diff options
Diffstat (limited to 'src')
| -rwxr-xr-x | src/keytrans/pem2openpgp | 15 | ||||
| -rwxr-xr-x | src/monkeysphere-authentication | 15 | ||||
| -rwxr-xr-x | src/monkeysphere-host | 137 | ||||
| -rw-r--r-- | src/share/common | 13 | ||||
| -rw-r--r-- | src/share/ma/add_certifier | 17 | ||||
| -rw-r--r-- | src/share/ma/setup | 13 | ||||
| -rw-r--r-- | src/share/mh/add_hostname | 16 | ||||
| -rw-r--r-- | src/share/mh/add_revoker | 85 | ||||
| -rw-r--r-- | src/share/mh/gen_key | 68 | ||||
| -rw-r--r-- | src/share/mh/import_key | 19 | ||||
| -rw-r--r-- | src/share/mh/revoke_hostname | 24 | ||||
| -rw-r--r-- | src/share/mh/set_expire (renamed from src/share/mh/extend_key) | 17 |
12 files changed, 253 insertions, 186 deletions
diff --git a/src/keytrans/pem2openpgp b/src/keytrans/pem2openpgp index c765002..2631da6 100755 --- a/src/keytrans/pem2openpgp +++ b/src/keytrans/pem2openpgp @@ -347,13 +347,16 @@ sub fingerprint { return Digest::SHA1::sha1(pack('Cn', 0x99, length($rsabody)).$rsabody); } -# we're just not dealing with newline business right now. slurp in -# the whole file. -undef $/; -my $buf = <STDIN>; - -my $rsa = Crypt::OpenSSL::RSA->new_private_key($buf); +my $rsa; +if (defined $ENV{PEM2OPENPGP_NEWKEY}) { + $rsa = Crypt::OpenSSL::RSA->generate_key($ENV{PEM2OPENPGP_NEWKEY}); +} else { + # we're just not dealing with newline business right now. slurp in + # the whole file. + undef $/; + $rsa = Crypt::OpenSSL::RSA->new_private_key(<STDIN>); +} $rsa->use_sha1_hash(); diff --git a/src/monkeysphere-authentication b/src/monkeysphere-authentication index 4485bd4..6d2e72c 100755 --- a/src/monkeysphere-authentication +++ b/src/monkeysphere-authentication @@ -70,19 +70,6 @@ subcommands: EOF } -# function to run command as monkeysphere user -su_monkeysphere_user() { - # if the current user is the monkeysphere user, then just eval - # command - if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then - eval "$@" - - # otherwise su command as monkeysphere user - else - su "$MONKEYSPHERE_USER" -c "$@" - fi -} - # function to interact with the gpg core keyring gpg_core() { GNUPGHOME="$GNUPGHOME_CORE" @@ -184,7 +171,7 @@ case $COMMAND in list_certifiers "$@" ;; - 'expert'|'e') + 'expert') SUBCOMMAND="$1" shift case "$SUBCOMMAND" in diff --git a/src/monkeysphere-host b/src/monkeysphere-host index a6fa62f..be398b1 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -14,6 +14,9 @@ ######################################################################## set -e +# set the pipefail option so pipelines fail on first command failure +set -o pipefail + PGRM=$(basename $0) SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"} @@ -65,70 +68,98 @@ subcommands: EOF } -# function to run command as monkeysphere user -su_monkeysphere_user() { - # if the current user is the monkeysphere user, then just eval - # command - if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then - eval "$@" +# function to interact with the gpg keyring +gpg_host() { + GNUPGHOME="$GNUPGHOME_HOST" gpg "$@" +} + +# command to list the info about the host key, in colon format +gpg_host_list() { + gpg_host --list-keys --with-colons --fixed-list-mode \ + --with-fingerprint --with-fingerprint \ + "0x${HOST_FINGERPRINT}!" - # otherwise su command as monkeysphere user - else - su "$MONKEYSPHERE_USER" -c "$@" - fi } -# function to interact with the gpg keyring -gpg_host() { - local returnCode +# command for edit key scripts, takes scripts on stdin +gpg_host_edit() { + gpg_host --quiet --command-fd 0 --edit-key \ + "0x${HOST_FINGERPRINT}!" "$@" +} - GNUPGHOME="$GNUPGHOME_HOST" - export GNUPGHOME +# export the host key to stdout +gpg_host_export() { + gpg_host --export --armor --export-options export-minimal \ + "0x${HOST_FINGERPRINT}!" +} - # NOTE: we supress this warning because we need the monkeysphere - # user to be able to read the host pubring. we realize this might - # be problematic, but it's the simplest solution, without too much - # loss of security. - gpg "$@" +# export the host key to the monkeysphere host file key +gpg_host_export_to_ssh_file() { + log debug "exporting openpgp public key..." + + gpg_host_export > "$HOST_KEY_PUB_GPG" + log info "SSH host public key in OpenPGP form: $HOST_KEY_PUB_GPG" } # output just key fingerprint -fingerprint_host_key() { - # set the pipefail option so functions fails if can't read sec key - set -o pipefail - +# FIXME: should not have to be priviledged user to get host +# fingerprint. should be taken from publicly accessible key files, +# instead of the keyring. +get_host_fingerprint() { gpg_host --list-secret-keys --fingerprint \ --with-colons --fixed-list-mode 2> /dev/null | \ - grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null + grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null || true +} + +# output the index of a user ID on the host key +# return 1 if user ID not found +find_host_userid() { + local userID="$1" + local tmpuidMatch + local line + + # match to only ultimately trusted user IDs + tmpuidMatch="u:$(echo $userID | gpg_escape)" + + # find the index of the requsted user ID + # NOTE: this is based on circumstantial evidence that the order of + # this output is the appropriate index + line=$(gpg_host_list | egrep '^(uid|uat):' | cut -f2,10 -d: | \ + grep -n -x -F "$tmpuidMatch" 2>/dev/null) + + if [ "$line" ] ; then + echo ${line%%:*} + return 0 + else + return 1 + fi } # function to check for host secret key -check_host_keyring() { - fingerprint_host_key >/dev/null \ - || failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-host import-key' first." +check_host_fail() { + [ "$HOST_FINGERPRINT" ] || \ + failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-host expert import-key' first." } # show info about the host key show_key() { - local fingerprintPGP local fingerprintSSH - # FIXME: you shouldn't have to be root to see the host key fingerprint - check_host_keyring - fingerprintPGP=$(fingerprint_host_key) + gpg_host --fingerprint --list-key --list-options show-unusable-uids \ + "0x${HOST_FINGERPRINT}!" 2>/dev/null + # FIXME: make sure expiration date is shown - gpg_host --fingerprint --list-key --list-options show-unusable-uids "0x${fingerprintPGP}!" 2>/dev/null - echo "OpenPGP fingerprint: $fingerprintPGP" + echo "OpenPGP fingerprint: $HOST_FINGERPRINT" - if [ -f "${MHDATADIR}/ssh_host_rsa_key.pub" ] ; then - fingerprintSSH=$(ssh-keygen -l -f "${MHDATADIR}/ssh_host_rsa_key.pub" | \ + if [ -f "$HOST_KEY_PUB" ] ; then + fingerprintSSH=$(ssh-keygen -l -f "$HOST_KEY_PUB" | \ awk '{ print $1, $2, $4 }') + echo "ssh fingerprint: $fingerprintSSH" else - log info "SSH host key not found." + log error "SSH host key not found." fi - # FIXME: show expiration date # FIXME: other relevant key parameters? } @@ -155,6 +186,13 @@ MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkey CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"} GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"} +# host key fingerprint +HOST_FINGERPRINT=$(get_host_fingerprint) + +# host pub key files +HOST_KEY_PUB="${SYSDATADIR}/ssh_host_rsa_key.pub" +HOST_KEY_PUB_GPG="${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" + # export variables needed in su invocation export DATE export MODE @@ -163,56 +201,57 @@ export MONKEYSPHERE_USER export KEYSERVER export GNUPGHOME_HOST export GNUPGHOME +export HOST_FINGERPRINT # get subcommand COMMAND="$1" [ "$COMMAND" ] || failure "Type '$PGRM help' for usage." shift + case $COMMAND in 'show-key'|'show'|'s') - check_host_keyring + check_host_fail show_key ;; - # FIXME: what should we call this command? 'set-expire'|'extend-key'|'e') - check_host_keyring - source "${MHSHAREDIR}/extend_key" - extend_key "$@" + check_host_fail + source "${MHSHAREDIR}/set_expire" + set_expire "$@" ;; 'add-hostname'|'add-name'|'n+') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/add_hostname" add_hostname "$@" ;; 'revoke-hostname'|'revoke-name'|'n-') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/revoke_hostname" revoke_hostname "$@" ;; 'add-revoker'|'o') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/add_revoker" add_revoker "$@" ;; 'revoke-key'|'r') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/revoke_key" revoke_key "$@" ;; 'publish-key'|'publish'|'p') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/publish_key" publish_key ;; - 'expert'|'e') + 'expert') SUBCOMMAND="$1" shift case "$SUBCOMMAND" in diff --git a/src/share/common b/src/share/common index 00a1008..2a20c1c 100644 --- a/src/share/common +++ b/src/share/common @@ -90,6 +90,19 @@ log() { done } +# run command as monkeysphere user +su_monkeysphere_user() { + # if the current user is the monkeysphere user, then just eval + # command + if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then + eval "$@" + + # otherwise su command as monkeysphere user + else + su "$MONKEYSPHERE_USER" -c "$@" + fi +} + # cut out all comments(#) and blank lines from standard input meat() { grep -v -e "^[[:space:]]*#" -e '^$' "$1" diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier index 60a4f9d..e9731cc 100644 --- a/src/share/ma/add_certifier +++ b/src/share/ma/add_certifier @@ -27,19 +27,15 @@ add_certifier() { -local domain -local trust -local depth +local domain= +local trust=full +local depth=1 local keyID +local importinfo local fingerprint local ltsignCommand local trustval -# set default values for trust depth and domain -domain= -trust=full -depth=1 - # get options while true ; do case "$1" in @@ -90,7 +86,7 @@ if [ -f "$keyID" ] ; then keyID=$(echo "$importinfo" | grep '^gpg: key ' | cut -f2 -d: | cut -f3 -d\ ) if [ -z "$keyID" ] || [ $(echo "$keyID" | wc -l) -ne 1 ] ; then - failure "Expected there to be a single gpg key in the file." + failure "There was not exactly one gpg key in the file." fi else # get the key from the key server @@ -132,8 +128,7 @@ case "$trust" in ;; esac -# this is the gpg "script" that gpg --edit-key will execute for the -# core to sign certifier. +# edit-key script to ltsign key # NOTE: *all* user IDs will be ltsigned ltsignCommand=$(cat <<EOF ltsign diff --git a/src/share/ma/setup b/src/share/ma/setup index 422cfd3..034f047 100644 --- a/src/share/ma/setup +++ b/src/share/ma/setup @@ -53,17 +53,8 @@ EOF local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 </dev/urandom | base64)) - local TMPLOC=$(mktemp -d "${MATMPDIR}"/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!" - - # generate the key with ssh-keygen... - log debug "generating ssh key ($CORE_KEYLENGTH bits)..." - ssh-keygen -q -b "$CORE_KEYLENGTH" -t rsa -N '' -f "${TMPLOC}/authkey" || failure "Could not generate new key for Monkeysphere authentication trust core" - # and then translate to openpgp encoding and import - # FIXME: pem2openpgp currently sets the A flag and a short - # expiration date. We should set the C flag and no expiration - # date. - log debug "converting ssh key to openpgp key and importing into core..." - < "${TMPLOC}/authkey" pem2openpgp "$CORE_UID" | gpg_core --import || failure "Could not import new key for Monkeysphere authentication trust core" + log debug "generating monkeysphere authentication trust core key ($CORE_KEYLENGTH bits)..." + PEM2OPENPGP_USAGE_FLAGS=certify PEM2OPENPGP_NEWKEY=$CORE_KEYLENGTH pem2openpgp "$CORE_UID" | gpg_core --import || failure "Could not import new key for Monkeysphere authentication trust core" # get fingerprint of core key. should definitely not be empty at this point log debug "get core key fingerprint..." diff --git a/src/share/mh/add_hostname b/src/share/mh/add_hostname index 267f109..46326bb 100644 --- a/src/share/mh/add_hostname +++ b/src/share/mh/add_hostname @@ -27,18 +27,9 @@ fi userID="ssh://${1}" -fingerprint=$(fingerprint_host_key) - -# match to only ultimately trusted user IDs -tmpuidMatch="u:$(echo $userID | gpg_escape)" - -# find the index of the requsted user ID -# NOTE: this is based on circumstantial evidence that the order of -# this output is the appropriate index -if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ - | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then +# test that the desired user ID does not already exist +find_host_userid > /dev/null && \ failure "Host userID '$userID' already exists." -fi echo "The following user ID will be added to the host key:" echo " $userID" @@ -58,8 +49,7 @@ EOF ) # execute edit-key script -if echo "$adduidCommand" | \ - gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then +if echo "$adduidCommand" | gpg_host_edit ; then show_key diff --git a/src/share/mh/add_revoker b/src/share/mh/add_revoker index f9d0bb6..39dfaca 100644 --- a/src/share/mh/add_revoker +++ b/src/share/mh/add_revoker @@ -15,7 +15,92 @@ add_revoker() { +local domain= +local trust=full +local depth=1 +local keyID +local importinfo +local fingerprint +local ltsignCommand +local trustval + +keyID="$1" +if [ -z "$keyID" ] ; then + failure "You must specify the key ID of a revoker key, or specify a file to read the key from." +fi +if [ -f "$keyID" ] ; then + log info "Reading key from file '$keyID':" + importinfo=$(gpg_host --import < "$keyID" 2>&1) || failure "could not read key from '$keyID'" + # FIXME: if this is tried when the key database is not + # up-to-date, i got these errors (using set -x): + + # ++ su -m monkeysphere -c '\''gpg --import'\'' + # Warning: using insecure memory! + # gpg: key D21739E9: public key "Daniel Kahn Gillmor <dkg@fifthhorseman.net>" imported + # gpg: Total number processed: 1 + # gpg: imported: 1 (RSA: 1) + # gpg: can'\''t create `/var/monkeysphere/gnupg-host/pubring.gpg.tmp'\'': Permission denied + # gpg: failed to rebuild keyring cache: Permission denied + # gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model + # gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u + # gpg: next trustdb check due at 2009-01-10' + # + failure 'could not read key from '\''/root/dkg.gpg'\''' + # + echo 'could not read key from '\''/root/dkg.gpg'\''' + + keyID=$(echo "$importinfo" | grep '^gpg: key ' | cut -f2 -d: | cut -f3 -d\ ) + if [ -z "$keyID" ] || [ $(echo "$keyID" | wc -l) -ne 1 ] ; then + failure "There was not exactly one gpg key in the file." + fi +else + # create a temporary directory for storing the downloaded key + TMPLOC=$(mktemp -d ${MHTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!" + + # download the key from the keyserver as the monkeysphere user + su_monkeysphere_user \ + "GNUPGHOME=$TMPLOC gpg --keyserver $KEYSERVER --recv-key 0x${keyID}!" + + # export the new key to the host keyring + su_monkeysphere_user "GNUPGHOME=$TMPLOC gpg --export 0x${keyID}!" \ + | gpg_host --import +fi + +export keyID + +# get the full fingerprint of the revoker key ID +fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "0x${keyID}!" \ + | grep '^fpr:' | grep "$keyID" | cut -d: -f10) + +if [ -z "$fingerprint" ] ; then + failure "Key '$keyID' not found." +fi + +log info -e "\nkey found:" +gpg_host --fingerprint "0x${fingerprint}!" + +echo "Are you sure you want to add the above key as a" +read -p "revoker of the host key? (y/N) " OK; OK=${OK:-N} +if [ "${OK/y/Y}" != 'Y' ] ; then + failure "Revoker not added." +fi + +# edit-key script to add revoker +# NOTE: *all* user IDs will be ltsigned +addrevokerCommand=$(cat <<EOF +addrevoker + +EOF + ) + # FIXME: implement! failure "not implemented yet!" +# core ltsigns the newly imported revoker key +if echo "$addrevokerCommand" | \ + gpg_core_edit ; then + + log info -e "\nRevoker added." +else + failure "Problem adding revoker." +fi + } diff --git a/src/share/mh/gen_key b/src/share/mh/gen_key index eb951cf..7b427e4 100644 --- a/src/share/mh/gen_key +++ b/src/share/mh/gen_key @@ -13,19 +13,16 @@ gen_key() { +local hostName=$(hostname -f) local keyType="RSA" local keyLength="2048" local keyUsage="auth" local keyExpire="0" -local hostName=$(hostname -f) local userID -local keyParameters -local fingerprint -# check for presense of secret key -# FIXME: is this the proper test to be doing here? -fingerprint_host_key >/dev/null \ - && failure "An OpenPGP host key already exists." +# check for presense of a key +[ "$HOST_FINGERPRINT" ] && \ + failure "An OpenPGP host key already exists." # get options while true ; do @@ -39,65 +36,50 @@ while true ; do failure "Unknown option '$1'. Type '$PGRM help' for usage." fi - hostName="$1" - shift break ;; esac done +hostName="$1" userID="ssh://${hostName}" -# set key parameters -keyParameters=\ -"Key-Type: $keyType +# create host home +mkdir -p "$GNUPGHOME_HOST" +chmod 700 "$GNUPGHOME_HOST" + +log debug "generating host key..." +gpg_host --batch --gen-key <<EOF +Key-Type: $keyType Key-Length: $keyLength Key-Usage: $keyUsage Name-Real: $userID -Expire-Date: $keyExpire" - -echo "The following key parameters will be used for the host key:" -echo "$keyParameters" - -read -p "Generate key? (Y/n) " OK; OK=${OK:=Y} -if [ ${OK/y/Y} != 'Y' ] ; then - failure "aborting." -fi - -# add commit command -# must include blank line! -keyParameters=\ -"${keyParameters} +Expire-Date: $keyExpire %commit -%echo done" - -# create host home -mkdir -p "$GNUPGHOME_HOST" -chmod 700 "$GNUPGHOME_HOST" +%echo done -log verbose "generating host key..." -echo "$keyParameters" | gpg_host --batch --gen-key +EOF -# find the key fingerprint of the newly generated key -fingerprint=$(fingerprint_host_key) +# find the key fingerprint of the newly converted key +HOST_FINGERPRINT=$(get_host_fingerprint) +export HOST_FINGERPRINT # translate the private key to ssh format, and export to a file # for sshs usage. # NOTE: assumes that the primary key is the proper key to use -log debug "exporting new secret key to ssh format..." +log debug "exporting ssh secret key..." (umask 077 && \ - gpg_host --export-secret-key "$fingerprint" | \ - openpgp2ssh "$fingerprint" > "${MHDATADIR}/ssh_host_rsa_key") + gpg_host --export-secret-key "$HOST_FINGERPRINT" | \ + openpgp2ssh "$HOST_FINGERPRINT" > "${MHDATADIR}/ssh_host_rsa_key") log info "SSH host private key output to file: ${MHDATADIR}/ssh_host_rsa_key" log debug "creating ssh public key..." -ssh-keygen -y -f "${MHDATADIR}/ssh_host_rsa_key" > "${MHDATADIR}/ssh_host_rsa_key.pub" -log info "SSH host public key output to file: ${MHDATADIR}/ssh_host_rsa_key.pub" +ssh-keygen -y -f "${MHDATADIR}/ssh_host_rsa_key" > "$HOST_KEY_PUB" +log info "SSH host public key output to file: $HOST_KEY_PUB" -log debug "exporting openpgp public key..." -gpg_host --export-options export-minimal --armor --export "0x${fingerprint}!" > "${MHDATADIR}/ssh_host_rsa_key.pub.gpg" -log info "SSH host public key in OpenPGP form: ${MHDATADIR}/ssh_host_rsa_key.pub.gpg" +# export public key to file +gpg_host_export_to_ssh_file # show info about new key show_key diff --git a/src/share/mh/import_key b/src/share/mh/import_key index 2e73a8c..99511a8 100644 --- a/src/share/mh/import_key +++ b/src/share/mh/import_key @@ -15,12 +15,10 @@ import_key() { local hostName local userID -local fingerprint -# check for presense of secret key -# FIXME: is this the proper test to be doing here? -fingerprint_host_key >/dev/null \ - && failure "An OpenPGP host key already exists." +# check for presense of a key +[ "$HOST_FINGERPRINT" ] && \ + failure "An OpenPGP host key already exists." hostName=${1:-$(hostname -f)} @@ -32,16 +30,15 @@ chmod 700 "$GNUPGHOME_HOST" log verbose "importing ssh key..." # translate ssh key to a private key -(umask 077 && \ - pem2openpgp "$userID" | gpg_host --import) +PEM2OPENPGP_USAGE_FLAGS=authenticate pem2openpgp "$userID" | \ + gpg_host --import # find the key fingerprint of the newly converted key -fingerprint=$(fingerprint_host_key) +HOST_FINGERPRINT=$(get_host_fingerprint) +export HOST_FINGERPRINT # export public key to file -log debug "exporting openpgp public key..." -gpg_host --export-options export-minimal --armor --export "0x${fingerprint}!" > "${MHDATADIR}/ssh_host_rsa_key.pub.gpg" -log info "SSH host public key in OpenPGP form: ${MHDATADIR}/ssh_host_rsa_key.pub.gpg" +gpg_host_export_to_ssh_file # show info about new key show_key diff --git a/src/share/mh/revoke_hostname b/src/share/mh/revoke_hostname index 06b5810..940b5f4 100644 --- a/src/share/mh/revoke_hostname +++ b/src/share/mh/revoke_hostname @@ -38,20 +38,9 @@ fi userID="ssh://${1}" -fingerprint=$(fingerprint_host_key) - -# match to only ultimately trusted user IDs -tmpuidMatch="u:$(echo $userID | gpg_escape)" - -# find the index of the requsted user ID -# NOTE: this is based on circumstantial evidence that the order of -# this output is the appropriate index -if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ - | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then - uidIndex=${line%%:*} -else - failure "No non-revoked user ID '$userID' is found." -fi +# make sure the user ID to revoke +uidIndex=$(find_host_userid) || \ + failure "No non-revoked user ID found matching '$userID'." echo "The following host key user ID will be revoked:" echo " $userID" @@ -60,15 +49,13 @@ if [ ${OK/y/Y} != 'Y' ] ; then failure "User ID not revoked." fi -message="Hostname removed by monkeysphere-server $DATE" - # edit-key script command to revoke user ID revuidCommand=$(cat <<EOF $uidIndex revuid y 4 -$message +Hostname removed by monkeysphere-host: $DATE y save @@ -76,8 +63,7 @@ EOF ) # execute edit-key script -if echo "$revuidCommand" | \ - gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then +if echo "$revuidCommand" | gpg_host_edit ; then show_key diff --git a/src/share/mh/extend_key b/src/share/mh/set_expire index 79ee267..653149f 100644 --- a/src/share/mh/extend_key +++ b/src/share/mh/set_expire @@ -1,7 +1,10 @@ # -*-shell-script-*- # This should be sourced by bash (though we welcome changes to make it POSIX sh compliant) -# Monkeysphere host extend-key subcommand +# Monkeysphere host set-expire subcommand +# +# This is a function to set the expiration date of the monkeysphere +# host key. # # The monkeysphere scripts are written by: # Jameson Rollins <jrollins@finestructure.net> @@ -11,18 +14,14 @@ # They are Copyright 2008-2009, and are all released under the GPL, # version 3 or later. -# extend the lifetime of a host key: - -extend_key() { +set_expire() { -local fpr=$(fingerprint_host_key) -local extendTo="$1" +local extendTo # get the new expiration date -extendTo=$(get_gpg_expiration "$extendTo") +extendTo=$(get_gpg_expiration "$1") -gpg_host --quiet --command-fd 0 --edit-key "$fpr" <<EOF -expire +gpg_host_edit expire <<EOF $extendTo save EOF |