summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rwxr-xr-xsrc/monkeysphere1
-rw-r--r--src/share/common51
-rwxr-xr-xsrc/share/keytrans6
-rw-r--r--src/share/m/gen_subkey6
-rw-r--r--src/share/m/ssh_proxycommand6
-rw-r--r--src/share/m/subkey_to_ssh_agent2
-rw-r--r--src/share/ma/setup4
-rw-r--r--src/share/ma/update_users2
8 files changed, 54 insertions, 24 deletions
diff --git a/src/monkeysphere b/src/monkeysphere
index fbc05b4..147c179 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -48,6 +48,7 @@ subcommands:
gen-subkey (g) [KEYID] generate an authentication subkey
--length (-l) BITS key length in bits (2048)
ssh-proxycommand HOST [PORT] monkeysphere ssh ProxyCommand
+ --no-connect do not make TCP connection to host
subkey-to-ssh-agent (s) store authentication subkey in ssh-agent
version (v) show version number
help (h,?) this help
diff --git a/src/share/common b/src/share/common
index d6e4949..11e7969 100644
--- a/src/share/common
+++ b/src/share/common
@@ -147,8 +147,8 @@ lock() {
local action="$1"
local file="$2"
- if ! ( which lockfile-create >/dev/null 2>/dev/null ) ; then
- if ! ( which lockfile >/dev/null ); then
+ if ! ( type lockfile-create &>/dev/null ) ; then
+ if ! ( type lockfile &>/dev/null ); then
failure "Neither lockfile-create nor lockfile are in the path!"
fi
use_lockfileprogs=
@@ -197,7 +197,7 @@ advance_date() {
local shortunits
# try things the GNU way first
- if date -d "$number $longunits" "$format" >/dev/null 2>&1; then
+ if date -d "$number $longunits" "$format" &>/dev/null; then
date -d "$number $longunits" "$format"
else
# otherwise, convert to (a limited version of) BSD date syntax:
@@ -252,7 +252,13 @@ check_capability() {
# hash of a file
file_hash() {
- md5sum "$1" 2> /dev/null
+ if type md5sum &>/dev/null ; then
+ md5sum "$1"
+ elif type md5 &>/dev/null ; then
+ md5 "$1"
+ else
+ failure "Neither md5sum nor md5 are in the path!"
+ fi
}
# convert escaped characters in pipeline from gpg output back into
@@ -303,7 +309,9 @@ passphrase_prompt() {
local fifo="$2"
local PASS
- if [ "$DISPLAY" ] && which "${SSH_ASKPASS:-ssh-askpass}" >/dev/null; then
+ if [ "$DISPLAY" ] && type "${SSH_ASKPASS:-ssh-askpass}" >/dev/null; then
+ printf 'Launching "%s"\n' "${SSH_ASKPASS:-ssh-askpass}" | log info
+ printf '(with prompt "%s")\n' "$prompt" | log debug
"${SSH_ASKPASS:-ssh-askpass}" "$prompt" > "$fifo"
else
read -s -p "$prompt" PASS
@@ -331,7 +339,7 @@ remove_line() {
fi
# if the string is in the file...
- if grep -q -F "$string" "$file" 2> /dev/null ; then
+ if grep -q -F "$string" "$file" 2>/dev/null ; then
tempfile=$(mktemp "${file}.XXXXXXX") || \
failure "Unable to make temp file '${file}.XXXXXXX'"
@@ -382,7 +390,7 @@ translate_ssh_variables() {
path="$2"
# get the user's home directory
- userHome=$(getent passwd "$uname" | cut -d: -f6)
+ userHome=$(get_homedir "$uname")
# translate '%u' to user name
path=${path/\%u/"$uname"}
@@ -437,7 +445,7 @@ check_key_file_permissions() {
# return 2 if path has group or other writability
if is_write "$gAccess" || is_write "$oAccess" ; then
log error "improper group or other writability on path '$path':"
- log error " group: $gAccess, other: $oAcess"
+ log error " group: $gAccess, other: $oAccess"
return 2
fi
@@ -450,6 +458,25 @@ check_key_file_permissions() {
fi
}
+# return a list of all users on the system
+list_users() {
+ if type getent &>/dev/null ; then
+ # for linux and FreeBSD systems
+ getent passwd | cut -d: -f1
+ elif type dscl &>/dev/null ; then
+ # for Darwin systems
+ dscl localhost -list /Search/Users
+ else
+ failure "Neither getent or dscl is in the path! Could not determine list of users."
+ fi
+}
+
+# return the path to the home directory of a user
+get_homedir() {
+ local uname=${1:-`whoami`}
+ eval "echo ~${uname}"
+}
+
### CONVERSION UTILITIES
# output the ssh key for a given key ID
@@ -458,7 +485,7 @@ gpg2ssh() {
keyID="$1"
- gpg --export "$keyID" | openpgp2ssh "$keyID" 2> /dev/null
+ gpg --export "$keyID" | openpgp2ssh "$keyID" 2>/dev/null
}
# output known_hosts line from ssh key
@@ -549,7 +576,7 @@ gpg_fetch_userid() {
echo 1,2,3,4,5 | \
gpg --quiet --batch --with-colons \
--command-fd 0 --keyserver "$KEYSERVER" \
- --search ="$userID" > /dev/null 2>&1
+ --search ="$userID" &>/dev/null
returnCode="$?"
return "$returnCode"
@@ -809,7 +836,7 @@ process_host_known_hosts() {
# hash from stdin to stdout
tmpfile=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
ssh2known_hosts "$host" "$sshKey" > "$tmpfile"
- ssh-keygen -H -f "$tmpfile" 2> /dev/null
+ ssh-keygen -H -f "$tmpfile" 2>/dev/null
cat "$tmpfile" >> "$KNOWN_HOSTS"
rm -f "$tmpfile" "${tmpfile}.old"
else
@@ -1091,7 +1118,7 @@ process_authorized_user_ids() {
# check permissions on the authorized_user_ids file path
check_key_file_permissions $(whoami) "$authorizedUserIDs" || failure
- if ! meat "$authorizedUserIDs" > /dev/null ; then
+ if ! meat "$authorizedUserIDs" >/dev/null ; then
log debug " no user IDs to process."
return
fi
diff --git a/src/share/keytrans b/src/share/keytrans
index 8b2e2ea..f9288fa 100755
--- a/src/share/keytrans
+++ b/src/share/keytrans
@@ -1,4 +1,4 @@
-#!/usr/bin/perl -w -T
+#!/usr/bin/perl -T
# keytrans: this is an RSA key translation utility; it is capable of
# transforming RSA keys (both public keys and secret keys) between
@@ -195,11 +195,11 @@ my $keyserver_prefs = { nomodify => 0x80
########### Math/Utility Functions ##############
-# see the bottom of page 43 of RFC 4880
+# see the bottom of page 44 of RFC 4880 (http://tools.ietf.org/html/rfc4880#page-44)
sub simple_checksum {
my $bytes = shift;
- return unpack("%32W*",$bytes) % 65536;
+ return unpack("%16C*",$bytes);
}
# calculate the multiplicative inverse of a mod b this is euclid's
diff --git a/src/share/m/gen_subkey b/src/share/m/gen_subkey
index a0fa3ce..05004f6 100644
--- a/src/share/m/gen_subkey
+++ b/src/share/m/gen_subkey
@@ -57,14 +57,16 @@ save"
# setup the temp fifo dir for retrieving the key password
log debug "creating password fifo..."
fifoDir=$(msmktempdir)
- trap "rm -rf $fifoDir" EXIT
(umask 077 && mkfifo "$fifoDir/pass")
- log verbose "generating subkey..."
+ # FIXME: are we adequately cleaning up any trailing gpg process here?
+ trap "rm -rf $fifoDir; kill %% || true" EXIT
echo "$editCommands" | gpg_user --passphrase-fd 3 3< "$fifoDir/pass" --expert --command-fd 0 --edit-key "$keyID" &
+ log debug "Prompting for passphrase"
# FIXME: this needs to fail more gracefully if the passphrase is incorrect
passphrase_prompt "Please enter your passphrase for $keyID: " "$fifoDir/pass"
+ log info "Generating subkey. This may take a long time..."
trap - EXIT
rm -rf "$fifoDir"
diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand
index 77f9d24..74b0f85 100644
--- a/src/share/m/ssh_proxycommand
+++ b/src/share/m/ssh_proxycommand
@@ -186,7 +186,7 @@ URI="ssh://${HOSTP}"
# CHECK_KEYSERVER variable in the monkeysphere.conf file.
# if the host is in the gpg keyring...
-if gpg_user --list-key ="${URI}" 2>&1 >/dev/null ; then
+if gpg_user --list-key ="${URI}" &>/dev/null ; then
# do not check the keyserver
CHECK_KEYSERVER=${CHECK_KEYSERVER:="false"}
@@ -253,9 +253,9 @@ esac
# exec a netcat passthrough to host for the ssh connection
if [ -z "$NO_CONNECT" ] ; then
- if (which nc 2>/dev/null >/dev/null); then
+ if (type nc &>/dev/null); then
exec nc "$HOST" "$PORT"
- elif (which socat 2>/dev/null >/dev/null); then
+ elif (type socat &>/dev/null); then
exec socat STDIO "TCP:$HOST:$PORT"
else
echo "Neither netcat nor socat found -- could not complete monkeysphere-ssh-proxycommand connection to $HOST:$PORT" >&2
diff --git a/src/share/m/subkey_to_ssh_agent b/src/share/m/subkey_to_ssh_agent
index aa647a6..edc177b 100644
--- a/src/share/m/subkey_to_ssh_agent
+++ b/src/share/m/subkey_to_ssh_agent
@@ -27,7 +27,7 @@ subkey_to_ssh_agent() {
local kname
# if there's no agent running, don't bother:
- if [ -z "$SSH_AUTH_SOCK" ] || ! which ssh-add >/dev/null ; then
+ if [ -z "$SSH_AUTH_SOCK" ] || ! type ssh-add >/dev/null ; then
failure "No ssh-agent available."
fi
diff --git a/src/share/ma/setup b/src/share/ma/setup
index b453f3c..4c87009 100644
--- a/src/share/ma/setup
+++ b/src/share/ma/setup
@@ -57,9 +57,9 @@ EOF
if [ -z "$CORE_FPR" ] ; then
log info "setting up Monkeysphere authentication trust core..."
- local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 </dev/urandom | perl -MMIME::Base64 -ne 'print encode_base64($_)'))
+ local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(dd if=/dev/urandom bs=21 count=1 | perl -MMIME::Base64 -ne 'print encode_base64($_)'))
- log debug "generating monkeysphere authentication trust core key ($CORE_KEYLENGTH bits)..."
+ printf "generating monkeysphere authentication trust core key:\nsize: %d bits\nuid: '%s'\n" "$CORE_KEYLENGTH" "$CORE_UID" | log debug
PEM2OPENPGP_USAGE_FLAGS=certify \
PEM2OPENPGP_NEWKEY=$CORE_KEYLENGTH pem2openpgp "$CORE_UID" \
| gpg_core --import \
diff --git a/src/share/ma/update_users b/src/share/ma/update_users
index 3a5c006..c5c74cf 100644
--- a/src/share/ma/update_users
+++ b/src/share/ma/update_users
@@ -24,7 +24,7 @@ if [ "$1" ] ; then
unames="$@"
else
# or just look at all users if none specified
- unames=$(getent passwd | cut -d: -f1)
+ unames=$(list_users)
fi
# set mode
generated by cgit v1.2.3 (git 2.46.0) at 2025-01-14 23:03:27 +0000