosts HOST + +and then + +.B exec nc HOST PORT + +Run the following command for more info: + +.B less $(which monkeysphere-ssh-proxycommand) .PD .SH AUTHOR Written by Jameson Rollins <jrollins@fifthhorseman.net> @@ -42,7 +42,7 @@ cutline() { # retrieve all keys with given user id from keyserver # FIXME: need to figure out how to retrieve all matching keys # (not just first 5) -gpg_fetch_keys() { +gpg_fetch_userid() { local id id="$1" echo 1,2,3,4,5 | \ @@ -69,6 +69,18 @@ check_capability() { return 0 } +# get the full fingerprint of a key ID +get_key_fingerprint() { + local keyID + + keyID="$1" + + gpg --list-key --with-colons --fixed-list-mode \ + --with-fingerprint "$keyID" | grep "$keyID" | \ + grep '^fpr:' | cut -d: -f10 +} + + # convert escaped characters from gpg output back into original # character # FIXME: undo all escape character translation in with-colons gpg output @@ -139,7 +151,7 @@ process_user_id() { requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") # fetch keys from keyserver, return 1 if none found - gpg_fetch_keys "$userID" || return 1 + gpg_fetch_userid "$userID" || return 1 # output gpg info for (exact) userid and store gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ @@ -261,6 +273,36 @@ process_user_id() { echo "$cacheDir"/"$userIDHash"."$pubKeyID" } +# update the cache for userid, and prompt to add file to +# authorized_user_ids file if the userid is found in gpg +# and not already in file. +update_userid() { + local userID + local cacheDir + local userIDKeyCache + + userID="$1" + cacheDir="$2" + + log "processing userid: '$userID'" + userIDKeyCache=$(process_user_id "$userID" "$cacheDir") + if [ -z "$userIDKeyCache" ] ; then + return 1 + fi + if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + echo "the following userid is not in the authorized_user_ids file:" + echo " $userID" + read -p "would you like to add it? [Y|n]: " OK; OK=${OK:=Y} + if [ ${OK/y/Y} = 'Y' ] ; then + log -n "adding userid to authorized_user_ids file... " + echo "$userID" >> "$AUTHORIZED_USER_IDS" + echo "done." + else + log "authorized_user_ids file untouched." + fi + fi +} + # process a host for addition to a known_host file process_host() { local host @@ -392,42 +434,38 @@ process_userids_from_authorized_keys() { done } -# update the cache for userid, and prompt to add file to -# authorized_user_ids file if the userid is found in gpg -# and not already in file. -update_userid() { - local userID - local cacheDir - local userIDKeyCache - - userID="$1" - cacheDir="$2" - - log "processing userid: '$userID'" - userIDKeyCache=$(process_user_id "$userID" "$cacheDir") - if [ -z "$userIDKeyCache" ] ; then - return 1 - fi - if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then - echo "the following userid is not in the authorized_user_ids file:" - echo " $userID" - read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y} - if [ ${OK/y/Y} = 'Y' ] ; then - log -n " adding userid to authorized_user_ids file... " - echo "$userID" >> "$AUTHORIZED_USER_IDS" - echo "done." - fi - fi -} - # retrieve key from web of trust, and set owner trust to "full" # if key is found. trust_key() { # get the key from the key server - gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" + if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then + log "could not retrieve key '$keyID'" + return 1 + fi + + # get key fingerprint + fingerprint=$(get_key_fingerprint "$keyID") + + # import "full" trust for fingerprint into gpg + echo ${fingerprint}:5: | gpg --import-ownertrust + if [ $? = 0 ] ; then + log "owner trust updated." + else + failure "there was a problem changing owner trust." + fi +} + +# publish server key to keyserver +publish_server_key() { + read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N} + if [ ${OK/y/Y} != 'Y' ] ; then + failure "aborting." + fi - # edit the key to change trust - # FIXME: need to figure out how to automate this, - # in a batch mode or something. - gpg --edit-key "$keyID" + # publish host key + # FIXME: need to figure out better way to identify host key + # dummy command so as not to publish fakes keys during testing + # eventually: + #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f) + echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)" } diff --git a/src/monkeysphere b/src/monkeysphere index 69741e1..782ba5e 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -136,6 +136,7 @@ mkdir -p -m 0700 "$GNUPGHOME" mkdir -p -m 0700 "$MS_HOME" mkdir -p "$hostKeysCacheDir" mkdir -p "$userKeysCacheDir" +touch "$AUTHORIZED_USER_IDS" case $COMMAND in 'update-known_hosts'|'update-known-hosts'|'k') @@ -163,12 +164,21 @@ case $COMMAND in fi ;; + 'update-userids'|'u') + if [ -z "$1" ] ; then + failure "you must specify at least one userid." + fi + for userID ; do + update_userid "$userID" "$userKeysCacheDir" + done + ;; + 'update-authorized_keys'|'update-authorized-keys'|'a') MODE='authorized_keys' # make sure authorized_user_ids file exists if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - failure "authorized_user_ids file is empty or does not exist." + failure "$AUTHORIZED_USER_IDS is empty." fi # set user-controlled authorized_keys file path @@ -178,15 +188,6 @@ case $COMMAND in update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir" ;; - 'update-userids'|'u') - if [ -z "$1" ] ; then - failure "you must specify at least one userid." - fi - for userID ; do - update_userid "$userID" "$userKeysCacheDir" - done - ;; - 'gen-ae-subkey'|'g') keyID="$1" if [ -z "$keyID" ] ; then @@ -201,6 +202,6 @@ case $COMMAND in *) failure "Unknown command: '$COMMAND' -Type 'cereal-admin help' for usage." +Type '$PGRM help' for usage." ;; esac diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 65a7dda..ffb3452 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -94,21 +94,6 @@ EOF echo "$keyParameters" | gpg --batch --gen-key } -# publish server key to keyserver -publish_key() { - read -p "publish key to $KEYSERVER? [Y|n]: " OK; OK=${OK:=Y} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "aborting." - fi - - keyID=$(gpg --list-key --with-colons ="$USERID" 2> /dev/null | grep '^pub:' | cut -d: -f5) - - # dummy command so as not to publish fakes keys during testing - # eventually: - #gpg --send-keys --keyserver "$KEYSERVER" "$keyID" - echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $keyID" -} - ######################################################################## # MAIN ######################################################################## @@ -176,7 +161,7 @@ case $COMMAND in ;; 'publish-key'|'p') - publish_key + publish_server_key ;; 'trust-keys'|'t') @@ -210,6 +195,6 @@ case $COMMAND in *) failure "Unknown command: '$COMMAND' -Type 'cereal-admin help' for usage." +Type '$PGRM help' for usage." ;; esac |