diff options
Diffstat (limited to 'src')
| -rwxr-xr-x | src/monkeysphere | 5 | ||||
| -rwxr-xr-x | src/monkeysphere-authentication | 489 | ||||
| -rwxr-xr-x | src/monkeysphere-host | 574 | ||||
| -rwxr-xr-x | src/subcommands/ma/add-certifier | 141 | ||||
| -rwxr-xr-x | src/subcommands/ma/diagnostics | 179 | ||||
| -rwxr-xr-x | src/subcommands/ma/list-certifiers | 25 | ||||
| -rwxr-xr-x | src/subcommands/ma/remove-certifier | 45 | ||||
| -rwxr-xr-x | src/subcommands/ma/update-users | 144 | ||||
| -rwxr-xr-x | src/subcommands/mh/add-hostname | 71 | ||||
| -rwxr-xr-x | src/subcommands/mh/add-revoker | 16 | ||||
| -rwxr-xr-x | src/subcommands/mh/diagnostics | 179 | ||||
| -rwxr-xr-x | src/subcommands/mh/extend-key | 29 | ||||
| -rwxr-xr-x | src/subcommands/mh/gen-key | 116 | ||||
| -rwxr-xr-x | src/subcommands/mh/import-key | 84 | ||||
| -rwxr-xr-x | src/subcommands/mh/publish-key | 24 | ||||
| -rwxr-xr-x | src/subcommands/mh/revoke-hostname | 89 | ||||
| -rwxr-xr-x | src/subcommands/mh/revoke-key | 16 | ||||
| -rwxr-xr-x | src/subcommands/mh/show-key | 37 |
18 files changed, 1202 insertions, 1061 deletions
diff --git a/src/monkeysphere b/src/monkeysphere index 463a1b1..342d59a 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -47,6 +47,7 @@ subcommands: gen-subkey (g) [KEYID] generate an authentication subkey --length (-l) BITS key length in bits (2048) --expire (-e) EXPIRE date to expire + ssh-proxycommand ssh proxycommand subkey-to-ssh-agent (s) store authentication subkey in ssh-agent version (v) show version number help (h,?) this help @@ -424,6 +425,10 @@ case $COMMAND in gen_subkey "$@" ;; + 'ssh-proxycommand'|'p') + ssh-proxycommand "$@" + ;; + 'subkey-to-ssh-agent'|'s') subkey_to_ssh_agent "$@" ;; diff --git a/src/monkeysphere-authentication b/src/monkeysphere-authentication index 71ca91f..1763b03 100755 --- a/src/monkeysphere-authentication +++ b/src/monkeysphere-authentication @@ -134,495 +134,6 @@ check_host_keyring() { || failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-server gen-key' first." } -# update authorized_keys for users -update_users() { - if [ "$1" ] ; then - # get users from command line - unames="$@" - else - # or just look at all users if none specified - unames=$(getent passwd | cut -d: -f1) - fi - - RETCODE=0 - - # set mode - MODE="authorized_keys" - - # set gnupg home - GNUPGHOME="$GNUPGHOME_AUTHENTICATION" - - # check to see if the gpg trust database has been initialized - if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then - failure "GNUPG trust database uninitialized. Please see MONKEYSPHERE-SERVER(8)." - fi - - # make sure the authorized_keys directory exists - mkdir -p "${SYSDATADIR}/authorized_keys" - - # loop over users - for uname in $unames ; do - # check all specified users exist - if ! id "$uname" >/dev/null ; then - log error "----- unknown user '$uname' -----" - continue - fi - - log verbose "----- user: $uname -----" - - # make temporary directory - TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!" - - # trap to delete temporary directory on exit - trap "rm -rf $TMPLOC" EXIT - - # create temporary authorized_user_ids file - TMP_AUTHORIZED_USER_IDS="${TMPLOC}/authorized_user_ids" - touch "$TMP_AUTHORIZED_USER_IDS" - - # create temporary authorized_keys file - AUTHORIZED_KEYS="${TMPLOC}/authorized_keys" - touch "$AUTHORIZED_KEYS" - - # set restrictive permissions on the temporary files - # FIXME: is there a better way to do this? - chmod 0700 "$TMPLOC" - chmod 0600 "$AUTHORIZED_KEYS" - chmod 0600 "$TMP_AUTHORIZED_USER_IDS" - chown -R "$MONKEYSPHERE_USER" "$TMPLOC" - - # process authorized_user_ids file - log debug "checking for authorized_user_ids..." - # translating ssh-style path variables - authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") - if [ -s "$authorizedUserIDs" ] ; then - # check permissions on the authorized_user_ids file path - if check_key_file_permissions "$uname" "$authorizedUserIDs" ; then - # copy user authorized_user_ids file to temporary - # location - cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS" - - # export needed variables - export AUTHORIZED_KEYS - export TMP_AUTHORIZED_USER_IDS - - # process authorized_user_ids file, as monkeysphere - # user - su_monkeysphere_user \ - ". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS" - RETURN="$?" - else - log debug "not processing authorized_user_ids." - fi - else - log debug "empty or absent authorized_user_ids file." - fi - - # add user-controlled authorized_keys file if specified - # translate ssh-style path variables - rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS") - if [ "$rawAuthorizedKeys" != 'none' ] ; then - log debug "checking for raw authorized_keys..." - if [ -s "$rawAuthorizedKeys" ] ; then - # check permissions on the authorized_keys file path - if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then - log verbose "adding raw authorized_keys file... " - cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS" - else - log debug "not adding raw authorized_keys file." - fi - else - log debug "empty or absent authorized_keys file." - fi - fi - - # move the new authorized_keys file into place - if [ -s "$AUTHORIZED_KEYS" ] ; then - # openssh appears to check the contents of the - # authorized_keys file as the user in question, so the - # file must be readable by that user at least. - - # but in general, we don't want the user tampering with - # this file directly, so we'll adopt this approach: Own - # the file by the monkeysphere-server invoker (usually - # root, but should be the same uid that sshd is launched - # as); change the group of the file so that members of the - # user's group can read it. - - # FIXME: is there a better way to do this? - chown $(whoami) "$AUTHORIZED_KEYS" && \ - chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \ - chmod g+r "$AUTHORIZED_KEYS" && \ - mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \ - { - log error "Failed to install authorized_keys for '$uname'!" - rm -f "${SYSDATADIR}/authorized_keys/${uname}" - # indicate that there has been a failure: - RETURN=1 - } - else - rm -f "${SYSDATADIR}/authorized_keys/${uname}" - fi - - # unset the trap - trap - EXIT - - # destroy temporary directory - rm -rf "$TMPLOC" - done -} - -diagnostics() { -# * check on the status and validity of the key and public certificates - local seckey - local keysfound - local curdate - local warnwindow - local warndate - local create - local expire - local uid - local fingerprint - local badhostkeys - local sshd_config - local problemsfound=0 - - # FIXME: what's the correct, cross-platform answer? - sshd_config=/etc/ssh/sshd_config - seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode) - keysfound=$(echo "$seckey" | grep -c ^sec:) - curdate=$(date +%s) - # warn when anything is 2 months away from expiration - warnwindow='2 months' - warndate=$(advance_date $warnwindow +%s) - - if ! id monkeysphere >/dev/null ; then - echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell." - problemsfound=$(($problemsfound+1)) - fi - - if ! [ -d "$SYSDATADIR" ] ; then - echo "! no $SYSDATADIR directory found. Please create it." - problemsfound=$(($problemsfound+1)) - fi - - echo "Checking host GPG key..." - if (( "$keysfound" < 1 )); then - echo "! No host key found." - echo " - Recommendation: run 'monkeysphere-server gen-key'" - problemsfound=$(($problemsfound+1)) - elif (( "$keysfound" > 1 )); then - echo "! More than one host key found?" - # FIXME: recommend a way to resolve this - problemsfound=$(($problemsfound+1)) - else - create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:) - expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:) - fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:) - # check for key expiration: - if [ "$expire" ]; then - if (( "$expire" < "$curdate" )); then - echo "! Host key is expired." - echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" - problemsfound=$(($problemsfound+1)) - elif (( "$expire" < "$warndate" )); then - echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) - echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" - problemsfound=$(($problemsfound+1)) - fi - fi - - # and weirdnesses: - if [ "$create" ] && (( "$create" > "$curdate" )); then - echo "! Host key was created in the future(?!). Is your clock correct?" - echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" - problemsfound=$(($problemsfound+1)) - fi - - # check for UserID expiration: - echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \ - while IFS=: read create expire uid ; do - # FIXME: should we be doing any checking on the form - # of the User ID? Should we be unmangling it somehow? - - if [ "$create" ] && (( "$create" > "$curdate" )); then - echo "! User ID '$uid' was created in the future(?!). Is your clock correct?" - echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" - problemsfound=$(($problemsfound+1)) - fi - if [ "$expire" ] ; then - if (( "$expire" < "$curdate" )); then - echo "! User ID '$uid' is expired." - # FIXME: recommend a way to resolve this - problemsfound=$(($problemsfound+1)) - elif (( "$expire" < "$warndate" )); then - echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) - # FIXME: recommend a way to resolve this - problemsfound=$(($problemsfound+1)) - fi - fi - done - -# FIXME: verify that the host key is properly published to the -# keyservers (do this with the non-privileged user) - -# FIXME: check that there are valid, non-expired certifying signatures -# attached to the host key after fetching from the public keyserver -# (do this with the non-privileged user as well) - -# FIXME: propose adding a revoker to the host key if none exist (do we -# have a way to do that after key generation?) - - # Ensure that the ssh_host_rsa_key file is present and non-empty: - echo - echo "Checking host SSH key..." - if [ ! -s "${SYSDATADIR}/ssh_host_rsa_key" ] ; then - echo "! The host key as prepared for SSH (${SYSDATADIR}/ssh_host_rsa_key) is missing or empty." - problemsfound=$(($problemsfound+1)) - else - if [ $(ls -l "${SYSDATADIR}/ssh_host_rsa_key" | cut -f1 -d\ ) != '-rw-------' ] ; then - echo "! Permissions seem wrong for ${SYSDATADIR}/ssh_host_rsa_key -- should be 0600." - problemsfound=$(($problemsfound+1)) - fi - - # propose changes needed for sshd_config (if any) - if ! grep -q "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$" "$sshd_config"; then - echo "! $sshd_config does not point to the monkeysphere host key (${SYSDATADIR}/ssh_host_rsa_key)." - echo " - Recommendation: add a line to $sshd_config: 'HostKey ${SYSDATADIR}/ssh_host_rsa_key'" - problemsfound=$(($problemsfound+1)) - fi - if badhostkeys=$(grep -i '^HostKey' "$sshd_config" | grep -v "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$") ; then - echo "! $sshd_config refers to some non-monkeysphere host keys:" - echo "$badhostkeys" - echo " - Recommendation: remove the above HostKey lines from $sshd_config" - problemsfound=$(($problemsfound+1)) - fi - - # FIXME: test (with ssh-keyscan?) that the running ssh - # daemon is actually offering the monkeysphere host key. - - fi - fi - -# FIXME: look at the ownership/privileges of the various keyrings, -# directories housing them, etc (what should those values be? can -# we make them as minimal as possible?) - -# FIXME: look to see that the ownertrust rules are set properly on the -# authentication keyring - -# FIXME: make sure that at least one identity certifier exists - -# FIXME: look at the timestamps on the monkeysphere-generated -# authorized_keys files -- warn if they seem out-of-date. - -# FIXME: check for a cronjob that updates monkeysphere-generated -# authorized_keys? - - echo - echo "Checking for MonkeySphere-enabled public-key authentication for users ..." - # Ensure that User ID authentication is enabled: - if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$" "$sshd_config"; then - echo "! $sshd_config does not point to monkeysphere authorized keys." - echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${SYSDATADIR}/authorized_keys/%u'" - problemsfound=$(($problemsfound+1)) - fi - if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -v "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$") ; then - echo "! $sshd_config refers to non-monkeysphere authorized_keys files:" - echo "$badauthorizedkeys" - echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config" - problemsfound=$(($problemsfound+1)) - fi - - if [ "$problemsfound" -gt 0 ]; then - echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:" - echo " monkeysphere-server diagnostics" - else - echo "Everything seems to be in order!" - fi -} - -# retrieve key from web of trust, import it into the host keyring, and -# ltsign the key in the host keyring so that it may certify other keys -add_certifier() { - local domain - local trust - local depth - local keyID - local fingerprint - local ltsignCommand - local trustval - - # set default values for trust depth and domain - domain= - trust=full - depth=1 - - # get options - while true ; do - case "$1" in - -n|--domain) - domain="$2" - shift 2 - ;; - -t|--trust) - trust="$2" - shift 2 - ;; - -d|--depth) - depth="$2" - shift 2 - ;; - *) - if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then - failure "Unknown option '$1'. -Type '$PGRM help' for usage." - fi - break - ;; - esac - done - - keyID="$1" - if [ -z "$keyID" ] ; then - failure "You must specify the key ID of a key to add, or specify a file to read the key from." - fi - if [ -f "$keyID" ] ; then - echo "Reading key from file '$keyID':" - importinfo=$(gpg_authentication "--import" < "$keyID" 2>&1) || failure "could not read key from '$keyID'" - # FIXME: if this is tried when the key database is not - # up-to-date, i got these errors (using set -x): - -# ++ su -m monkeysphere -c '\''gpg --import'\'' -# Warning: using insecure memory! -# gpg: key D21739E9: public key "Daniel Kahn Gillmor <dkg@fifthhorseman.net>" imported -# gpg: Total number processed: 1 -# gpg: imported: 1 (RSA: 1) -# gpg: can'\''t create `/var/monkeysphere/gnupg-host/pubring.gpg.tmp'\'': Permission denied -# gpg: failed to rebuild keyring cache: Permission denied -# gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model -# gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u -# gpg: next trustdb check due at 2009-01-10' -# + failure 'could not read key from '\''/root/dkg.gpg'\''' -# + echo 'could not read key from '\''/root/dkg.gpg'\''' - - keyID=$(echo "$importinfo" | grep '^gpg: key ' | cut -f2 -d: | cut -f3 -d\ ) - if [ -z "$keyID" ] || [ $(echo "$keyID" | wc -l) -ne 1 ] ; then - failure "Expected there to be a single gpg key in the file." - fi - else - # get the key from the key server - gpg_authentication "--keyserver $KEYSERVER --recv-key '0x${keyID}!'" || failure "Could not receive a key with this ID from the '$KEYSERVER' keyserver." - fi - - export keyID - - - # get the full fingerprint of a key ID - fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint 0x${keyID}!" | \ - grep '^fpr:' | grep "$keyID" | cut -d: -f10) - - if [ -z "$fingerprint" ] ; then - failure "Key '$keyID' not found." - fi - - echo - echo "key found:" - gpg_authentication "--fingerprint 0x${fingerprint}!" - - echo "Are you sure you want to add the above key as a" - read -p "certifier of users on this system? (y/N) " OK; OK=${OK:-N} - if [ "${OK/y/Y}" != 'Y' ] ; then - failure "Identity certifier not added." - fi - - # export the key to the host keyring - gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import - - if [ "$trust" = marginal ]; then - trustval=1 - elif [ "$trust" = full ]; then - trustval=2 - else - failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)." - fi - - # ltsign command - # NOTE: *all* user IDs will be ltsigned - ltsignCommand=$(cat <<EOF -ltsign -y -$trustval -$depth -$domain -y -save -EOF - ) - - # ltsign the key - if echo "$ltsignCommand" | \ - gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then - - # update the trustdb for the authentication keyring - gpg_authentication "--check-trustdb" - - echo - echo "Identity certifier added." - else - failure "Problem adding identify certifier." - fi -} - -# delete a certifiers key from the host keyring -remove_certifier() { - local keyID - local fingerprint - - keyID="$1" - if [ -z "$keyID" ] ; then - failure "You must specify the key ID of a key to remove." - fi - - if gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then - read -p "Really remove above listed identity certifier? (y/N) " OK; OK=${OK:-N} - if [ "${OK/y/Y}" != 'Y' ] ; then - failure "Identity certifier not removed." - fi - else - failure - fi - - # delete the requested key - if gpg_authentication "--delete-key --batch --yes 0x${keyID}!" ; then - # delete key from host keyring as well - gpg_host --delete-key --batch --yes "0x${keyID}!" - - # update the trustdb for the authentication keyring - gpg_authentication "--check-trustdb" - - echo - echo "Identity certifier removed." - else - failure "Problem removing identity certifier." - fi -} - -# list the host certifiers -list_certifiers() { - local keys - local key - - # find trusted keys in authentication keychain - keys=$(gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \ - grep ^pub: | cut -d: -f2,5 | egrep '^(u|f):' | cut -d: -f2) - - # output keys - for key in $keys ; do - gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key" - done -} - ######################################################################## # MAIN ######################################################################## diff --git a/src/monkeysphere-host b/src/monkeysphere-host index bf58616..19ab5fc 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -53,12 +53,10 @@ subcommands: publish-key (p) publish server host key to keyserver expert - import-key (i) import existing ssh key to gpg - --hostname (-h) NAME[:PORT] hostname for key user ID + import-key (i) NAME[:PORT] import existing ssh key to gpg --keyfile (-f) FILE key file to import --expire (-e) EXPIRE date to expire - gen-key (g) generate gpg key for the host - --hostname (-h) NAME[:PORT] hostname for key user ID + gen-key (g) NAME[:PORT] generate gpg key for the host --length (-l) BITS key length in bits (2048) --expire (-e) EXPIRE date to expire --revoker (-r) FINGERPRINT add a revoker @@ -121,574 +119,6 @@ check_host_keyring() { || failure "You don't appear to have a Monkeysphere host key on this server. Please run 'monkeysphere-server gen-key' first." } -# output key information -show_server_key() { - local fingerprintPGP - local fingerprintSSH - local ret=0 - - # FIXME: you shouldn't have to be root to see the host key fingerprint - check_host_keyring - fingerprintPGP=$(fingerprint_server_key) - gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null - if [ $? -ne 0 ] ; then - log info "You must be root to see host OpenPGP fingerprint." - ret='1' - else - echo "OpenPGP fingerprint: $fingerprintPGP" - fi - - if [ -f "${SYSDATADIR}/ssh_host_rsa_key.pub" ] ; then - fingerprintSSH=$(ssh-keygen -l -f "${SYSDATADIR}/ssh_host_rsa_key.pub" | \ - awk '{ print $1, $2, $4 }') - echo "ssh fingerprint: $fingerprintSSH" - else - log info "SSH host key not found." - ret='1' - fi - - return $ret -} - -# import an existing ssh key to a gpg key -import_key() { - local hostName=$(hostname -f) - local keyFile="/etc/ssh/ssh_host_rsa_key" - local keyExpire - local userID - - # check for presense of secret key - # FIXME: is this the proper test to be doing here? - fingerprint_server_key >/dev/null \ - && failure "An OpenPGP host key already exists." - - # get options - while true ; do - case "$1" in - -h|--hostname) - hostName="$2" - shift 2 - ;; - -f|--keyfile) - keyFile="$2" - shift 2 - ;; - -e|--expire) - keyExpire="$2" - shift 2 - ;; - *) - if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then - failure "Unknown option '$1'. -Type '$PGRM help' for usage." - fi - break - ;; - esac - done - - if [ ! -f "$keyFile" ] ; then - failure "SSH secret key file '$keyFile' not found." - fi - - userID="ssh://${hostName}" - - # prompt about key expiration if not specified - keyExpire=$(get_gpg_expiration "$keyExpire") - - echo "The following key parameters will be used for the host private key:" - echo "Import: $keyFile" - echo "Name-Real: $userID" - echo "Expire-Date: $keyExpire" - - read -p "Import key? (Y/n) " OK; OK=${OK:=Y} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "aborting." - fi - - log verbose "importing ssh key..." - # translate ssh key to a private key - (umask 077 && \ - pem2openpgp "$userID" "$keyExpire" < "$sshKey" | gpg_host --import) - - # find the key fingerprint of the newly converted key - fingerprint=$(fingerprint_server_key) - - # export host ownertrust to authentication keyring - log verbose "setting ultimate owner trust for host key..." - echo "${fingerprint}:6:" | gpg_host "--import-ownertrust" - echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust" - - # export public key to file - gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" - log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" - - # show info about new key - show_server_key -} - -# generate server gpg key -gen_key() { - local keyType="RSA" - local keyLength="2048" - local keyUsage="auth" - local keyExpire - local revoker - local hostName=$(hostname -f) - local userID - local keyParameters - local fingerprint - - # check for presense of secret key - # FIXME: is this the proper test to be doing here? - fingerprint_server_key >/dev/null \ - && failure "An OpenPGP host key already exists." - - # get options - while true ; do - case "$1" in - -l|--length) - keyLength="$2" - shift 2 - ;; - -e|--expire) - keyExpire="$2" - shift 2 - ;; - -r|--revoker) - revoker="$2" - shift 2 - ;; - *) - if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then - failure "Unknown option '$1'. -Type '$PGRM help' for usage." - fi - hostName="$1" - break - ;; - esac - done - - userID="ssh://${hostName}" - - # prompt about key expiration if not specified - keyExpire=$(get_gpg_expiration "$keyExpire") - - # set key parameters - keyParameters=\ -"Key-Type: $keyType -Key-Length: $keyLength -Key-Usage: $keyUsage -Name-Real: $userID -Expire-Date: $keyExpire" - - # add the revoker field if specified - # FIXME: the "1:" below assumes that $REVOKER's key is an RSA key. - # FIXME: key is marked "sensitive"? is this appropriate? - if [ "$revoker" ] ; then - keyParameters=\ -"${keyParameters} -Revoker: 1:${revoker} sensitive" - fi - - echo "The following key parameters will be used for the host private key:" - echo "$keyParameters" - - read -p "Generate key? (Y/n) " OK; OK=${OK:=Y} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "aborting." - fi - - # add commit command - # must include blank line! - keyParameters=\ -"${keyParameters} - -%commit -%echo done" - - log verbose "generating host key..." - echo "$keyParameters" | gpg_host --batch --gen-key - - # find the key fingerprint of the newly generated key - fingerprint=$(fingerprint_server_key) - - # export host ownertrust to authentication keyring - log verbose "setting ultimate owner trust for host key..." - echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust" - - # translate the private key to ssh format, and export to a file - # for sshs usage. - # NOTE: assumes that the primary key is the proper key to use - (umask 077 && \ - gpg_host --export-secret-key "$fingerprint" | \ - openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key") - log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key" - ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub" - log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub" - gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" - log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" - - # show info about new key - show_server_key -} - -# extend the lifetime of a host key: -extend_key() { - local fpr=$(fingerprint_server_key) - local extendTo="$1" - - # get the new expiration date - extendTo=$(get_gpg_expiration "$extendTo") - - gpg_host --quiet --command-fd 0 --edit-key "$fpr" <<EOF -expire -$extendTo -save -EOF - - echo - echo "NOTE: Host key expiration date adjusted, but not yet published." - echo "Run '$PGRM publish-key' to publish the new expiration date." -} - -# add hostname user ID to server key -add_hostname() { - local userID - local fingerprint - local tmpuidMatch - local line - local adduidCommand - - if [ -z "$1" ] ; then - failure "You must specify a hostname to add." - fi - - userID="ssh://${1}" - - fingerprint=$(fingerprint_server_key) - - # match to only ultimately trusted user IDs - tmpuidMatch="u:$(echo $userID | gpg_escape)" - - # find the index of the requsted user ID - # NOTE: this is based on circumstantial evidence that the order of - # this output is the appropriate index - if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ - | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then - failure "Host userID '$userID' already exists." - fi - - echo "The following user ID will be added to the host key:" - echo " $userID" - read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "User ID not added." - fi - - # edit-key script command to add user ID - adduidCommand=$(cat <<EOF -adduid -$userID - - -save -EOF -) - - # execute edit-key script - if echo "$adduidCommand" | \ - gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then - - # update the trustdb for the authentication keyring - gpg_authentication "--check-trustdb" - - show_server_key - - echo - echo "NOTE: User ID added to key, but key not published." - echo "Run '$PGRM publish-key' to publish the new user ID." - else - failure "Problem adding user ID." - fi -} - -# revoke hostname user ID to server key -revoke_hostname() { - local userID - local fingerprint - local tmpuidMatch - local line - local uidIndex - local message - local revuidCommand - - if [ -z "$1" ] ; then - failure "You must specify a hostname to revoke." - fi - - echo "WARNING: There is a known bug in this function." - echo "This function has been known to occasionally revoke the wrong user ID." - echo "Please see the following bug report for more information:" - echo "http://web.monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/" - read -p "Are you sure you would like to proceed? (y/N) " OK; OK=${OK:=N} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "aborting." - fi - - userID="ssh://${1}" - - fingerprint=$(fingerprint_server_key) - - # match to only ultimately trusted user IDs - tmpuidMatch="u:$(echo $userID | gpg_escape)" - - # find the index of the requsted user ID - # NOTE: this is based on circumstantial evidence that the order of - # this output is the appropriate index - if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ - | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then - uidIndex=${line%%:*} - else - failure "No non-revoked user ID '$userID' is found." - fi - - echo "The following host key user ID will be revoked:" - echo " $userID" - read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "User ID not revoked." - fi - - message="Hostname removed by monkeysphere-server $DATE" - - # edit-key script command to revoke user ID - revuidCommand=$(cat <<EOF -$uidIndex -revuid -y -4 -$message - -y -save -EOF - ) - - # execute edit-key script - if echo "$revuidCommand" | \ - gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then - - # update the trustdb for the authentication keyring - gpg_authentication "--check-trustdb" - - show_server_key - - echo - echo "NOTE: User ID revoked, but revocation not published." - echo "Run '$PGRM publish-key' to publish the revocation." - else - failure "Problem revoking user ID." - fi -} - -# add a revoker to the host key -add_revoker() { - # FIXME: implement! - failure "not implemented yet!" -} - -# revoke the host key -revoke_key() { - # FIXME: implement! - failure "not implemented yet!" -} - -# publish server key to keyserver -publish_server_key() { - read -p "Really publish host key to $KEYSERVER? (y/N) " OK; OK=${OK:=N} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "key not published." - fi - - # find the key fingerprint - fingerprint=$(fingerprint_server_key) - - # publish host key - gpg_authentication "--keyserver $KEYSERVER --send-keys '0x${fingerprint}!'" -} - -diagnostics() { -# * check on the status and validity of the key and public certificates - local seckey - local keysfound - local curdate - local warnwindow - local warndate - local create - local expire - local uid - local fingerprint - local badhostkeys - local sshd_config - local problemsfound=0 - - # FIXME: what's the correct, cross-platform answer? - sshd_config=/etc/ssh/sshd_config - seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode) - keysfound=$(echo "$seckey" | grep -c ^sec:) - curdate=$(date +%s) - # warn when anything is 2 months away from expiration - warnwindow='2 months' - warndate=$(advance_date $warnwindow +%s) - - if ! id monkeysphere >/dev/null ; then - echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell." - problemsfound=$(($problemsfound+1)) - fi - - if ! [ -d "$SYSDATADIR" ] ; then - echo "! no $SYSDATADIR directory found. Please create it." - problemsfound=$(($problemsfound+1)) - fi - - echo "Checking host GPG key..." - if (( "$keysfound" < 1 )); then - echo "! No host key found." - echo " - Recommendation: run 'monkeysphere-server gen-key'" - problemsfound=$(($problemsfound+1)) - elif (( "$keysfound" > 1 )); then - echo "! More than one host key found?" - # FIXME: recommend a way to resolve this - problemsfound=$(($problemsfound+1)) - else - create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:) - expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:) - fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:) - # check for key expiration: - if [ "$expire" ]; then - if (( "$expire" < "$curdate" )); then - echo "! Host key is expired." - echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" - problemsfound=$(($problemsfound+1)) - elif (( "$expire" < "$warndate" )); then - echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) - echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" - problemsfound=$(($problemsfound+1)) - fi - fi - - # and weirdnesses: - if [ "$create" ] && (( "$create" > "$curdate" )); then - echo "! Host key was created in the future(?!). Is your clock correct?" - echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" - problemsfound=$(($problemsfound+1)) - fi - - # check for UserID expiration: - echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \ - while IFS=: read create expire uid ; do - # FIXME: should we be doing any checking on the form - # of the User ID? Should we be unmangling it somehow? - - if [ "$create" ] && (( "$create" > "$curdate" )); then - echo "! User ID '$uid' was created in the future(?!). Is your clock correct?" - echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" - problemsfound=$(($problemsfound+1)) - fi - if [ "$expire" ] ; then - if (( "$expire" < "$curdate" )); then - echo "! User ID '$uid' is expired." - # FIXME: recommend a way to resolve this - problemsfound=$(($problemsfound+1)) - elif (( "$expire" < "$warndate" )); then - echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) - # FIXME: recommend a way to resolve this - problemsfound=$(($problemsfound+1)) - fi - fi - done - -# FIXME: verify that the host key is properly published to the -# keyservers (do this with the non-privileged user) - -# FIXME: check that there are valid, non-expired certifying signatures -# attached to the host key after fetching from the public keyserver -# (do this with the non-privileged user as well) - -# FIXME: propose adding a revoker to the host key if none exist (do we -# have a way to do that after key generation?) - - # Ensure that the ssh_host_rsa_key file is present and non-empty: - echo - echo "Checking host SSH key..." - if [ ! -s "${SYSDATADIR}/ssh_host_rsa_key" ] ; then - echo "! The host key as prepared for SSH (${SYSDATADIR}/ssh_host_rsa_key) is missing or empty." - problemsfound=$(($problemsfound+1)) - else - if [ $(ls -l "${SYSDATADIR}/ssh_host_rsa_key" | cut -f1 -d\ ) != '-rw-------' ] ; then - echo "! Permissions seem wrong for ${SYSDATADIR}/ssh_host_rsa_key -- should be 0600." - problemsfound=$(($problemsfound+1)) - fi - - # propose changes needed for sshd_config (if any) - if ! grep -q "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$" "$sshd_config"; then - echo "! $sshd_config does not point to the monkeysphere host key (${SYSDATADIR}/ssh_host_rsa_key)." - echo " - Recommendation: add a line to $sshd_config: 'HostKey ${SYSDATADIR}/ssh_host_rsa_key'" - problemsfound=$(($problemsfound+1)) - fi - if badhostkeys=$(grep -i '^HostKey' "$sshd_config" | grep -v "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$") ; then - echo "! $sshd_config refers to some non-monkeysphere host keys:" - echo "$badhostkeys" - echo " - Recommendation: remove the above HostKey lines from $sshd_config" - problemsfound=$(($problemsfound+1)) - fi - - # FIXME: test (with ssh-keyscan?) that the running ssh - # daemon is actually offering the monkeysphere host key. - - fi - fi - -# FIXME: look at the ownership/privileges of the various keyrings, -# directories housing them, etc (what should those values be? can -# we make them as minimal as possible?) - -# FIXME: look to see that the ownertrust rules are set properly on the -# authentication keyring - -# FIXME: make sure that at least one identity certifier exists - -# FIXME: look at the timestamps on the monkeysphere-generated -# authorized_keys files -- warn if they seem out-of-date. - -# FIXME: check for a cronjob that updates monkeysphere-generated -# authorized_keys? - - echo - echo "Checking for MonkeySphere-enabled public-key authentication for users ..." - # Ensure that User ID authentication is enabled: - if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$" "$sshd_config"; then - echo "! $sshd_config does not point to monkeysphere authorized keys." - echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${SYSDATADIR}/authorized_keys/%u'" - problemsfound=$(($problemsfound+1)) - fi - if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -v "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$") ; then - echo "! $sshd_config refers to non-monkeysphere authorized_keys files:" - echo "$badauthorizedkeys" - echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config" - problemsfound=$(($problemsfound+1)) - fi - - if [ "$problemsfound" -gt 0 ]; then - echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:" - echo " monkeysphere-server diagnostics" - else - echo "Everything seems to be in order!" - fi -} - ######################################################################## # MAIN ######################################################################## diff --git a/src/subcommands/ma/add-certifier b/src/subcommands/ma/add-certifier new file mode 100755 index 0000000..3bd800c --- /dev/null +++ b/src/subcommands/ma/add-certifier @@ -0,0 +1,141 @@ +#!/usr/bin/env bash + +# Monkeysphere authentication add-certifier subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# retrieve key from web of trust, import it into the host keyring, and +# ltsign the key in the host keyring so that it may certify other keys + +local domain +local trust +local depth +local keyID +local fingerprint +local ltsignCommand +local trustval + +# set default values for trust depth and domain +domain= +trust=full +depth=1 + +# get options +while true ; do + case "$1" in + -n|--domain) + domain="$2" + shift 2 + ;; + -t|--trust) + trust="$2" + shift 2 + ;; + -d|--depth) + depth="$2" + shift 2 + ;; + *) + if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then + failure "Unknown option '$1'. +Type '$PGRM help' for usage." + fi + break + ;; + esac +done + +keyID="$1" +if [ -z "$keyID" ] ; then + failure "You must specify the key ID of a key to add, or specify a file to read the key from." +fi +if [ -f "$keyID" ] ; then + echo "Reading key from file '$keyID':" + importinfo=$(gpg_authentication "--import" < "$keyID" 2>&1) || failure "could not read key from '$keyID'" + # FIXME: if this is tried when the key database is not + # up-to-date, i got these errors (using set -x): + + # ++ su -m monkeysphere -c '\''gpg --import'\'' + # Warning: using insecure memory! + # gpg: key D21739E9: public key "Daniel Kahn Gillmor <dkg@fifthhorseman.net>" imported + # gpg: Total number processed: 1 + # gpg: imported: 1 (RSA: 1) + # gpg: can'\''t create `/var/monkeysphere/gnupg-host/pubring.gpg.tmp'\'': Permission denied + # gpg: failed to rebuild keyring cache: Permission denied + # gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model + # gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u + # gpg: next trustdb check due at 2009-01-10' + # + failure 'could not read key from '\''/root/dkg.gpg'\''' + # + echo 'could not read key from '\''/root/dkg.gpg'\''' + + keyID=$(echo "$importinfo" | grep '^gpg: key ' | cut -f2 -d: | cut -f3 -d\ ) + if [ -z "$keyID" ] || [ $(echo "$keyID" | wc -l) -ne 1 ] ; then + failure "Expected there to be a single gpg key in the file." + fi +else + # get the key from the key server + gpg_authentication "--keyserver $KEYSERVER --recv-key '0x${keyID}!'" || failure "Could not receive a key with this ID from the '$KEYSERVER' keyserver." +fi + +export keyID + +# get the full fingerprint of a key ID +fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint 0x${keyID}!" | \ + grep '^fpr:' | grep "$keyID" | cut -d: -f10) + +if [ -z "$fingerprint" ] ; then + failure "Key '$keyID' not found." +fi + +echo +echo "key found:" +gpg_authentication "--fingerprint 0x${fingerprint}!" + +echo "Are you sure you want to add the above key as a" +read -p "certifier of users on this system? (y/N) " OK; OK=${OK:-N} +if [ "${OK/y/Y}" != 'Y' ] ; then + failure "Identity certifier not added." +fi + +# export the key to the host keyring +gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import + +if [ "$trust" = marginal ]; then + trustval=1 +elif [ "$trust" = full ]; then + trustval=2 +else + failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)." +fi + +# ltsign command +# NOTE: *all* user IDs will be ltsigned +ltsignCommand=$(cat <<EOF +ltsign +y +$trustval +$depth +$domain +y +save +EOF + ) + +# ltsign the key +if echo "$ltsignCommand" | \ + gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then + + # update the trustdb for the authentication keyring + gpg_authentication "--check-trustdb" + + echo + echo "Identity certifier added." +else + failure "Problem adding identify certifier." +fi diff --git a/src/subcommands/ma/diagnostics b/src/subcommands/ma/diagnostics new file mode 100755 index 0000000..b6003b0 --- /dev/null +++ b/src/subcommands/ma/diagnostics @@ -0,0 +1,179 @@ +#!/usr/bin/env bash + +# Monkeysphere authentication diagnostics subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# * check on the status and validity of the key and public certificates +local seckey +local keysfound +local curdate +local warnwindow +local warndate +local create +local expire +local uid +local fingerprint +local badhostkeys +local sshd_config +local problemsfound=0 + +# FIXME: what's the correct, cross-platform answer? +sshd_config=/etc/ssh/sshd_config +seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode) +keysfound=$(echo "$seckey" | grep -c ^sec:) +curdate=$(date +%s) +# warn when anything is 2 months away from expiration +warnwindow='2 months' +warndate=$(advance_date $warnwindow +%s) + +if ! id monkeysphere >/dev/null ; then + echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell." + problemsfound=$(($problemsfound+1)) +fi + +if ! [ -d "$SYSDATADIR" ] ; then + echo "! no $SYSDATADIR directory found. Please create it." + problemsfound=$(($problemsfound+1)) +fi + +echo "Checking host GPG key..." +if (( "$keysfound" < 1 )); then + echo "! No host key found." + echo " - Recommendation: run 'monkeysphere-server gen-key'" + problemsfound=$(($problemsfound+1)) +elif (( "$keysfound" > 1 )); then + echo "! More than one host key found?" + # FIXME: recommend a way to resolve this + problemsfound=$(($problemsfound+1)) +else + create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:) + expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:) + fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:) + # check for key expiration: + if [ "$expire" ]; then + if (( "$expire" < "$curdate" )); then + echo "! Host key is expired." + echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" + problemsfound=$(($problemsfound+1)) + elif (( "$expire" < "$warndate" )); then + echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) + echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" + problemsfound=$(($problemsfound+1)) + fi + fi + + # and weirdnesses: + if [ "$create" ] && (( "$create" > "$curdate" )); then + echo "! Host key was created in the future(?!). Is your clock correct?" + echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" + problemsfound=$(($problemsfound+1)) + fi + + # check for UserID expiration: + echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \ + while IFS=: read create expire uid ; do + # FIXME: should we be doing any checking on the form + # of the User ID? Should we be unmangling it somehow? + + if [ "$create" ] && (( "$create" > "$curdate" )); then + echo "! User ID '$uid' was created in the future(?!). Is your clock correct?" + echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" + problemsfound=$(($problemsfound+1)) + fi + if [ "$expire" ] ; then + if (( "$expire" < "$curdate" )); then + echo "! User ID '$uid' is expired." + # FIXME: recommend a way to resolve this + problemsfound=$(($problemsfound+1)) + elif (( "$expire" < "$warndate" )); then + echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) + # FIXME: recommend a way to resolve this + problemsfound=$(($problemsfound+1)) + fi + fi + done + +# FIXME: verify that the host key is properly published to the +# keyservers (do this with the non-privileged user) + +# FIXME: check that there are valid, non-expired certifying signatures +# attached to the host key after fetching from the public keyserver +# (do this with the non-privileged user as well) + +# FIXME: propose adding a revoker to the host key if none exist (do we +# have a way to do that after key generation?) + + # Ensure that the ssh_host_rsa_key file is present and non-empty: + echo + echo "Checking host SSH key..." + if [ ! -s "${SYSDATADIR}/ssh_host_rsa_key" ] ; then + echo "! The host key as prepared for SSH (${SYSDATADIR}/ssh_host_rsa_key) is missing or empty." + problemsfound=$(($problemsfound+1)) + else + if [ $(ls -l "${SYSDATADIR}/ssh_host_rsa_key" | cut -f1 -d\ ) != '-rw-------' ] ; then + echo "! Permissions seem wrong for ${SYSDATADIR}/ssh_host_rsa_key -- should be 0600." + problemsfound=$(($problemsfound+1)) + fi + + # propose changes needed for sshd_config (if any) + if ! grep -q "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$" "$sshd_config"; then + echo "! $sshd_config does not point to the monkeysphere host key (${SYSDATADIR}/ssh_host_rsa_key)." + echo " - Recommendation: add a line to $sshd_config: 'HostKey ${SYSDATADIR}/ssh_host_rsa_key'" + problemsfound=$(($problemsfound+1)) + fi + if badhostkeys=$(grep -i '^HostKey' "$sshd_config" | grep -v "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$") ; then + echo "! $sshd_config refers to some non-monkeysphere host keys:" + echo "$badhostkeys" + echo " - Recommendation: remove the above HostKey lines from $sshd_config" + problemsfound=$(($problemsfound+1)) + fi + + # FIXME: test (with ssh-keyscan?) that the running ssh + # daemon is actually offering the monkeysphere host key. + + fi +fi + +# FIXME: look at the ownership/privileges of the various keyrings, +# directories housing them, etc (what should those values be? can +# we make them as minimal as possible?) + +# FIXME: look to see that the ownertrust rules are set properly on the +# authentication keyring + +# FIXME: make sure that at least one identity certifier exists + +# FIXME: look at the timestamps on the monkeysphere-generated +# authorized_keys files -- warn if they seem out-of-date. + +# FIXME: check for a cronjob that updates monkeysphere-generated +# authorized_keys? + +echo +echo "Checking for MonkeySphere-enabled public-key authentication for users ..." +# Ensure that User ID authentication is enabled: +if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$" "$sshd_config"; then + echo "! $sshd_config does not point to monkeysphere authorized keys." + echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${SYSDATADIR}/authorized_keys/%u'" + problemsfound=$(($problemsfound+1)) +fi +if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -v "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$") ; then + echo "! $sshd_config refers to non-monkeysphere authorized_keys files:" + echo "$badauthorizedkeys" + echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config" + problemsfound=$(($problemsfound+1)) +fi + +if [ "$problemsfound" -gt 0 ]; then + echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:" + echo " monkeysphere-server diagnostics" +else + echo "Everything seems to be in order!" +fi diff --git a/src/subcommands/ma/list-certifiers b/src/subcommands/ma/list-certifiers new file mode 100755 index 0000000..789d553 --- /dev/null +++ b/src/subcommands/ma/list-certifiers @@ -0,0 +1,25 @@ +#!/usr/bin/env bash + +# Monkeysphere authentication list-certifiers subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# list the host certifiers + +local keys +local key + +# find trusted keys in authentication keychain +keys=$(gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \ + grep ^pub: | cut -d: -f2,5 | egrep '^(u|f):' | cut -d: -f2) + +# output keys +for key in $keys ; do + gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key" +done diff --git a/src/subcommands/ma/remove-certifier b/src/subcommands/ma/remove-certifier new file mode 100755 index 0000000..a4eaf54 --- /dev/null +++ b/src/subcommands/ma/remove-certifier @@ -0,0 +1,45 @@ +#!/usr/bin/env bash + +# Monkeysphere authentication remove-certifier subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# delete a certifiers key from the host keyring + +local keyID +local fingerprint + +keyID="$1" +if [ -z "$keyID" ] ; then + failure "You must specify the key ID of a key to remove." +fi + +if gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then + read -p "Really remove above listed identity certifier? (y/N) " OK; OK=${OK:-N} + if [ "${OK/y/Y}" != 'Y' ] ; then + failure "Identity certifier not removed." + fi +else + failure +fi + +# delete the requested key +if gpg_authentication "--delete-key --batch --yes 0x${keyID}!" ; then + # delete key from host keyring as well + gpg_host --delete-key --batch --yes "0x${keyID}!" + + # update the trustdb for the authentication keyring + gpg_authentication "--check-trustdb" + + echo + echo "Identity certifier removed." +else + failure "Problem removing identity certifier." +fi + diff --git a/src/subcommands/ma/update-users b/src/subcommands/ma/update-users new file mode 100755 index 0000000..a26d3fb --- /dev/null +++ b/src/subcommands/ma/update-users @@ -0,0 +1,144 @@ +#!/usr/bin/env bash + +# Monkeysphere authentication update-users subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +if [ "$1" ] ; then + # get users from command line + unames="$@" +else + # or just look at all users if none specified + unames=$(getent passwd | cut -d: -f1) +fi + +RETCODE=0 + +# set mode +MODE="authorized_keys" + +# set gnupg home +GNUPGHOME="$GNUPGHOME_AUTHENTICATION" + +# check to see if the gpg trust database has been initialized +if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then + failure "GNUPG trust database uninitialized. Please see MONKEYSPHERE-SERVER(8)." +fi + +# make sure the authorized_keys directory exists +mkdir -p "${SYSDATADIR}/authorized_keys" + +# loop over users +for uname in $unames ; do + # check all specified users exist + if ! id "$uname" >/dev/null ; then + log error "----- unknown user '$uname' -----" + continue + fi + + log verbose "----- user: $uname -----" + + # make temporary directory + TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!" + + # trap to delete temporary directory on exit + trap "rm -rf $TMPLOC" EXIT + + # create temporary authorized_user_ids file + TMP_AUTHORIZED_USER_IDS="${TMPLOC}/authorized_user_ids" + touch "$TMP_AUTHORIZED_USER_IDS" + + # create temporary authorized_keys file + AUTHORIZED_KEYS="${TMPLOC}/authorized_keys" + touch "$AUTHORIZED_KEYS" + + # set restrictive permissions on the temporary files + # FIXME: is there a better way to do this? + chmod 0700 "$TMPLOC" + chmod 0600 "$AUTHORIZED_KEYS" + chmod 0600 "$TMP_AUTHORIZED_USER_IDS" + chown -R "$MONKEYSPHERE_USER" "$TMPLOC" + + # process authorized_user_ids file + log debug "checking for authorized_user_ids..." + # translating ssh-style path variables + authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") + if [ -s "$authorizedUserIDs" ] ; then + # check permissions on the authorized_user_ids file path + if check_key_file_permissions "$uname" "$authorizedUserIDs" ; then + # copy user authorized_user_ids file to temporary + # location + cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS" + + # export needed variables + export AUTHORIZED_KEYS + export TMP_AUTHORIZED_USER_IDS + + # process authorized_user_ids file, as monkeysphere user + su_monkeysphere_user \ + ". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS" + RETURN="$?" + else + log debug "not processing authorized_user_ids." + fi + else + log debug "empty or absent authorized_user_ids file." + fi + + # add user-controlled authorized_keys file if specified translate + # ssh-style path variables + rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS") + if [ "$rawAuthorizedKeys" != 'none' ] ; then + log debug "checking for raw authorized_keys..." + if [ -s "$rawAuthorizedKeys" ] ; then + # check permissions on the authorized_keys file path + if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then + log verbose "adding raw authorized_keys file... " + cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS" + else + log debug "not adding raw authorized_keys file." + fi + else + log debug "empty or absent authorized_keys file." + fi + fi + + # move the new authorized_keys file into place + if [ -s "$AUTHORIZED_KEYS" ] ; then + # openssh appears to check the contents of the authorized_keys + # file as the user in question, so the file must be readable + # by that user at least. + + # but in general, we don't want the user tampering with this + # file directly, so we'll adopt this approach: Own the file by + # the monkeysphere-server invoker (usually root, but should be + # the same uid that sshd is launched as); change the group of + # the file so that members of the user's group can read it. + + # FIXME: is there a better way to do this? + chown $(whoami) "$AUTHORIZED_KEYS" && \ + chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \ + chmod g+r "$AUTHORIZED_KEYS" && \ + mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \ + { + log error "Failed to install authorized_keys for '$uname'!" + rm -f "${SYSDATADIR}/authorized_keys/${uname}" + # indicate that there has been a failure: + RETURN=1 + } + else + rm -f "${SYSDATADIR}/authorized_keys/${uname}" + fi + + # unset the trap + trap - EXIT + + # destroy temporary directory + rm -rf "$TMPLOC" + done diff --git a/src/subcommands/mh/add-hostname b/src/subcommands/mh/add-hostname new file mode 100755 index 0000000..fc1ae96 --- /dev/null +++ b/src/subcommands/mh/add-hostname @@ -0,0 +1,71 @@ +#!/usr/bin/env bash + +# Monkeysphere host add-hostname subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# add hostname user ID to server key + +local userID +local fingerprint +local tmpuidMatch +local line +local adduidCommand + +if [ -z "$1" ] ; then + failure "You must specify a hostname to add." +fi + +userID="ssh://${1}" + +fingerprint=$(fingerprint_server_key) + +# match to only ultimately trusted user IDs +tmpuidMatch="u:$(echo $userID | gpg_escape)" + +# find the index of the requsted user ID +# NOTE: this is based on circumstantial evidence that the order of +# this output is the appropriate index +if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ + | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then + failure "Host userID '$userID' already exists." +fi + +echo "The following user ID will be added to the host key:" +echo " $userID" +read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N} +if [ ${OK/y/Y} != 'Y' ] ; then + failure "User ID not added." +fi + +# edit-key script command to add user ID +adduidCommand=$(cat <<EOF +adduid +$userID + + +save +EOF +) + +# execute edit-key script +if echo "$adduidCommand" | \ + gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then + + # update the trustdb for the authentication keyring + gpg_authentication "--check-trustdb" + + show_server_key + + echo + echo "NOTE: User ID added to key, but key not published." + echo "Run '$PGRM publish-key' to publish the new user ID." +else + failure "Problem adding user ID." +fi diff --git a/src/subcommands/mh/add-revoker b/src/subcommands/mh/add-revoker new file mode 100755 index 0000000..8783cd1 --- /dev/null +++ b/src/subcommands/mh/add-revoker @@ -0,0 +1,16 @@ +#!/usr/bin/env bash + +# Monkeysphere host add-revoker subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# add a revoker to the host key + +# FIXME: implement! +failure "not implemented yet!" diff --git a/src/subcommands/mh/diagnostics b/src/subcommands/mh/diagnostics new file mode 100755 index 0000000..f411e06 --- /dev/null +++ b/src/subcommands/mh/diagnostics @@ -0,0 +1,179 @@ +#!/usr/bin/env bash + +# Monkeysphere host diagnostics subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# * check on the status and validity of the key and public certificates +local seckey +local keysfound +local curdate +local warnwindow +local warndate +local create +local expire +local uid +local fingerprint +local badhostkeys +local sshd_config +local problemsfound=0 + +# FIXME: what's the correct, cross-platform answer? +sshd_config=/etc/ssh/sshd_config +seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode) +keysfound=$(echo "$seckey" | grep -c ^sec:) +curdate=$(date +%s) +# warn when anything is 2 months away from expiration +warnwindow='2 months' +warndate=$(advance_date $warnwindow +%s) + +if ! id monkeysphere >/dev/null ; then + echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell." + problemsfound=$(($problemsfound+1)) +fi + +if ! [ -d "$SYSDATADIR" ] ; then + echo "! no $SYSDATADIR directory found. Please create it." + problemsfound=$(($problemsfound+1)) +fi + +echo "Checking host GPG key..." +if (( "$keysfound" < 1 )); then + echo "! No host key found." + echo " - Recommendation: run 'monkeysphere-server gen-key'" + problemsfound=$(($problemsfound+1)) +elif (( "$keysfound" > 1 )); then + echo "! More than one host key found?" + # FIXME: recommend a way to resolve this + problemsfound=$(($problemsfound+1)) +else + create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:) + expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:) + fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:) + # check for key expiration: + if [ "$expire" ]; then + if (( "$expire" < "$curdate" )); then + echo "! Host key is expired." + echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" + problemsfound=$(($problemsfound+1)) + elif (( "$expire" < "$warndate" )); then + echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) + echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'" + problemsfound=$(($problemsfound+1)) + fi + fi + + # and weirdnesses: + if [ "$create" ] && (( "$create" > "$curdate" )); then + echo "! Host key was created in the future(?!). Is your clock correct?" + echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" + problemsfound=$(($problemsfound+1)) + fi + + # check for UserID expiration: + echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \ + while IFS=: read create expire uid ; do + # FIXME: should we be doing any checking on the form + # of the User ID? Should we be unmangling it somehow? + + if [ "$create" ] && (( "$create" > "$curdate" )); then + echo "! User ID '$uid' was created in the future(?!). Is your clock correct?" + echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?" + problemsfound=$(($problemsfound+1)) + fi + if [ "$expire" ] ; then + if (( "$expire" < "$curdate" )); then + echo "! User ID '$uid' is expired." + # FIXME: recommend a way to resolve this + problemsfound=$(($problemsfound+1)) + elif (( "$expire" < "$warndate" )); then + echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F) + # FIXME: recommend a way to resolve this + problemsfound=$(($problemsfound+1)) + fi + fi + done + +# FIXME: verify that the host key is properly published to the +# keyservers (do this with the non-privileged user) + +# FIXME: check that there are valid, non-expired certifying signatures +# attached to the host key after fetching from the public keyserver +# (do this with the non-privileged user as well) + +# FIXME: propose adding a revoker to the host key if none exist (do we +# have a way to do that after key generation?) + + # Ensure that the ssh_host_rsa_key file is present and non-empty: + echo + echo "Checking host SSH key..." + if [ ! -s "${SYSDATADIR}/ssh_host_rsa_key" ] ; then + echo "! The host key as prepared for SSH (${SYSDATADIR}/ssh_host_rsa_key) is missing or empty." + problemsfound=$(($problemsfound+1)) + else + if [ $(ls -l "${SYSDATADIR}/ssh_host_rsa_key" | cut -f1 -d\ ) != '-rw-------' ] ; then + echo "! Permissions seem wrong for ${SYSDATADIR}/ssh_host_rsa_key -- should be 0600." + problemsfound=$(($problemsfound+1)) + fi + + # propose changes needed for sshd_config (if any) + if ! grep -q "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$" "$sshd_config"; then + echo "! $sshd_config does not point to the monkeysphere host key (${SYSDATADIR}/ssh_host_rsa_key)." + echo " - Recommendation: add a line to $sshd_config: 'HostKey ${SYSDATADIR}/ssh_host_rsa_key'" + problemsfound=$(($problemsfound+1)) + fi + if badhostkeys=$(grep -i '^HostKey' "$sshd_config" | grep -v "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$") ; then + echo "! $sshd_config refers to some non-monkeysphere host keys:" + echo "$badhostkeys" + echo " - Recommendation: remove the above HostKey lines from $sshd_config" + problemsfound=$(($problemsfound+1)) + fi + + # FIXME: test (with ssh-keyscan?) that the running ssh + # daemon is actually offering the monkeysphere host key. + + fi +fi + +# FIXME: look at the ownership/privileges of the various keyrings, +# directories housing them, etc (what should those values be? can +# we make them as minimal as possible?) + +# FIXME: look to see that the ownertrust rules are set properly on the +# authentication keyring + +# FIXME: make sure that at least one identity certifier exists + +# FIXME: look at the timestamps on the monkeysphere-generated +# authorized_keys files -- warn if they seem out-of-date. + +# FIXME: check for a cronjob that updates monkeysphere-generated +# authorized_keys? + +echo +echo "Checking for MonkeySphere-enabled public-key authentication for users ..." +# Ensure that User ID authentication is enabled: +if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$" "$sshd_config"; then + echo "! $sshd_config does not point to monkeysphere authorized keys." + echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${SYSDATADIR}/authorized_keys/%u'" + problemsfound=$(($problemsfound+1)) +fi +if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -v "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$") ; then + echo "! $sshd_config refers to non-monkeysphere authorized_keys files:" + echo "$badauthorizedkeys" + echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config" + problemsfound=$(($problemsfound+1)) +fi + +if [ "$problemsfound" -gt 0 ]; then + echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:" + echo " monkeysphere-server diagnostics" +else + echo "Everything seems to be in order!" +fi diff --git a/src/subcommands/mh/extend-key b/src/subcommands/mh/extend-key new file mode 100755 index 0000000..755fe13 --- /dev/null +++ b/src/subcommands/mh/extend-key @@ -0,0 +1,29 @@ +#!/usr/bin/env bash + +# Monkeysphere host extend-key subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# extend the lifetime of a host key: + +local fpr=$(fingerprint_server_key) +local extendTo="$1" + +# get the new expiration date +extendTo=$(get_gpg_expiration "$extendTo") + +gpg_host --quiet --command-fd 0 --edit-key "$fpr" <<EOF +expire +$extendTo +save +EOF + +echo +echo "NOTE: Host key expiration date adjusted, but not yet published." +echo "Run '$PGRM publish-key' to publish the new expiration date." diff --git a/src/subcommands/mh/gen-key b/src/subcommands/mh/gen-key new file mode 100755 index 0000000..554c04c --- /dev/null +++ b/src/subcommands/mh/gen-key @@ -0,0 +1,116 @@ +#!/usr/bin/env bash + +# Monkeysphere host gen-key subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +local keyType="RSA" +local keyLength="2048" +local keyUsage="auth" +local keyExpire +local revoker +local hostName=$(hostname -f) +local userID +local keyParameters +local fingerprint + +# check for presense of secret key +# FIXME: is this the proper test to be doing here? +fingerprint_server_key >/dev/null \ + && failure "An OpenPGP host key already exists." + +# get options +while true ; do + case "$1" in + -l|--length) + keyLength="$2" + shift 2 + ;; + -e|--expire) + keyExpire="$2" + shift 2 + ;; + -r|--revoker) + revoker="$2" + shift 2 + ;; + *) + if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then + failure "Unknown option '$1'. +Type '$PGRM help' for usage." + fi + hostName="$1" + shift; + break + ;; + esac +done + +userID="ssh://${hostName}" + +# prompt about key expiration if not specified +keyExpire=$(get_gpg_expiration "$keyExpire") + +# set key parameters +keyParameters=\ +"Key-Type: $keyType +Key-Length: $keyLength +Key-Usage: $keyUsage +Name-Real: $userID +Expire-Date: $keyExpire" + +# add the revoker field if specified +# FIXME: the "1:" below assumes that $REVOKER's key is an RSA key. +# FIXME: key is marked "sensitive"? is this appropriate? +if [ "$revoker" ] ; then + keyParameters=\ +"${keyParameters} +Revoker: 1:${revoker} sensitive" +fi + +echo "The following key parameters will be used for the host private key:" +echo "$keyParameters" + +read -p "Generate key? (Y/n) " OK; OK=${OK:=Y} +if [ ${OK/y/Y} != 'Y' ] ; then + failure "aborting." +fi + +# add commit command +# must include blank line! +keyParameters=\ +"${keyParameters} + +%commit +%echo done" + +log verbose "generating host key..." +echo "$keyParameters" | gpg_host --batch --gen-key + +# find the key fingerprint of the newly generated key +fingerprint=$(fingerprint_server_key) + +# export host ownertrust to authentication keyring +log verbose "setting ultimate owner trust for host key..." +echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust" + +# translate the private key to ssh format, and export to a file +# for sshs usage. +# NOTE: assumes that the primary key is the proper key to use +(umask 077 && \ + gpg_host --export-secret-key "$fingerprint" | \ + openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key") +log info "SSH host private key output to file: ${SYSDATADIR}/ssh_host_rsa_key" +ssh-keygen -y -f "${SYSDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub" +log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub" +gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" +log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" + +# show info about new key +show_server_key diff --git a/src/subcommands/mh/import-key b/src/subcommands/mh/import-key new file mode 100755 index 0000000..bbeb37f --- /dev/null +++ b/src/subcommands/mh/import-key @@ -0,0 +1,84 @@ +#!/usr/bin/env bash + +# Monkeysphere host import-key subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +local hostName=$(hostname -f) +local keyFile="/etc/ssh/ssh_host_rsa_key" +local keyExpire +local userID + +# check for presense of secret key +# FIXME: is this the proper test to be doing here? +fingerprint_server_key >/dev/null \ + && failure "An OpenPGP host key already exists." + +# get options +while true ; do + case "$1" in + -f|--keyfile) + keyFile="$2" + shift 2 + ;; + -e|--expire) + keyExpire="$2" + shift 2 + ;; + *) + if [ "$(echo "$1" | cut -c 1)" = '-' ] ; then + failure "Unknown option '$1'. +Type '$PGRM help' for usage." + fi + hostName="$1" + shift + ;; + break + ;; + esac +done + +if [ ! -f "$keyFile" ] ; then + failure "SSH secret key file '$keyFile' not found." +fi + +userID="ssh://${hostName}" + +# prompt about key expiration if not specified +keyExpire=$(get_gpg_expiration "$keyExpire") + +echo "The following key parameters will be used for the host private key:" +echo "Import: $keyFile" +echo "Name-Real: $userID" +echo "Expire-Date: $keyExpire" + +read -p "Import key? (Y/n) " OK; OK=${OK:=Y} +if [ ${OK/y/Y} != 'Y' ] ; then + failure "aborting." +fi + +log verbose "importing ssh key..." +# translate ssh key to a private key +(umask 077 && \ + pem2openpgp "$userID" "$keyExpire" < "$sshKey" | gpg_host --import) + +# find the key fingerprint of the newly converted key +fingerprint=$(fingerprint_server_key) + +# export host ownertrust to authentication keyring +log verbose "setting ultimate owner trust for host key..." +echo "${fingerprint}:6:" | gpg_host "--import-ownertrust" +echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust" + +# export public key to file +gpg_authentication "--export-options export-minimal --armor --export 0x${fingerprint}\!" > "${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" +log info "SSH host public key in OpenPGP form: ${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" + +# show info about new key +show_server_key diff --git a/src/subcommands/mh/publish-key b/src/subcommands/mh/publish-key new file mode 100755 index 0000000..792d858 --- /dev/null +++ b/src/subcommands/mh/publish-key @@ -0,0 +1,24 @@ +#!/usr/bin/env bash + +# Monkeysphere host publish-key subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# publish server key to keyserver + +read -p "Really publish host key to $KEYSERVER? (y/N) " OK; OK=${OK:=N} +if [ ${OK/y/Y} != 'Y' ] ; then + failure "key not published." +fi + +# find the key fingerprint +fingerprint=$(fingerprint_server_key) + +# publish host key +gpg_authentication "--keyserver $KEYSERVER --send-keys '0x${fingerprint}!'" diff --git a/src/subcommands/mh/revoke-hostname b/src/subcommands/mh/revoke-hostname new file mode 100755 index 0000000..decac86 --- /dev/null +++ b/src/subcommands/mh/revoke-hostname @@ -0,0 +1,89 @@ +#!/usr/bin/env bash + +# Monkeysphere host revoke-hostname subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# revoke hostname user ID from host key + +local userID +local fingerprint +local tmpuidMatch +local line +local uidIndex +local message +local revuidCommand + +if [ -z "$1" ] ; then + failure "You must specify a hostname to revoke." +fi + +echo "WARNING: There is a known bug in this function." +echo "This function has been known to occasionally revoke the wrong user ID." +echo "Please see the following bug report for more information:" +echo "http://web.monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/" +read -p "Are you sure you would like to proceed? (y/N) " OK; OK=${OK:=N} +if [ ${OK/y/Y} != 'Y' ] ; then + failure "aborting." +fi + +userID="ssh://${1}" + +fingerprint=$(fingerprint_server_key) + +# match to only ultimately trusted user IDs +tmpuidMatch="u:$(echo $userID | gpg_escape)" + +# find the index of the requsted user ID +# NOTE: this is based on circumstantial evidence that the order of +# this output is the appropriate index +if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \ + | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then + uidIndex=${line%%:*} +else + failure "No non-revoked user ID '$userID' is found." +fi + +echo "The following host key user ID will be revoked:" +echo " $userID" +read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N} +if [ ${OK/y/Y} != 'Y' ] ; then + failure "User ID not revoked." +fi + +message="Hostname removed by monkeysphere-server $DATE" + +# edit-key script command to revoke user ID +revuidCommand=$(cat <<EOF +$uidIndex +revuid +y +4 +$message + +y +save +EOF + ) + +# execute edit-key script +if echo "$revuidCommand" | \ + gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then + + # update the trustdb for the authentication keyring + gpg_authentication "--check-trustdb" + + show_server_key + + echo + echo "NOTE: User ID revoked, but revocation not published." + echo "Run '$PGRM publish-key' to publish the revocation." +else + failure "Problem revoking user ID." +fi diff --git a/src/subcommands/mh/revoke-key b/src/subcommands/mh/revoke-key new file mode 100755 index 0000000..b4ce401 --- /dev/null +++ b/src/subcommands/mh/revoke-key @@ -0,0 +1,16 @@ +#!/usr/bin/env bash + +# Monkeysphere host revoke-key subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# revoke host key + +# FIXME: implement! +failure "not implemented yet!" diff --git a/src/subcommands/mh/show-key b/src/subcommands/mh/show-key new file mode 100755 index 0000000..c62ec16 --- /dev/null +++ b/src/subcommands/mh/show-key @@ -0,0 +1,37 @@ +#!/usr/bin/env bash + +# Monkeysphere host show-key subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins <jrollins@fifthhorseman.net> +# Jamie McClelland <jm@mayfirst.org> +# Daniel Kahn Gillmor <dkg@fifthhorseman.net> +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +local fingerprintPGP +local fingerprintSSH +local ret=0 + +# FIXME: you shouldn't have to be root to see the host key fingerprint +if is_root ; then + check_host_keyring + fingerprintPGP=$(fingerprint_server_key) + gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprintPGP" 2>/dev/null + echo "OpenPGP fingerprint: $fingerprintPGP" +else + log info "You must be root to see host OpenPGP fingerprint." + ret='1' +fi + +if [ -f "${SYSDATADIR}/ssh_host_rsa_key.pub" ] ; then + fingerprintSSH=$(ssh-keygen -l -f "${SYSDATADIR}/ssh_host_rsa_key.pub" | \ + awk '{ print $1, $2, $4 }') + echo "ssh fingerprint: $fingerprintSSH" +else + log info "SSH host key not found." + ret='1' +fi + +return $ret |