diff options
Diffstat (limited to 'rhesus')
| -rw-r--r-- | rhesus/README | 7 | ||||
| -rwxr-xr-x | rhesus/rhesus | 139 |
2 files changed, 146 insertions, 0 deletions
diff --git a/rhesus/README b/rhesus/README new file mode 100644 index 0000000..226361c --- /dev/null +++ b/rhesus/README @@ -0,0 +1,7 @@ +rhesus is the monkeysphere authorized_keys generator. + +It's goal is to take a user's auth_user_ids file, which contains gpg +user ids (and possibly authorized_keys options), use gpg to fetch the +keys of the specified users, do a monkeysphere policy check on each +id, and generate authorized_keys lines for verified id. + diff --git a/rhesus/rhesus b/rhesus/rhesus new file mode 100755 index 0000000..fe98b39 --- /dev/null +++ b/rhesus/rhesus @@ -0,0 +1,139 @@ +#!/bin/sh + +# rhesus: monkeysphere authorized_keys update script +# +# Written by +# Jameson Rollins <jrollins@fifthhorseman.net> +# +# Copyright 2008, released under the GPL, version 3 or later + +################################################## +# load conf file +#. /etc/monkeysphere/monkeysphere.conf +. ~/ms/monkeysphere.conf + +#AUTH_KEYS_DIR_BASE=/var/lib/monkeysphere/authorized_keys/ +AUTH_KEYS_DIR_BASE=~/ms/authorized_keys + +export GNUPGHOME +################################################## + +CMD=$(basename $0) + +usage() { +cat <<EOF +usage: $CMD USERNAME +EOF +} + +failure() { + echo "$1" >&2 + exit ${2:-'1'} +} + +meat() { + grep -v -e "^[[:space:]]*#" -e '^$' "$1" +} + +cutline() { + head --line="$1" | tail -1 +} + +### MAIN + +if [ -z "$1" ] ; then + usage + exit 1 +fi + +# user name of user to update +USERNAME="$1" +if ! id "$USERNAME" > /dev/null ; then + failure "User '$USERNAME' does not exist." +fi + +AUTH_USER_IDS="$AUTH_USER_IDS_DIR"/"$USERNAME" +if [ ! -e "$AUTH_USER_IDS" ] ; then + failure "No auth_user_ids file for user '$USERNAME'." +fi + +AUTH_KEYS_DIR="$AUTH_KEYS_DIR_BASE"/"$USERNAME"/keys +AUTH_KEYS_FILE="$AUTH_KEYS_DIR_BASE"/authorized_keys + +# make sure the gnupg home exists with proper permissions +mkdir -p "$GNUPGHOME" +chmod 0700 "$GNUPGHOME" + +# find number of user ids in auth_user_ids file +NLINES=$(meat "$AUTH_USER_IDS" | wc -l) + +# clean out keys file and remake keys directory +rm -rf "$AUTH_KEYS_DIR" +mkdir -p "$AUTH_KEYS_DIR" + +# loop through all user ids, and generate ssh keys +for (( N=1; N<=$NLINES; N=N+1 )) ; do + # get user id + USERID=$(meat "$AUTH_USER_IDS" | cutline "$N" ) + USERID_HASH=$(echo "$USERID" | sha1sum | awk '{ print $1 }') + + KEYFILE="$AUTH_KEYS_DIR"/"$USERID_HASH" + + # search for key on keyserver + echo -n "ms: finding key for '$USERID'..." + RETURN=$(echo 1 | gpg --quiet --batch --command-fd 0 --with-colons --keyserver "$KEYSERVER" --search ="$USERID" 2> /dev/null) + + # if the key was found... + if [ "$RETURN" ] ; then + echo " found." + + # checking key attributes + # see /usr/share/doc/gnupg/DETAILS.gz: + + PUB_INFO=$(gpg --fixed-list-mode --with-colons --list-keys --with-fingerprint ="$USERID" | grep '^pub:') + + echo -n "ms: " + +# # if not an authorization key exit +# if echo "$PUB_INFO" | cut -d: -f12 | grep -v -q '[aA]' ; then +# echo "not an authorization key --> SKIPPING" +# continue +# fi + + # if key is not fully trusted exit + # (this includes not revoked or expired) + # determine trust + TRUST=$(echo "$PUB_INFO" | cut -d: -f2) + case "$TRUST" in + 'i') + echo -n "invalid" ;; + 'r') + echo -n "revoked" ;; + 'e') + echo -n "expired" ;; + '-'|'q'|'n'|'m') + echo -n "unacceptable trust" ;; + 'f'|'u') + echo -n "fully trusted" + # convert pgp key to ssh key, and write to cache file + echo " -> generating ssh key..." + gpgkey2ssh "$KEYID" | sed -e "s/COMMENT/$USERID/" > "$KEYFILE" + continue + ;; + *) + echo -n "unknown trust" ;; + esac + echo " -> SKIPPING" + fi +done + +if [ $(ls "$AUTH_KEYS_DIR") ] ; then + echo "ms: writing ms authorized_keys file..." + cat "$AUTH_KEYS_DIR"/* > "$AUTH_KEYS_FILE" +else + echo "ms: no gpg keys to add to authorized_keys file." +fi +if [ -s ~"$USERNAME"/.ssh/authorized_keys ] ; then + echo "ms: adding user authorized_keys..." + cat ~"$USERNAME"/.ssh/authorized_keys >> "$AUTH_KEYS_FILE" +fi |