From ec76b3cef0014c6aa68ec8982101892c74958b99 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Sat, 7 Jun 2008 19:27:51 -0400 Subject: updated gpg2ssh to properly check for data encryption and authentication. --- gpg2ssh/Makefile | 6 ++++-- gpg2ssh/gpg2ssh.c | 14 ++++++++------ 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/gpg2ssh/Makefile b/gpg2ssh/Makefile index aa18aaa..a0b7241 100644 --- a/gpg2ssh/Makefile +++ b/gpg2ssh/Makefile @@ -1,3 +1,5 @@ +all: monkeysphere gpg2ssh + monkeysphere: main.c gnutls-helpers.o gcc -g -Wall --pedantic -o monkeysphere main.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o @@ -11,6 +13,6 @@ ssh2gpg: ssh2gpg.c gnutls-helpers.o gcc -g -Wall --pedantic -o $@ -c $< clean: - rm -f monkeysphere *.o + rm -f monkeysphere gpg2ssh *.o -.PHONY: clean +.PHONY: clean all diff --git a/gpg2ssh/gpg2ssh.c b/gpg2ssh/gpg2ssh.c index a1e94df..c99f03f 100644 --- a/gpg2ssh/gpg2ssh.c +++ b/gpg2ssh/gpg2ssh.c @@ -116,8 +116,9 @@ int main(int argc, char* argv[]) { err("failed to get the usage flags for the primary key (error: %d)\n", ret); return ret; } - if (usage & GNUTLS_KEY_KEY_AGREEMENT) { - err("the primary key can be used for authentication\n"); + if (usage & GNUTLS_KEY_KEY_AGREEMENT && + usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { + err("the primary key can be used for authentication and communication encryption!\n"); algo = gnutls_openpgp_crt_get_pk_algorithm(openpgp_crt, &bits); if (algo < 0) { @@ -144,10 +145,10 @@ int main(int argc, char* argv[]) { } } else { - err("primary key is only good for: 0x%08x. Trying subkeys...\n", usage); + err("primary key is not good for authentication and communication encryption. Trying subkeys...\n"); if (ret = gnutls_openpgp_crt_get_auth_subkey(openpgp_crt, keyid, 0), ret) { - err("failed to find a subkey capable of authentication (error: %d)\n", ret); + err("failed to find a subkey capable of authentication and communication encryption (error: %d)\n", ret); return ret; } make_keyid_printable(p_keyid, keyid); @@ -169,8 +170,9 @@ int main(int argc, char* argv[]) { err("could not figure out usage of subkey %.16s (error: %d)\n", p_keyid, ret); return ret; } - if ((usage & GNUTLS_KEY_KEY_AGREEMENT) == 0) { - err("could not find a subkey with authentication privileges.\n"); + if ((usage & GNUTLS_KEY_KEY_AGREEMENT) == 0 && + usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { + err("could not find a subkey with authentication and communication encryption.\n"); return 1; } -- cgit v1.2.3 From f016e55c785648e0032c88c6eed872f663e81e39 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Sat, 7 Jun 2008 19:39:55 -0400 Subject: small change to correct usage of howler --- doc/MonkeySpec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/MonkeySpec b/doc/MonkeySpec index 6ac5f11..9ed0724 100644 --- a/doc/MonkeySpec +++ b/doc/MonkeySpec @@ -41,7 +41,7 @@ server-side components * "howler": server gpg maintainer - generates gpg keys for the server - publishes server gpg keys - - used to specify userids to trust for user authentication + - used to specify keys to trust for user authentication * "tamarin": script to trigger rhesus during attempt to initiate connection from client -- cgit v1.2.3 From d89dfcbf8f15e50f807a1aa133e967ff06cb37fb Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 9 Jun 2008 01:45:31 -0400 Subject: more work on rhesus - known_hosts processing know processes known_hosts file directly - uses "ssh-keygen -R" to remove keys as necessary - known_hosts lines can be hashed if requested - added ability to specify required key capability - added ability to specify if user authorized_keys file is added --- monkeysphere.conf | 17 ++- rhesus/rhesus | 417 ++++++++++++++++++++++++++++++++++++------------------ 2 files changed, 296 insertions(+), 138 deletions(-) diff --git a/monkeysphere.conf b/monkeysphere.conf index cd5e3b2..6401203 100644 --- a/monkeysphere.conf +++ b/monkeysphere.conf @@ -4,7 +4,7 @@ # rhesus shell script when run in administrative mode to maintain # authorized_keys files for users. -AUTH_USER_FILE=/etc/monkeysphere/auth_user_ids/"$USER" +AUTHORIZED_USER_IDS=/etc/monkeysphere/authorized_user_ids/"$USER" STAGING_AREA=/var/lib/monkeysphere/stage/"$USER" @@ -13,3 +13,18 @@ GNUPGHOME=/etc/monkeysphere/gnupg # gpg keyserver to search for keys KEYSERVER=subkeys.pgp.net + +# required capabilities of keys +# must be quoted, lowercase, space-seperated list of the following: +# e = encrypt +# s = sign +# c = certify +# a = authentication +REQUIRED_KEY_CAPABILITY="e a" + +# Path to user-controlled authorized_keys file to add to +# Monkeysphere-generated authorized_keys file. If empty, then no +# user-controlled file will be added. To specify the user's home +# directory, use the string "~${USER}" +USER_CONTROLLED_AUTHORIZED_KEYS="~${USER}/.ssh/authorized_keys" + diff --git a/rhesus/rhesus b/rhesus/rhesus index 7a43fca..f607f0b 100755 --- a/rhesus/rhesus +++ b/rhesus/rhesus @@ -1,4 +1,4 @@ -#!/bin/sh -e +#!/bin/sh # rhesus: monkeysphere authorized_keys/known_hosts generating script # @@ -7,19 +7,27 @@ # # Copyright 2008, released under the GPL, version 3 or later +# all caps variables are meant to be user supplied (ie. from config +# file) and are considered global + PGRM=$(basename $0) +# date in UTF format if needed +DATE=$(date -u '+%FT%T') + +# unset some environment variables that could screw things up +GREP_OPTIONS= + ######################################################################## # FUNCTIONS ######################################################################## usage() { cat <&2 + echo "$@" 1>&2 +} + # cut out all comments(#) and blank lines from standard input meat() { grep -v -e "^[[:space:]]*#" -e '^$' @@ -55,6 +70,24 @@ gpg_fetch_keys() { --search ="$id" >/dev/null 2>&1 } +# check that characters are in a string (in an AND fashion). +# used for checking key capability +# check_capability capability a [b...] +check_capability() { + local capability + local capcheck + + capability="$1" + shift 1 + + for capcheck ; do + if echo "$capability" | grep -q -v "$capcheck" ; then + return 1 + fi + done + return 0 +} + # convert escaped characters from gpg output back into original # character # FIXME: undo all escape character translation in with-colons gpg output @@ -66,87 +99,120 @@ unescape() { gpg2ssh_tmp() { local mode local keyID + local userID + local host mode="$1" keyID="$2" userID="$3" - if [ "$mode" = 'authorized_keys' -o "$mode" = 'a' ] ; then - gpgkey2ssh "$keyID" | sed -e "s/COMMENT/$userID/" - elif [ "$mode" = 'known_hosts' -o "$mode" = 'k' ] ; then - echo -n "$userID "; gpgkey2ssh "$keyID" | sed -e 's/ COMMENT//' + if [ "$mode" = 'authorized_keys' ] ; then + gpgkey2ssh "$keyID" | sed -e "s/COMMENT/${userID}/" + + # NOTE: it seems that ssh-keygen -R removes all comment fields from + # all lines in the known_hosts file. why? + # NOTE: just in case, the COMMENT can be matched with the + # following regexp: + # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' + elif [ "$mode" = 'known_hosts' ] ; then + host=$(echo "$userID" | sed -e "s|ssh://||") + echo -n "$host "; gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere${DATE}/" fi } # userid and key policy checking # the following checks policy on the returned keys # - checks that full key has appropriate valididy (u|f) -# - checks key has appropriate capability (E|A) +# - checks key has specified capability (REQUIRED_KEY_CAPABILITY) # - checks that particular desired user id has appropriate validity # see /usr/share/doc/gnupg/DETAILS.gz -# FIXME: add some more status output # expects global variable: "mode" process_user_id() { local userID local cacheDir + local requiredPubCapability + local gpgOut + local line + local type + local validity + local keyid + local uidfpr + local capability local keyOK - local keyCapability - local keyFingerprint + local pubKeyID + local uidOK + local keyIDs local userIDHash + local keyID userID="$1" cacheDir="$2" - # fetch all keys from keyserver - # if none found, break - if ! gpg_fetch_keys "$userID" ; then - echo " no keys found." - return + requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") + + # fetch keys from keyserver, return 1 if none found + gpg_fetch_keys "$userID" || return 1 + + # output gpg info for (exact) userid and store + gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ + ="$userID" 2> /dev/null) + + # return 1 if there only "tru" lines are output from gpg + if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then + return 1 fi - # some crazy piping here that takes the output of gpg and - # pipes it into a "while read" loop that reads each line - # of standard input one-by-one. - gpg --fixed-list-mode --list-key --with-colons \ - --with-fingerprint ="$userID" 2> /dev/null | \ - cut -d : -f 1,2,5,10,12 | \ - while IFS=: read -r type validity keyid uidfpr capability ; do + # loop over all lines in the gpg output and process. + # need to do it this way (as opposed to "while read...") so that + # variables set in loop will be visible outside of loop + for line in $(seq 1 $(echo "$gpgOut" | wc -l)) ; do + + # read the contents of the line + type=$(echo "$gpgOut" | cutline "$line" | cut -d: -f1) + validity=$(echo "$gpgOut" | cutline "$line" | cut -d: -f2) + keyid=$(echo "$gpgOut" | cutline "$line" | cut -d: -f5) + uidfpr=$(echo "$gpgOut" | cutline "$line" | cut -d: -f10) + capability=$(echo "$gpgOut" | cutline "$line" | cut -d: -f12) + # process based on record type case $type in - 'pub') + 'pub') # primary keys # new key, wipe the slate keyOK= - keyCapability= - keyFingerprint= + pubKeyID= + uidOK= + keyIDs= + + pubKeyID="$keyid" + # check primary key validity if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + loge " unacceptable primary key validity ($validity)." continue fi # check capability is not Disabled... - if echo "$capability" | grep -q 'D' ; then + if check_capability "$capability" 'D' ; then + loge " key disabled." continue fi - # check capability is Encryption and Authentication - # FIXME: make more flexible capability specification - # (ie. in conf file) - if echo "$capability" | grep -q -v 'E' ; then - if echo "$capability" | grep -q -v 'A' ; then - continue - fi + # check overall key capability + # must be Encryption and Authentication + if ! check_capability "$capability" $requiredPubCapability ; then + loge " unacceptable primary key capability ($capability)." + continue fi - keyCapability="$capability" + + # mark if primary key is acceptable keyOK=true - keyID="$keyid" - ;; - 'fpr') - # if key ok, get fingerprint - if [ "$keyOK" ] ; then - keyFingerprint="$uidfpr" + + # add primary key ID to key list if it has required capability + if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + keyIDs[${#keyIDs[*]}]="$keyid" fi ;; - 'uid') + 'uid') # user ids # check key ok and we have key fingerprint - if [ -z "$keyOK" -o -z "$keyFingerprint" ] ; then + if [ -z "$keyOK" ] ; then continue fi # check key validity @@ -157,53 +223,111 @@ process_user_id() { if [ "$(unescape "$uidfpr")" != "$userID" ] ; then continue fi - # convert the key - # FIXME: needs to apply extra options if specified - echo -n " valid key found; generating ssh key(s)... " - userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') - # export the key with gpg2ssh - #gpg --export "$keyFingerprint" | gpg2ssh "$mode" > "$cacheDir"/"$userIDHash"."$keyFingerprint" - # stand in until we get dkg's gpg2ssh program - gpg2ssh_tmp "$mode" "$keyID" "$userID" > "$cacheDir"/"$userIDHash"."$keyFingerprint" - if [ "$?" = 0 ] ; then - echo "done." - else - echo "error." + + # mark if uid acceptable + uidOK=true + ;; + 'sub') # sub keys + # add sub key ID to key list if it has required capability + if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + keyIDs[${#keyIDs[*]}]="$keyid" fi ;; esac done + + # hash userid for cache file name + userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') + + # touch/clear key cache file + # (will be left empty if there are noacceptable keys) + > "$cacheDir"/"$userIDHash"."$pubKeyID" + + # for each acceptable key, write an ssh key line to the + # key cache file + if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then + for keyID in ${keyIDs[@]} ; do + # export the key with gpg2ssh + # FIXME: needs to apply extra options for authorized_keys + # lines if specified + gpg2ssh_tmp "$mode" "$keyID" "$userID" >> "$cacheDir"/"$userIDHash"."$pubKeyID" + + # hash the cache file if specified + if [ "$mode" = 'known_hosts' -a "$HASH_KNOWN_HOSTS" ] ; then + ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 + rm "$cacheDir"/"$userIDHash"."$pubKeyID".old + fi + done + fi + + # echo the path to the key cache file + echo "$cacheDir"/"$userIDHash"."$pubKeyID" } -# process the auth_*_ids file -# go through line-by-line, extracting and processing each user id -# expects global variable: "mode" -process_auth_file() { - local authIDsFile +# process a host for addition to a known_host file +process_host() { + local host local cacheDir - local nLines - local line - local userID + local hostKeyCachePath - authIDsFile="$1" + host="$1" cacheDir="$2" - # find number of user ids in auth_user_ids file - nLines=$(meat <"$authIDsFile" | wc -l) + log "processing host: '$host'" + + hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") + if [ $? = 0 ] ; then + ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS" + cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS" + fi +} + +# process known_hosts file +# go through line-by-line, extract each host, and process with the +# host processing function +process_known_hosts() { + local cacheDir + local userID + + cacheDir="$1" + + # take all the hosts from the known_hosts file (first field), + # grep out all the hashed hosts (lines starting with '|') + cut -d ' ' -f 1 "$USER_KNOWN_HOSTS" | \ + grep -v '^|.*$' | \ + while IFS=, read -r -a hosts ; do + # process each host + for host in ${hosts[*]} ; do + process_host "$host" "$cacheDir" + done + done +} + +# process an authorized_*_ids file +# go through line-by-line, extract each userid, and process +process_authorized_ids() { + local authorizedIDsFile + local cacheDir + local userID + local userKeyCachePath + + authorizedIDsFile="$1" + cacheDir="$2" # clean out keys file and remake keys directory rm -rf "$cacheDir" mkdir -p "$cacheDir" - # loop through all user ids - for line in $(seq 1 $nLines) ; do - # get user id - # FIXME: needs to handle extra options if necessary - userID=$(meat <"$authIDsFile" | cutline "$line" ) - - # process the user id and extract keys - log "processing user id: '$userID'" - process_user_id "$userID" "$cacheDir" + # loop through all user ids in file + # FIXME: needs to handle extra options if necessary + cat "$authorizedIDsFile" | meat | \ + while read -r userID ; do + # process the userid + log "processing userid: '$userID'" + userKeyCachePath=$(process_user_id "$userID" "$cacheDir") + if [ -s "$userKeyCachePath" ] ; then + loge " acceptable key/uid found." + fi done } @@ -216,7 +340,7 @@ if [ -z "$1" ] ; then exit 1 fi -# check mode +# mode given in first variable mode="$1" shift 1 @@ -237,13 +361,13 @@ MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} # set config variable defaults STAGING_AREA=${STAGING_AREA:-"$MS_HOME"} -AUTH_HOST_FILE=${AUTH_HOST_FILE:-"$MS_HOME"/auth_host_ids} -AUTH_USER_FILE=${AUTH_USER_FILE:-"$MS_HOME"/auth_user_ids} +AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids} GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg} KEYSERVER=${KEYSERVER:-subkeys.pgp.net} - -USER_KNOW_HOSTS="$HOME"/.ssh/known_hosts -USER_AUTHORIZED_KEYS="$HOME"/.ssh/authorized_keys +REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"$HOME"/.ssh/authorized_keys} +USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts} +HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-} # export USER and GNUPGHOME variables, since they are used by gpg export USER @@ -255,69 +379,88 @@ userKeysCacheDir="$STAGING_AREA"/user_keys msKnownHosts="$STAGING_AREA"/known_hosts msAuthorizedKeys="$STAGING_AREA"/authorized_keys -# set mode variables +# make sure gpg home exists with proper permissions +mkdir -p -m 0700 "$GNUPGHOME" + +## KNOWN_HOST MODE if [ "$mode" = 'known_hosts' -o "$mode" = 'k' ] ; then - fileType=known_hosts - authFileType=auth_host_ids - authIDsFile="$AUTH_HOST_FILE" - outFile="$msKnownHosts" + mode='known_hosts' + cacheDir="$hostKeysCacheDir" - userFile="$USER_KNOWN_HOSTS" + + log "user '$USER': monkeysphere known_hosts processing" + + # touch the known_hosts file to make sure it exists + touch "$USER_KNOWN_HOSTS" + + # if hosts are specified on the command line, process just + # those hosts + if [ "$1" ] ; then + for host ; do + process_host "$host" "$cacheDir" + done + + # otherwise, if no hosts are specified, process the user + # known_hosts file + else + if [ ! -s "$USER_KNOWN_HOSTS" ] ; then + failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." + fi + process_known_hosts "$cacheDir" + fi + +## AUTHORIZED_KEYS MODE elif [ "$mode" = 'authorized_keys' -o "$mode" = 'a' ] ; then - fileType=authorized_keys - authFileType=auth_user_ids - authIDsFile="$AUTH_USER_FILE" - outFile="$msAuthorizedKeys" - cacheDir="$userKeysCacheDir" - userFile="$USER_AUTHORIZED_KEYS" -else - failure "unknown command '$mode'." -fi + mode='authorized_keys' -# check auth ids file -if [ ! -s "$authIDsFile" ] ; then - echo "'$authFileType' file is empty or does not exist." - exit -fi + cacheDir="$userKeysCacheDir" -log "user '$USER': monkeysphere $fileType generation" + # check auth ids file + if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then + log "authorized_user_ids file is empty or does not exist." + exit + fi -# make sure gpg home exists with proper permissions -mkdir -p -m 0700 "$GNUPGHOME" + log "user '$USER': monkeysphere authorized_keys processing" + + # if userids are specified on the command line, process just + # those userids + if [ "$1" ] ; then + for userID ; do + if ! grep -q "$userID" "$AUTHORIZED_USER_IDS" ; then + log "userid '$userID' not in authorized_user_ids file." + continue + fi + log "processing user id: '$userID'" + process_user_id "$userID" "$cacheDir" > /dev/null + done + + # otherwise, if no userids are specified, process the entire + # authorized_user_ids file + else + process_authorized_ids "$AUTHORIZED_USER_IDS" "$cacheDir" + fi -# if users are specified on the command line, process just -# those users -if [ "$1" ] ; then - # process userids given on the command line - for userID ; do - if ! grep -q "$userID" "$authIDsFile" ; then - log "userid '$userID' not in $authFileType file." - continue + # write output key file + log "writing monkeysphere authorized_keys file... " + touch "$msAuthorizedKeys" + if [ "$(ls "$cacheDir")" ] ; then + log -n "adding gpg keys... " + cat "$cacheDir"/* > "$msAuthorizedKeys" + echo "done." + else + log "no gpg keys to add." + fi + if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then + if [ -s "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then + log -n "adding user authorized_keys file... " + cat "$USER_CONTROLLED_AUTHORIZED_KEYS" >> "$msAuthorizedKeys" + echo "done." fi - log "processing user id: '$userID'" - process_user_id "$userID" "$cacheDir" - done -# otherwise if no users are specified, process the entire -# auth_*_ids file -else - # process the auth file - process_auth_file "$authIDsFile" "$cacheDir" -fi + fi + log "monkeysphere authorized_keys file generated:" + log "$msAuthorizedKeys" -# write output key file -log "writing ms $fileType file... " -> "$outFile" -if [ "$(ls "$cacheDir")" ] ; then - log -n "adding gpg keys... " - cat "$cacheDir"/* > "$outFile" - echo "done." else - log "no gpg keys to add." -fi -if [ -s "$userFile" ] ; then - log -n "adding user $fileType file... " - cat "$userFile" >> "$outFile" - echo "done." + failure "unknown command '$mode'." fi -log "ms $fileType file generated:" -log "$outFile" -- cgit v1.2.3 From 6c335e70360c7502a2205d21e9f96d4bf2679cbd Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 9 Jun 2008 01:50:49 -0400 Subject: small tweak to MonkeySpec --- doc/MonkeySpec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/MonkeySpec b/doc/MonkeySpec index fe5a0bf..54aaa72 100644 --- a/doc/MonkeySpec +++ b/doc/MonkeySpec @@ -39,9 +39,9 @@ common components server-side components ---------------------- * "howler": server gpg maintainer - - generates gpg keys for the server - - publishes server gpg keys - - used to specify keys to trust for user authentication + - generate gpg keys for the server + - publish server gpg keys + - give owner trust to keys for user authentication * "tamarin": concept - how to trigger or schedule rhesus at admin defined points (e.g. via cron or during ssh connections). -- cgit v1.2.3 From 4793624c65673268128fb0146cd9bd1b3cfeb6c4 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 10 Jun 2008 17:17:51 -0400 Subject: New client/server components: - broke out all common functions to "common" file - put all client commands into "monkeysphere" script - put all server commands into "monkeysphere-server" script - moved all code into src directory to clean things up a bit - this effectively makes obsolete rhesus and howler - added proposed monkeysphere-ssh-proxycommand script that can be called to update known_hosts from ssh ProxyCommand - updated monkeysphere.conf to work as global client config - added monkeysphere-server.conf for server config --- .gitignore | 3 - gpg2ssh/Makefile | 18 -- gpg2ssh/gnutls-helpers.c | 364 ----------------------------- gpg2ssh/gnutls-helpers.h | 72 ------ gpg2ssh/gpg2ssh.c | 293 ------------------------ gpg2ssh/main.c | 271 ---------------------- gpg2ssh/ssh2gpg.c | 171 -------------- howler/howler | 134 ----------- langur/README | 4 - monkeysphere-server.conf | 23 ++ monkeysphere.conf | 37 +-- rhesus/README | 30 --- rhesus/rhesus | 466 -------------------------------------- src/common | 353 +++++++++++++++++++++++++++++ src/gpg2ssh/Makefile | 18 ++ src/gpg2ssh/gnutls-helpers.c | 364 +++++++++++++++++++++++++++++ src/gpg2ssh/gnutls-helpers.h | 72 ++++++ src/gpg2ssh/gpg2ssh.c | 293 ++++++++++++++++++++++++ src/gpg2ssh/main.c | 271 ++++++++++++++++++++++ src/gpg2ssh/ssh2gpg.c | 171 ++++++++++++++ src/howler/howler | 134 +++++++++++ src/monkeysphere | 154 +++++++++++++ src/monkeysphere-server | 219 ++++++++++++++++++ src/monkeysphere-ssh-proxycommand | 16 ++ src/rhesus/README | 30 +++ src/rhesus/rhesus | 466 ++++++++++++++++++++++++++++++++++++++ 26 files changed, 2603 insertions(+), 1844 deletions(-) delete mode 100644 gpg2ssh/Makefile delete mode 100644 gpg2ssh/gnutls-helpers.c delete mode 100644 gpg2ssh/gnutls-helpers.h delete mode 100644 gpg2ssh/gpg2ssh.c delete mode 100644 gpg2ssh/main.c delete mode 100644 gpg2ssh/ssh2gpg.c delete mode 100755 howler/howler delete mode 100644 langur/README create mode 100644 monkeysphere-server.conf delete mode 100644 rhesus/README delete mode 100755 rhesus/rhesus create mode 100755 src/common create mode 100644 src/gpg2ssh/Makefile create mode 100644 src/gpg2ssh/gnutls-helpers.c create mode 100644 src/gpg2ssh/gnutls-helpers.h create mode 100644 src/gpg2ssh/gpg2ssh.c create mode 100644 src/gpg2ssh/main.c create mode 100644 src/gpg2ssh/ssh2gpg.c create mode 100755 src/howler/howler create mode 100755 src/monkeysphere create mode 100755 src/monkeysphere-server create mode 100755 src/monkeysphere-ssh-proxycommand create mode 100644 src/rhesus/README create mode 100755 src/rhesus/rhesus diff --git a/.gitignore b/.gitignore index 80bf65d..0dc4f79 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,2 @@ *~ *.[ao] -monkeysphere -gpg2ssh -ssh2gpg diff --git a/gpg2ssh/Makefile b/gpg2ssh/Makefile deleted file mode 100644 index a0b7241..0000000 --- a/gpg2ssh/Makefile +++ /dev/null @@ -1,18 +0,0 @@ -all: monkeysphere gpg2ssh - -monkeysphere: main.c gnutls-helpers.o - gcc -g -Wall --pedantic -o monkeysphere main.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o - -gpg2ssh: gpg2ssh.c gnutls-helpers.o - gcc -g -Wall --pedantic -o gpg2ssh gpg2ssh.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o - -ssh2gpg: ssh2gpg.c gnutls-helpers.o - gcc -g -Wall --pedantic -o ssh2gpg ssh2gpg.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o - -%.o: %.c - gcc -g -Wall --pedantic -o $@ -c $< - -clean: - rm -f monkeysphere gpg2ssh *.o - -.PHONY: clean all diff --git a/gpg2ssh/gnutls-helpers.c b/gpg2ssh/gnutls-helpers.c deleted file mode 100644 index 6eae29e..0000000 --- a/gpg2ssh/gnutls-helpers.c +++ /dev/null @@ -1,364 +0,0 @@ -/* Author: Daniel Kahn Gillmor */ -/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ -/* License: GPL v3 or later */ - -#include "gnutls-helpers.h" -/* for htonl() */ -#include - -/* for setlocale() */ -#include - -/* for isalnum() */ -#include - -int loglevel = 0; - - -void err(const char* fmt, ...) { - va_list ap; - va_start(ap, fmt); - vfprintf(stderr, fmt, ap); - va_end(ap); - fflush(stderr); -} - -void logfunc(int level, const char* string) { - fprintf(stderr, "GnuTLS Logging (%d): %s\n", level, string); -} - -void init_keyid(gnutls_openpgp_keyid_t keyid) { - memset(keyid, 'x', sizeof(gnutls_openpgp_keyid_t)); -} - - - -void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid) -{ - static const char hex[16] = "0123456789ABCDEF"; - unsigned int kix = 0, outix = 0; - - while (kix < sizeof(gnutls_openpgp_keyid_t)) { - out[outix] = hex[(keyid[kix] >> 4) & 0x0f]; - out[outix + 1] = hex[keyid[kix] & 0x0f]; - kix++; - outix += 2; - } -} - - -int init_gnutls() { - const char* version = NULL; - const char* debug_string = NULL; - int ret; - - if (ret = gnutls_global_init(), ret) { - err("Failed to do gnutls_global_init() (error: %d)\n", ret); - return 1; - } - - version = gnutls_check_version(NULL); - - if (version) - err("gnutls version: %s\n", version); - else { - err("no version found!\n"); - return 1; - } - - if (debug_string = getenv("MONKEYSPHERE_DEBUG"), debug_string) { - loglevel = atoi(debug_string); - gnutls_global_set_log_function(logfunc); - - gnutls_global_set_log_level(loglevel); - err("set log level to %d\n", loglevel); - } - return 0; -} - -void init_datum(gnutls_datum_t* d) { - d->data = NULL; - d->size = 0; -} -void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src) { - dest->data = gnutls_realloc(dest->data, src->size); - dest->size = src->size; - memcpy(dest->data, src->data, src->size); -} -int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b) { - if (a->size > b->size) { - err("a is larger\n"); - return 1; - } - if (a->size < b->size) { - err("b is larger\n"); - return -1; - } - return memcmp(a->data, b->data, a->size); -} -void free_datum(gnutls_datum_t* d) { - gnutls_free(d->data); - d->data = NULL; - d->size = 0; -} - -/* read the passed-in string, store in a single datum */ -int set_datum_string(gnutls_datum_t* d, const char* s) { - unsigned int x = strlen(s)+1; - unsigned char* c = NULL; - - c = gnutls_realloc(d->data, x); - if (NULL == c) - return -1; - d->data = c; - d->size = x; - memcpy(d->data, s, x); - return 0; -} - -/* read the passed-in file descriptor until EOF, store in a single - datum */ -int set_datum_fd(gnutls_datum_t* d, int fd) { - unsigned int bufsize = 1024; - unsigned int len = 0; - - FILE* f = fdopen(fd, "r"); - if (bufsize > d->size) { - bufsize = 1024; - d->data = gnutls_realloc(d->data, bufsize); - if (d->data == NULL) { - err("out of memory!\n"); - return -1; - } - d->size = bufsize; - } else { - bufsize = d->size; - } - f = fdopen(fd, "r"); - if (NULL == f) { - err("could not fdopen FD %d\n", fd); - } - clearerr(f); - while (!feof(f) && !ferror(f)) { - if (len == bufsize) { - /* allocate more space by doubling: */ - bufsize *= 2; - d->data = gnutls_realloc(d->data, bufsize); - if (d->data == NULL) { - err("out of memory!\n"); - return -1; - }; - d->size = bufsize; - } - len += fread(d->data + len, 1, bufsize - len, f); - /* err("read %d bytes\n", len); */ - } - if (ferror(f)) { - err("Error reading from fd %d (error: %d) (error: %d '%s')\n", fd, ferror(f), errno, strerror(errno)); - return -1; - } - - /* touch up buffer size to match reality: */ - d->data = gnutls_realloc(d->data, len); - d->size = len; - return 0; -} - -/* read the file indicated (by name) in the fname parameter. store - its entire contents in a single datum. */ -int set_datum_file(gnutls_datum_t* d, const char* fname) { - struct stat sbuf; - unsigned char* c = NULL; - FILE* file = NULL; - size_t x = 0; - - if (0 != stat(fname, &sbuf)) { - err("failed to stat '%s'\n", fname); - return -1; - } - - c = gnutls_realloc(d->data, sbuf.st_size); - if (NULL == c) { - err("failed to allocate %d bytes for '%s'\n", sbuf.st_size, fname); - return -1; - } - - d->data = c; - d->size = sbuf.st_size; - file = fopen(fname, "r"); - if (NULL == file) { - err("failed to open '%s' for reading\n", fname); - return -1; - } - - x = fread(d->data, d->size, 1, file); - if (x != 1) { - err("tried to read %d bytes, read %d instead from '%s'\n", d->size, x, fname); - fclose(file); - return -1; - } - fclose(file); - return 0; -} - -int write_datum_fd(int fd, const gnutls_datum_t* d) { - if (d->size != write(fd, d->data, d->size)) { - err("failed to write body of datum.\n"); - return -1; - } - return 0; -} - - -int write_datum_fd_with_length(int fd, const gnutls_datum_t* d) { - uint32_t len; - int looks_negative = (d->data[0] & 0x80); - unsigned char zero = 0; - - /* if the first bit is 1, then the datum will appear negative in the - MPI encoding style used by OpenSSH. In that case, we'll increase - the length by one, and dump out one more byte */ - - if (looks_negative) { - len = htonl(d->size + 1); - } else { - len = htonl(d->size); - } - if (write(fd, &len, sizeof(len)) != sizeof(len)) { - err("failed to write size of datum.\n"); - return -2; - } - if (looks_negative) { - if (write(fd, &zero, 1) != 1) { - err("failed to write padding byte for MPI.\n"); - return -2; - } - } - return write_datum_fd(fd, d); -} - -int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num) { - unsigned int i; - int ret; - - for (i = 0; i < num; i++) - if (ret = write_datum_fd_with_length(fd, d[i]), ret != 0) - return ret; - - return 0; -} - - -int datum_from_string(gnutls_datum_t* d, const char* str) { - d->size = strlen(str); - d->data = gnutls_realloc(d->data, d->size); - if (d->data == 0) - return ENOMEM; - memcpy(d->data, str, d->size); - return 0; -} - - -int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]) { - int p[2]; - int ret; - - if (pid == NULL) { - err("bad pointer passed to create_writing_pipe()\n"); - return -1; - } - - if (ret = pipe(p), ret == -1) { - err("failed to create a pipe (error: %d \"%s\")\n", errno, strerror(errno)); - return -1; - } - - *pid = fork(); - if (*pid == -1) { - err("Failed to fork (error: %d \"%s\")\n", errno, strerror(errno)); - return -1; - } - if (*pid == 0) { /* this is the child */ - close(p[1]); /* close unused write end */ - - if (0 != dup2(p[0], 0)) { /* map the reading end into stdin */ - err("Failed to transfer reading file descriptor to stdin (error: %d \"%s\")\n", errno, strerror(errno)); - exit(1); - } - execv(path, argv); - err("exec %s failed (error: %d \"%s\")\n", path, errno, strerror(errno)); - /* close the open file descriptors */ - close(p[0]); - close(0); - - exit(1); - } else { /* this is the parent */ - close(p[0]); /* close unused read end */ - return p[1]; - } -} - -int validate_ssh_host_userid(const char* userid) { - char* oldlocale = setlocale(LC_ALL, "C"); - - /* choke if userid does not match the expected format - ("ssh://fully.qualified.domain.name") */ - if (strncmp("ssh://", userid, strlen("ssh://")) != 0) { - err("The user ID should start with ssh:// for a host key\n"); - goto fail; - } - /* so that isalnum will work properly */ - userid += strlen("ssh://"); - while (0 != (*userid)) { - if (!isalnum(*userid)) { - err("label did not start with a letter or a digit! (%s)\n", userid); - goto fail; - } - userid++; - while (isalnum(*userid) || ('-' == (*userid))) - userid++; - if (('.' == (*userid)) || (0 == (*userid))) { /* clean end of label: - check last char - isalnum */ - if (!isalnum(*(userid - 1))) { - err("label did not end with a letter or a digit!\n"); - goto fail; - } - if ('.' == (*userid)) /* advance to the start of the next label */ - userid++; - } else { - err("invalid character in domain name: %c\n", *userid); - goto fail; - } - } - /* ensure that the last character is valid: */ - if (!isalnum(*(userid - 1))) { - err("hostname did not end with a letter or a digit!\n"); - goto fail; - } - /* FIXME: fqdn's can be unicode now, thanks to RFC 3490 -- how do we - make sure that we've got an OK string? */ - - return 0; - - fail: - setlocale(LC_ALL, oldlocale); - return 1; -} - -/* http://tools.ietf.org/html/rfc4880#section-5.5.2 */ -size_t get_openpgp_mpi_size(gnutls_datum_t* d) { - return 2 + d->size; -} - -int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d) { - uint16_t x; - - x = d->size * 8; - x = htons(x); - - write(fd, &x, sizeof(x)); - write(fd, d->data, d->size); - - return 0; -} diff --git a/gpg2ssh/gnutls-helpers.h b/gpg2ssh/gnutls-helpers.h deleted file mode 100644 index 9ea22a3..0000000 --- a/gpg2ssh/gnutls-helpers.h +++ /dev/null @@ -1,72 +0,0 @@ -/* Author: Daniel Kahn Gillmor */ -/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ -/* License: GPL v3 or later */ - - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -/* Functions to help dealing with GnuTLS for monkeysphere key - translation projects: */ - -/* set everything up, including logging levels. Return 0 on - success */ -int init_gnutls(); - -/* logging and output functions: */ - -void err(const char* fmt, ...); -void logfunc(int level, const char* string); - -/* basic datum manipulations: */ - -void init_datum(gnutls_datum_t* d); -void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src); -int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b); -void free_datum(gnutls_datum_t* d); -int write_datum_fd(int fd, const gnutls_datum_t* d); -int write_datum_fd_with_length(int fd, const gnutls_datum_t* d); -int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num); - -/* set up a datum from a null-terminated string */ -int datum_from_string(gnutls_datum_t* d, const char* str); - -/* keyid manipulations: */ -typedef unsigned char printable_keyid[16]; - -void init_keyid(gnutls_openpgp_keyid_t keyid); -void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid); - -/* functions to get data into datum objects: */ - -/* read the passed-in string, store in a single datum */ -int set_datum_string(gnutls_datum_t* d, const char* s); - -/* read the passed-in file descriptor until EOF, store in a single - datum */ -int set_datum_fd(gnutls_datum_t* d, int fd); - -/* read the file indicated (by name) in the fname parameter. store - its entire contents in a single datum. */ -int set_datum_file(gnutls_datum_t* d, const char* fname); - -/* set up file descriptor pipe for writing (child process pid gets - stored in pid, fd is returned)*/ -int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]); - -/* return 0 if userid matches the monkeysphere spec for ssh host user IDs */ -int validate_ssh_host_userid(const char* userid); - -/* how many bytes will it take to write out this datum in OpenPGP MPI form? */ -size_t get_openpgp_mpi_size(gnutls_datum_t* d); - -/* write the MPI stored in gnutls_datum_t to file descriptor fd: */ -int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d); diff --git a/gpg2ssh/gpg2ssh.c b/gpg2ssh/gpg2ssh.c deleted file mode 100644 index c99f03f..0000000 --- a/gpg2ssh/gpg2ssh.c +++ /dev/null @@ -1,293 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* for waitpid() */ -#include -#include - -/* - Author: Daniel Kahn Gillmor - Date: Tue, 08 Apr 2008 - License: GPL v3 or later - - monkeysphere public key translator: execute this with an GPG - certificate (public key(s) + userid(s)) on stdin. It currently - only works with RSA keys. - - It will spit out a version of the first key capable of being used - for authentication on stdout. The output format should be suitable - for appending a known_hosts file. - - Requirements: I've only built this so far with GnuTLS v2.3.4 -- - version 2.2.0 does not contain the appropriate pieces. - - */ - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_openpgp_crt_t openpgp_crt; - gnutls_openpgp_keyid_t keyid; - printable_keyid p_keyid; - unsigned int keyidx; - unsigned int usage, bits; - gnutls_pk_algorithm_t algo; - - gnutls_datum_t m, e, p, q, g, y; - gnutls_datum_t algolabel; - - char output_data[10240]; - char userid[10240]; - size_t uidsz = sizeof(userid); - - const gnutls_datum_t* all[5]; - int pipefd; - pid_t child_pid; - char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; - const char* algoname; - int mpicount; - int pipestatus; - - init_gnutls(); - - init_datum(&data); - - init_datum(&m); - init_datum(&e); - init_datum(&p); - init_datum(&q); - init_datum(&g); - init_datum(&y); - - init_datum(&algolabel); - - init_keyid(keyid); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - if (ret = gnutls_openpgp_crt_init(&openpgp_crt), ret) { - err("Failed to initialize OpenPGP certificate (error: %d)\n", ret); - return 1; - } - - /* format could be either: GNUTLS_OPENPGP_FMT_RAW, - GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, - otherwise, use BASE64: */ - - /* FIXME: we should be auto-detecting the input format, and - translating it as needed. */ - - if (getenv("MONKEYSPHERE_RAW")) { - err("assuming RAW formatted certificate\n"); - if (ret = gnutls_openpgp_crt_import(openpgp_crt, &data, GNUTLS_OPENPGP_FMT_RAW), ret) { - err("failed to import the OpenPGP certificate in RAW format (error: %d)\n", ret); - return ret; - } - } else { - err("assuming BASE64 formatted certificate\n"); - if (ret = gnutls_openpgp_crt_import (openpgp_crt, &data, GNUTLS_OPENPGP_FMT_BASE64), ret) { - err("failed to import the OpenPGP certificate in BASE64 format (error: %d)\n", ret); - return ret; - } - } - - if (gnutls_openpgp_crt_get_revoked_status(openpgp_crt)) { - err("the primary key was revoked!\n"); - return 1; - } - - /* FIXME: We're currently looking at the primary key or maybe the - first authentication-capable subkey. - - Instead, we should be iterating through the primary key and all - subkeys: for each one with the authentication usage flag set of a - algorithm we can handle, we should output matching UserIDs and - the SSH version of the key. */ - - - if (ret = gnutls_openpgp_crt_get_key_usage(openpgp_crt, &usage), ret) { - err("failed to get the usage flags for the primary key (error: %d)\n", ret); - return ret; - } - if (usage & GNUTLS_KEY_KEY_AGREEMENT && - usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { - err("the primary key can be used for authentication and communication encryption!\n"); - - algo = gnutls_openpgp_crt_get_pk_algorithm(openpgp_crt, &bits); - if (algo < 0) { - err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - - err("OpenPGP RSA certificate, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_pk_rsa_raw(openpgp_crt, &m, &e); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_pk_dsa_raw(openpgp_crt, &p, &q, &g, &y); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - - } else { - err("primary key is not good for authentication and communication encryption. Trying subkeys...\n"); - - if (ret = gnutls_openpgp_crt_get_auth_subkey(openpgp_crt, keyid, 0), ret) { - err("failed to find a subkey capable of authentication and communication encryption (error: %d)\n", ret); - return ret; - } - make_keyid_printable(p_keyid, keyid); - err("found authentication subkey %.16s\n", p_keyid); - - ret = gnutls_openpgp_crt_get_subkey_idx(openpgp_crt, keyid); - if (ret < 0) { - err("could not get the index of subkey %.16s (error: %d)\n", ret); - return ret; - } - keyidx = ret; - - if (gnutls_openpgp_crt_get_subkey_revoked_status(openpgp_crt, keyidx)) { - err("The authentication subkey was revoked!\n"); - return 1; - } - - if (ret = gnutls_openpgp_crt_get_subkey_usage(openpgp_crt, keyidx, &usage), ret) { - err("could not figure out usage of subkey %.16s (error: %d)\n", p_keyid, ret); - return ret; - } - if ((usage & GNUTLS_KEY_KEY_AGREEMENT) == 0 && - usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { - err("could not find a subkey with authentication and communication encryption.\n"); - return 1; - } - - /* switch, based on the algorithm in question, to extract the MPI - components: */ - - algo = gnutls_openpgp_crt_get_subkey_pk_algorithm(openpgp_crt, keyidx, &bits); - if (algo < 0) { - err("failed to get the algorithm of the authentication subkey (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - - err("OpenPGP RSA subkey, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(openpgp_crt, keyidx, &m, &e); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA subkey parameters (error: %d)\n", ret); - return 1; - } - } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA subkey, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(openpgp_crt, keyidx, &p, &q, &g, &y); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA subkey parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP subkey was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - } - - /* make sure userid is NULL-terminated */ - userid[sizeof(userid) - 1] = 0; - uidsz--; - - /* FIXME: we're just choosing the first UserID from the certificate: - instead, we should be selecting every User ID that is adequately - signed and matches the spec, and aggregating them with commas for - known_hosts output */ - - if (ret = gnutls_openpgp_crt_get_name(openpgp_crt, 0, userid, &uidsz), ret) { - err("Failed to fetch the first UserID (error: %d)\n", ret); - return ret; - } - - if (ret = validate_ssh_host_userid(userid), ret) { - err("bad userid: not a valid ssh host.\n"); - return ret; - } - - /* remove ssh:// from the beginning of userid */ - memmove(userid, userid + strlen("ssh://"), 1 + strlen(userid) - strlen("ssh://")); - - - /* now we have algo, and the various MPI data are set. Can we - export them cleanly? */ - - /* for the moment, we'll just dump the info raw, and pipe it - externally through coreutils' /usr/bin/base64 */ - - if (algo == GNUTLS_PK_RSA) { - algoname = "ssh-rsa"; - mpicount = 3; - - all[0] = &algolabel; - all[1] = &e; - all[2] = &m; - } else if (algo == GNUTLS_PK_DSA) { - algoname = "ssh-dss"; - mpicount = 5; - - all[0] = &algolabel; - all[1] = &p; - all[2] = &q; - all[3] = &g; - all[4] = &y; - } else { - err("no idea what this algorithm is: %d\n", algo); - return 1; - } - - if (ret = datum_from_string(&algolabel, algoname), ret) { - err("couldn't label string (error: %d)\n", ret); - return ret; - } - - snprintf(output_data, sizeof(output_data), "%s %s ", userid, algoname); - - pipefd = create_writing_pipe(&child_pid, args[0], args); - if (pipefd < 0) { - err("failed to create a writing pipe (returned %d)\n", pipefd); - return pipefd; - } - - write(1, output_data, strlen(output_data)); - - if (0 != write_data_fd_with_length(pipefd, all, mpicount)) { - err("was not able to write out RSA key data\n"); - return 1; - } - close(pipefd); - if (child_pid != waitpid(child_pid, &pipestatus, 0)) { - err("could not wait for child process to return for some reason.\n"); - return 1; - } - if (pipestatus != 0) { - err("base64 pipe died with return code %d\n", pipestatus); - return pipestatus; - } - - write(1, "\n", 1); - - - - gnutls_openpgp_crt_deinit(openpgp_crt); - gnutls_global_deinit(); - return 0; -} diff --git a/gpg2ssh/main.c b/gpg2ssh/main.c deleted file mode 100644 index d6bac68..0000000 --- a/gpg2ssh/main.c +++ /dev/null @@ -1,271 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* - Author: Daniel Kahn Gillmor - Date: Tue, 01 Apr 2008 - License: GPL v3 or later - - monkeysphere private key translator: execute this with an GPG - secret key on stdin (at the moment, only passphraseless RSA keys - work). - - It will spit out a PEM-encoded version of the key on stdout, which - can be fed into ssh-add like this: - - gpg --export-secret-keys $KEYID | monkeysphere | ssh-add -c /dev/stdin - - Requirements: I've only built this so far with GnuTLS v2.3.4 -- - version 2.2.0 does not contain the appropriate pieces. - - Notes: gpgkey2ssh doesn't seem to provide the same public - keys. Mighty weird! - -0 wt215@squeak:~/monkeysphere$ gpg --export-secret-keys 1DCDF89F | ~dkg/src/monkeysphere/monkeysphere | ssh-add -c /dev/stdin -gnutls version: 2.3.4 -OpenPGP RSA Key, with 1024 bits -Identity added: /dev/stdin (/dev/stdin) -The user has to confirm each use of the key -0 wt215@squeak:~/monkeysphere$ ssh-add -L -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC9gWQqfrnhQKDQnND/3eOexpddE64J+1zp9fcyCje7H5LKclb6DBV2HS6WgW32PJhIzvP+fYZM3dzXea3fpv14y1SicXiRBDgF9SnsNA1qWn2RyzkLcKy7PmM0PDYtU1oiLTcQj/xkWcqW2sLKHT/WW+vZP5XP7RMGN/yWNMfE2Q== /dev/stdin -0 wt215@squeak:~/monkeysphere$ gpgkey2ssh 1DCDF89F -ssh-rsa AAAAB3NzaC1yc2EAAACBAL2BZCp+ueFAoNCc0P/d457Gl10Trgn7XOn19zIKN7sfkspyVvoMFXYdLpaBbfY8mEjO8/59hkzd3Nd5rd+m/XjLVKJxeJEEOAX1Kew0DWpafZHLOQtwrLs+YzQ8Ni1TWiItNxCP/GRZypbawsodP9Zb69k/lc/tEwY3/JY0x8TZAAAAAwEAAQ== COMMENT -0 wt215@squeak:~/monkeysphere$ - - */ - - -int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { - gnutls_openpgp_privkey_t pgp_privkey; - gnutls_datum_t m, e, d, p, q, u, g, y, x; - gnutls_pk_algorithm_t pgp_algo; - unsigned int pgp_bits; - int ret; - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - init_datum(&x); - - if (ret = gnutls_openpgp_privkey_init(&pgp_privkey), ret) { - err("Failed to initialized OpenPGP private key (error: %d)\n", ret); - return 1; - } - - - /* format could be either: GNUTLS_OPENPGP_FMT_RAW, - GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, - otherwise, use BASE64: */ - - if (getenv("MONKEYSPHERE_RAW")) { - err("assuming RAW formatted private keys\n"); - if (ret = gnutls_openpgp_privkey_import(pgp_privkey, input, GNUTLS_OPENPGP_FMT_RAW, NULL, 0), ret) - err("failed to import the OpenPGP private key in RAW format (error: %d)\n", ret); - } else { - err("assuming BASE64 formatted private keys\n"); - if (ret = gnutls_openpgp_privkey_import (pgp_privkey, input, GNUTLS_OPENPGP_FMT_BASE64, NULL, 0), ret) - err("failed to import the OpenPGP private key in BASE64 format (error: %d)\n", ret); - } - - pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(pgp_privkey, &pgp_bits); - if (pgp_algo < 0) { - err("failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); - return 1; - } - if (pgp_algo == GNUTLS_PK_RSA) { - err("OpenPGP RSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_rsa_raw(pgp_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - - ret = gnutls_x509_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (pgp_algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_dsa_raw(pgp_privkey, &p, &q, &g, &y, &x); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - - ret = gnutls_x509_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", pgp_algo); - return 1; - } - - ret = gnutls_x509_privkey_fix(*output); - if (ret != 0) { - err("failed to fix up the private key in X.509 format (error: %d)\n", ret); - return 1; - } - - gnutls_openpgp_privkey_deinit(pgp_privkey); - return 0; -} - -int convert_x509_to_pgp(gnutls_openpgp_privkey_t* output, gnutls_datum_t* input) { - gnutls_x509_privkey_t x509_privkey; - gnutls_datum_t m, e, d, p, q, u, g, y, x; - gnutls_pk_algorithm_t x509_algo; - int ret; - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - init_datum(&x); - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialized X.509 private key (error: %d)\n", ret); - return 1; - } - - - /* format could be either: GNUTLS_X509_FMT_DER, - GNUTLS_X509_FMT_PEM; if MONKEYSPHERE_DER is set, use DER, - otherwise, use PEM: */ - - if (getenv("MONKEYSPHERE_DER")) { - err("assuming DER formatted private keys\n"); - if (ret = gnutls_x509_privkey_import(x509_privkey, input, GNUTLS_X509_FMT_DER), ret) - err("failed to import the X.509 private key in DER format (error: %d)\n", ret); - } else { - err("assuming PEM formatted private keys\n"); - if (ret = gnutls_x509_privkey_import (x509_privkey, input, GNUTLS_X509_FMT_PEM), ret) - err("failed to import the X.509 private key in PEM format (error: %d)\n", ret); - } - - x509_algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); - if (x509_algo < 0) { - err("failed to get X.509 key algorithm (error: %d)\n", x509_algo); - return 1; - } - if (x509_algo == GNUTLS_PK_RSA) { - err("X.509 RSA Key\n"); - ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - - /* ret = gnutls_openpgp_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); */ - ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (x509_algo == GNUTLS_PK_DSA) { - err("X.509 DSA Key\n"); - ret = gnutls_x509_privkey_export_dsa_raw(x509_privkey, &p, &q, &g, &y, &x); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - - /* ret = gnutls_openpgp_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); */ - ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", x509_algo); - return 1; - } - - gnutls_x509_privkey_deinit(x509_privkey); - return 0; -} - - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_x509_privkey_t x509_privkey; - - char output_data[10240]; - size_t ods = sizeof(output_data); - - init_gnutls(); - - init_datum(&data); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - - /* Or, instead, read in key from a file name: - if (ret = set_datum_file(&data, argv[1]), ret) { - err("didn't read file '%s'\n", argv[1]); - return 1; - } -*/ - - /* treat the passed file as an X.509 private key, and extract its - component values: */ - -/* if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { */ -/* err("Failed to import the X.509 key (error: %d)\n", ret); */ -/* return 1; */ -/* } */ -/* gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); */ - - /* try to print the PEM-encoded private key: */ -/* ret = gnutls_x509_privkey_export (x509_privkey, */ -/* GNUTLS_X509_FMT_PEM, */ -/* output_data, */ -/* &ods); */ -/* printf("ret: %u; ods: %u;\n", ret, ods); */ -/* if (ret == 0) { */ -/* write(0, output_data, ods); */ -/* } */ - - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialize X.509 private key (error: %d)\n", ret); - return 1; - } - - if (ret = convert_pgp_to_x509(&x509_privkey, &data), ret) { - return ret; - } - - ret = gnutls_x509_privkey_export (x509_privkey, - GNUTLS_X509_FMT_PEM, - output_data, - &ods); - printf("ret: %u; ods: %u;\n", ret, ods); - if (ret == 0) { - write(1, output_data, ods); - } - - - gnutls_x509_privkey_deinit(x509_privkey); - gnutls_global_deinit(); - return 0; -} diff --git a/gpg2ssh/ssh2gpg.c b/gpg2ssh/ssh2gpg.c deleted file mode 100644 index b14a540..0000000 --- a/gpg2ssh/ssh2gpg.c +++ /dev/null @@ -1,171 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* for waitpid() */ -#include -#include - -/* for time() */ -#include - -/* for htons() */ -#include - - -/* - Author: Daniel Kahn Gillmor - Date: Sun, 2008-04-20 - License: GPL v3 or later - - monkeysphere public key translator: execute this with an ssh - private key on stdin. It currently only works with RSA keys. - - it should eventually work with OpenSSH-style public keys instead of - the full private key, but it was easier to do this way. - - It shoud spit out a version of the public key suitable for acting - as an OpenPGP public sub key packet. - - */ - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_x509_privkey_t x509_privkey; - gnutls_openpgp_crt_t openpgp_crt; - gnutls_openpgp_keyid_t keyid; - printable_keyid p_keyid; - unsigned int keyidx; - unsigned int usage, bits; - gnutls_pk_algorithm_t algo; - - unsigned char packettag; - unsigned char openpgpversion; - time_t timestamp; - uint32_t clunkytime; - unsigned char openpgpalgo; - unsigned int packetlen; - uint16_t plen; - - gnutls_datum_t m, e, d, p, q, u, g, y; - gnutls_datum_t algolabel; - - char output_data[10240]; - char userid[10240]; - size_t uidsz = sizeof(userid); - - const gnutls_datum_t* all[5]; - int pipefd; - pid_t child_pid; - char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; - const char* algoname; - int mpicount; - int pipestatus; - - init_gnutls(); - - init_datum(&data); - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - - init_datum(&algolabel); - - init_keyid(keyid); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialize private key structure (error: %d)\n", ret); - return 1; - } - - err("assuming PEM formatted private key\n"); - if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { - err("failed to import the PEM-encoded private key (error: %d)\n", ret); - return ret; - } - - algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); - if (algo < 0) { - err("failed to get the algorithm of the PEM-encoded public key (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - err("RSA private key\n"); - ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - err("Modulus size %d, exponent size %d\n", m.size, e.size); - } else if (algo == GNUTLS_PK_DSA) { - err("DSA Key, not implemented!!\n", bits); - return 1; - } else { - err("Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - - /* now we have algo, and the various MPI data are set. Can we - export them as a public subkey packet? */ - - /* this packet should be tagged 14, and should contain: - - 1 octet: version (4) - 4 octets: time of generation (seconds since 1970) - 1 octet: algo (http://tools.ietf.org/html/rfc4880#section-5.5.2 implies 1 for RSA) - - MPI: modulus - MPI: exponent - */ - - packetlen = 1 + 4 + 1; - /* FIXME: this is RSA only. for DSA, there'll be more: */ - packetlen += get_openpgp_mpi_size(&m) + get_openpgp_mpi_size(&e); - - /* FIXME: we should generate this bound more cleanly -- i just - happen to know that 65535 is 2^16-1: */ - if (packetlen > 65535) { - err("packet length is too long (%d)\n", packetlen); - return 1; - } - - /* we're going to emit an old-style packet, with tag 14 (public - subkey), with a two-octet packet length */ - packettag = 0x80 | (14 << 2) | 1; - - write(1, &packettag, sizeof(packettag)); - plen = htons(packetlen); - write(1, &plen, sizeof(plen)); - - openpgpversion = 4; - write(1, &openpgpversion, 1); - - timestamp = time(NULL); - clunkytime = htonl(timestamp); - write(1, &clunkytime, 4); - - /* FIXME: handle things other than RSA */ - openpgpalgo = 1; - write(1, &openpgpalgo, 1); - - write_openpgp_mpi_to_fd(1, &m); - write_openpgp_mpi_to_fd(1, &e); - - gnutls_x509_privkey_deinit(x509_privkey); - gnutls_global_deinit(); - return 0; -} diff --git a/howler/howler b/howler/howler deleted file mode 100755 index 0b67c02..0000000 --- a/howler/howler +++ /dev/null @@ -1,134 +0,0 @@ -#!/bin/sh - -# howler: monkeysphere server gpg generator/publisher/maintainer -# -# Written by -# Jameson Rollins -# -# Copyright 2008, released under the GPL, version 3 or later - -PGRM=$(basename $0) - -######################################################################## -# FUNCTIONS -######################################################################## - -usage() { -cat <&2 - exit ${2:-'1'} -} - -# generate server gpg key -gen_key() { - KEY_TYPE=${KEY_TYPE:-RSA} - KEY_LENGTH=${KEY_LENGTH:-2048} - KEY_USAGE=${KEY_USAGE:-encrypt,auth} - SERVICE=${SERVICE:-ssh} - HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} - - USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} - - echo "key parameters:" - cat < /dev/null 2>&1 ; then - failure "key for '$USERID' already exists" - fi - - echo "generating server key..." - gpg --batch --gen-key < /dev/null | grep '^pub:' | cut -d: -f5) - - # dummy command so as not to publish fakes keys during testing - # eventually: - #gpg --send-keys --keyserver "$KEYSERVER" "$keyID" - echo "gpg --send-keys --keyserver $KEYSERVER $keyID" -} - -trust_key() { - for keyID ; do - # get the key from the key server - gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" - - # edit the key to change trust - # FIXME: need to figure out how to automate this, - # in a batch mode or something. - gpg --edit-key "$keyID" - done -} - -######################################################################## -# MAIN -######################################################################## - -# set ms home directory -MS_HOME=${MS_HOME:-/etc/monkeysphere} - -# load configuration file -MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} -[ -e "$MS_CONF" ] && . "$MS_CONF" - -GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} -export GNUPGHOME -KEYSERVER=${KEYSERVER:-subkeys.pgp.net} -export KEYSERVER - -COMMAND="$1" -[ "$COMMAND" ] || failure "Type '$PGRM help' for usage." -shift 1 - -case $COMMAND in - 'gen-key') - gen_key - ;; - 'publish-key') - publish_key - ;; - 'trust-key') - if [ -z "$1" ] ; then - failure "you must specify at least one key to trust." - fi - trust_key "$@" - ;; - 'help') - usage - exit - ;; - *) - failure "Unknown command: '$COMMAND' -Type '$PGRM help' for usage." - ;; -esac diff --git a/langur/README b/langur/README deleted file mode 100644 index ee60701..0000000 --- a/langur/README +++ /dev/null @@ -1,4 +0,0 @@ -Langur is the policy editor/viewer for the monkeysphere. - -Its goals are to provide a human-friendly interface to the simple and -intelligible policies monkeysphere supports. diff --git a/monkeysphere-server.conf b/monkeysphere-server.conf new file mode 100644 index 0000000..bed5c09 --- /dev/null +++ b/monkeysphere-server.conf @@ -0,0 +1,23 @@ +# MonkeySphere server configuration file. + +# GPG home directory for server +#GNUPGHOME=/etc/monkeysphere/gnupg + +# GPG keyserver to search for keys +#KEYSERVER=subkeys.pgp.net + +# Required key capabilities +# Must be quoted, lowercase, space-seperated list of the following: +# e = encrypt +# s = sign +# c = certify +# a = authentication +#REQUIRED_KEY_CAPABILITY="e a" + +# Whether to add user controlled authorized_keys file to +# monkeysphere-generated authorized_keys file. Should be path to file +# where '%h' will be substituted for the user's home directory. +#USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys + +# where to cache user authorized_keys lines +#STAGING_AREA=/var/lib/monkeysphere/stage diff --git a/monkeysphere.conf b/monkeysphere.conf index 6401203..385165a 100644 --- a/monkeysphere.conf +++ b/monkeysphere.conf @@ -1,30 +1,31 @@ -# monkeysphere system configuration file +# MonkeySphere system-wide client configuration file. -# This is particular configuration is meant to be sourced by the -# rhesus shell script when run in administrative mode to maintain -# authorized_keys files for users. +# authorized_user_ids file +#AUTHORIZED_USER_IDS=~/.config/monkeysphere/authorized_user_ids -AUTHORIZED_USER_IDS=/etc/monkeysphere/authorized_user_ids/"$USER" +# GPG home directory +#GNUPGHOME=~/.gnupg -STAGING_AREA=/var/lib/monkeysphere/stage/"$USER" +# GPG keyserver to search for keys +#KEYSERVER=subkeys.pgp.net -# gpg home directory for server -GNUPGHOME=/etc/monkeysphere/gnupg - -# gpg keyserver to search for keys -KEYSERVER=subkeys.pgp.net - -# required capabilities of keys -# must be quoted, lowercase, space-seperated list of the following: +# Required key capabilities +# Must be quoted, lowercase, space-seperated list of the following: # e = encrypt # s = sign # c = certify # a = authentication -REQUIRED_KEY_CAPABILITY="e a" +#REQUIRED_KEY_CAPABILITY="e a" # Path to user-controlled authorized_keys file to add to # Monkeysphere-generated authorized_keys file. If empty, then no -# user-controlled file will be added. To specify the user's home -# directory, use the string "~${USER}" -USER_CONTROLLED_AUTHORIZED_KEYS="~${USER}/.ssh/authorized_keys" +# user-controlled file will be added. +#USER_CONTROLLED_AUTHORIZED_KEYS=~/.ssh/authorized_keys + +# User known_hosts file +#USER_KNOWN_HOSTS=~/.ssh/known_hosts + +# Whether or not to hash the generated known_hosts lines +# (empty mean "no"). +#HASH_KNOWN_HOSTS= diff --git a/rhesus/README b/rhesus/README deleted file mode 100644 index 4d383d5..0000000 --- a/rhesus/README +++ /dev/null @@ -1,30 +0,0 @@ -rhesus is the monkeysphere authorized_keys/known_hosts generator. - -In authorized_keys mode, rhesus takes an auth_user_ids file, which -contains gpg user ids, uses gpg to fetch the keys of the specified -users, does a monkeysphere policy check on each id, and uses gpg2ssh -to generate authorized_keys lines for each verified id. The lines are -then combined with a user's traditional authorized_keys file to create -a new authorized_keys file. - -In known_hosts mode, rhesus takes an auth_host_ids file, which -contains gpg user ids of the form ssh://URL, uses gpg to fetch the -keys of the specified hosts, does a monkeysphere policy check on each -id, and uses gpg2ssh to generate a known_hosts lines for each verified -id. The lines are then combined with a user's traditional known_hosts -file to create a new known_hosts file. - -When run as a normal user, no special configuration is needed. - -When run as an administrator to update system-maintained -authorized_keys files for each user, the following environment -variables should be defined first: - - MS_CONF=/etc/monkeysphere/monkeysphere.conf - USER=foo - -For example, the command might be run like this: - - for USER in $(ls -1 /home) ; do - MS_CONF=/etc/monkeysphere/monkeysphere.conf rhesus --authorized_keys - done diff --git a/rhesus/rhesus b/rhesus/rhesus deleted file mode 100755 index f607f0b..0000000 --- a/rhesus/rhesus +++ /dev/null @@ -1,466 +0,0 @@ -#!/bin/sh - -# rhesus: monkeysphere authorized_keys/known_hosts generating script -# -# Written by -# Jameson Rollins -# -# Copyright 2008, released under the GPL, version 3 or later - -# all caps variables are meant to be user supplied (ie. from config -# file) and are considered global - -PGRM=$(basename $0) - -# date in UTF format if needed -DATE=$(date -u '+%FT%T') - -# unset some environment variables that could screw things up -GREP_OPTIONS= - -######################################################################## -# FUNCTIONS -######################################################################## - -usage() { -cat <&2 - exit ${2:-'1'} -} - -# write output to stdout -log() { - echo -n "ms: " - echo "$@" -} - -# write output to stderr -loge() { - echo -n "ms: " 1>&2 - echo "$@" 1>&2 -} - -# cut out all comments(#) and blank lines from standard input -meat() { - grep -v -e "^[[:space:]]*#" -e '^$' -} - -# cut a specified line from standard input -cutline() { - head --line="$1" | tail -1 -} - -# retrieve all keys with given user id from keyserver -# FIXME: need to figure out how to retrieve all matching keys -# (not just first 5) -gpg_fetch_keys() { - local id - id="$1" - echo 1,2,3,4,5 | \ - gpg --quiet --batch --command-fd 0 --with-colons \ - --keyserver "$KEYSERVER" \ - --search ="$id" >/dev/null 2>&1 -} - -# check that characters are in a string (in an AND fashion). -# used for checking key capability -# check_capability capability a [b...] -check_capability() { - local capability - local capcheck - - capability="$1" - shift 1 - - for capcheck ; do - if echo "$capability" | grep -q -v "$capcheck" ; then - return 1 - fi - done - return 0 -} - -# convert escaped characters from gpg output back into original -# character -# FIXME: undo all escape character translation in with-colons gpg output -unescape() { - echo "$1" | sed 's/\\x3a/:/' -} - -# stand in until we get dkg's gpg2ssh program -gpg2ssh_tmp() { - local mode - local keyID - local userID - local host - - mode="$1" - keyID="$2" - userID="$3" - - if [ "$mode" = 'authorized_keys' ] ; then - gpgkey2ssh "$keyID" | sed -e "s/COMMENT/${userID}/" - - # NOTE: it seems that ssh-keygen -R removes all comment fields from - # all lines in the known_hosts file. why? - # NOTE: just in case, the COMMENT can be matched with the - # following regexp: - # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' - elif [ "$mode" = 'known_hosts' ] ; then - host=$(echo "$userID" | sed -e "s|ssh://||") - echo -n "$host "; gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere${DATE}/" - fi -} - -# userid and key policy checking -# the following checks policy on the returned keys -# - checks that full key has appropriate valididy (u|f) -# - checks key has specified capability (REQUIRED_KEY_CAPABILITY) -# - checks that particular desired user id has appropriate validity -# see /usr/share/doc/gnupg/DETAILS.gz -# expects global variable: "mode" -process_user_id() { - local userID - local cacheDir - local requiredPubCapability - local gpgOut - local line - local type - local validity - local keyid - local uidfpr - local capability - local keyOK - local pubKeyID - local uidOK - local keyIDs - local userIDHash - local keyID - - userID="$1" - cacheDir="$2" - - requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") - - # fetch keys from keyserver, return 1 if none found - gpg_fetch_keys "$userID" || return 1 - - # output gpg info for (exact) userid and store - gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ - ="$userID" 2> /dev/null) - - # return 1 if there only "tru" lines are output from gpg - if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - return 1 - fi - - # loop over all lines in the gpg output and process. - # need to do it this way (as opposed to "while read...") so that - # variables set in loop will be visible outside of loop - for line in $(seq 1 $(echo "$gpgOut" | wc -l)) ; do - - # read the contents of the line - type=$(echo "$gpgOut" | cutline "$line" | cut -d: -f1) - validity=$(echo "$gpgOut" | cutline "$line" | cut -d: -f2) - keyid=$(echo "$gpgOut" | cutline "$line" | cut -d: -f5) - uidfpr=$(echo "$gpgOut" | cutline "$line" | cut -d: -f10) - capability=$(echo "$gpgOut" | cutline "$line" | cut -d: -f12) - - # process based on record type - case $type in - 'pub') # primary keys - # new key, wipe the slate - keyOK= - pubKeyID= - uidOK= - keyIDs= - - pubKeyID="$keyid" - - # check primary key validity - if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then - loge " unacceptable primary key validity ($validity)." - continue - fi - # check capability is not Disabled... - if check_capability "$capability" 'D' ; then - loge " key disabled." - continue - fi - # check overall key capability - # must be Encryption and Authentication - if ! check_capability "$capability" $requiredPubCapability ; then - loge " unacceptable primary key capability ($capability)." - continue - fi - - # mark if primary key is acceptable - keyOK=true - - # add primary key ID to key list if it has required capability - if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then - keyIDs[${#keyIDs[*]}]="$keyid" - fi - ;; - 'uid') # user ids - # check key ok and we have key fingerprint - if [ -z "$keyOK" ] ; then - continue - fi - # check key validity - if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then - continue - fi - # check the uid matches - if [ "$(unescape "$uidfpr")" != "$userID" ] ; then - continue - fi - - # mark if uid acceptable - uidOK=true - ;; - 'sub') # sub keys - # add sub key ID to key list if it has required capability - if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then - keyIDs[${#keyIDs[*]}]="$keyid" - fi - ;; - esac - done - - # hash userid for cache file name - userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') - - # touch/clear key cache file - # (will be left empty if there are noacceptable keys) - > "$cacheDir"/"$userIDHash"."$pubKeyID" - - # for each acceptable key, write an ssh key line to the - # key cache file - if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then - for keyID in ${keyIDs[@]} ; do - # export the key with gpg2ssh - # FIXME: needs to apply extra options for authorized_keys - # lines if specified - gpg2ssh_tmp "$mode" "$keyID" "$userID" >> "$cacheDir"/"$userIDHash"."$pubKeyID" - - # hash the cache file if specified - if [ "$mode" = 'known_hosts' -a "$HASH_KNOWN_HOSTS" ] ; then - ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 - rm "$cacheDir"/"$userIDHash"."$pubKeyID".old - fi - done - fi - - # echo the path to the key cache file - echo "$cacheDir"/"$userIDHash"."$pubKeyID" -} - -# process a host for addition to a known_host file -process_host() { - local host - local cacheDir - local hostKeyCachePath - - host="$1" - cacheDir="$2" - - log "processing host: '$host'" - - hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") - if [ $? = 0 ] ; then - ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS" - cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS" - fi -} - -# process known_hosts file -# go through line-by-line, extract each host, and process with the -# host processing function -process_known_hosts() { - local cacheDir - local userID - - cacheDir="$1" - - # take all the hosts from the known_hosts file (first field), - # grep out all the hashed hosts (lines starting with '|') - cut -d ' ' -f 1 "$USER_KNOWN_HOSTS" | \ - grep -v '^|.*$' | \ - while IFS=, read -r -a hosts ; do - # process each host - for host in ${hosts[*]} ; do - process_host "$host" "$cacheDir" - done - done -} - -# process an authorized_*_ids file -# go through line-by-line, extract each userid, and process -process_authorized_ids() { - local authorizedIDsFile - local cacheDir - local userID - local userKeyCachePath - - authorizedIDsFile="$1" - cacheDir="$2" - - # clean out keys file and remake keys directory - rm -rf "$cacheDir" - mkdir -p "$cacheDir" - - # loop through all user ids in file - # FIXME: needs to handle extra options if necessary - cat "$authorizedIDsFile" | meat | \ - while read -r userID ; do - # process the userid - log "processing userid: '$userID'" - userKeyCachePath=$(process_user_id "$userID" "$cacheDir") - if [ -s "$userKeyCachePath" ] ; then - loge " acceptable key/uid found." - fi - done -} - -######################################################################## -# MAIN -######################################################################## - -if [ -z "$1" ] ; then - usage - exit 1 -fi - -# mode given in first variable -mode="$1" -shift 1 - -# check user -if ! id -u "$USER" > /dev/null 2>&1 ; then - failure "invalid user '$USER'." -fi - -# set user home directory -HOME=$(getent passwd "$USER" | cut -d: -f6) - -# set ms home directory -MS_HOME=${MS_HOME:-"$HOME"/.config/monkeysphere} - -# load configuration file -MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} -[ -e "$MS_CONF" ] && . "$MS_CONF" - -# set config variable defaults -STAGING_AREA=${STAGING_AREA:-"$MS_HOME"} -AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids} -GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg} -KEYSERVER=${KEYSERVER:-subkeys.pgp.net} -REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} -USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"$HOME"/.ssh/authorized_keys} -USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts} -HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-} - -# export USER and GNUPGHOME variables, since they are used by gpg -export USER -export GNUPGHOME - -# stagging locations -hostKeysCacheDir="$STAGING_AREA"/host_keys -userKeysCacheDir="$STAGING_AREA"/user_keys -msKnownHosts="$STAGING_AREA"/known_hosts -msAuthorizedKeys="$STAGING_AREA"/authorized_keys - -# make sure gpg home exists with proper permissions -mkdir -p -m 0700 "$GNUPGHOME" - -## KNOWN_HOST MODE -if [ "$mode" = 'known_hosts' -o "$mode" = 'k' ] ; then - mode='known_hosts' - - cacheDir="$hostKeysCacheDir" - - log "user '$USER': monkeysphere known_hosts processing" - - # touch the known_hosts file to make sure it exists - touch "$USER_KNOWN_HOSTS" - - # if hosts are specified on the command line, process just - # those hosts - if [ "$1" ] ; then - for host ; do - process_host "$host" "$cacheDir" - done - - # otherwise, if no hosts are specified, process the user - # known_hosts file - else - if [ ! -s "$USER_KNOWN_HOSTS" ] ; then - failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." - fi - process_known_hosts "$cacheDir" - fi - -## AUTHORIZED_KEYS MODE -elif [ "$mode" = 'authorized_keys' -o "$mode" = 'a' ] ; then - mode='authorized_keys' - - cacheDir="$userKeysCacheDir" - - # check auth ids file - if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - log "authorized_user_ids file is empty or does not exist." - exit - fi - - log "user '$USER': monkeysphere authorized_keys processing" - - # if userids are specified on the command line, process just - # those userids - if [ "$1" ] ; then - for userID ; do - if ! grep -q "$userID" "$AUTHORIZED_USER_IDS" ; then - log "userid '$userID' not in authorized_user_ids file." - continue - fi - log "processing user id: '$userID'" - process_user_id "$userID" "$cacheDir" > /dev/null - done - - # otherwise, if no userids are specified, process the entire - # authorized_user_ids file - else - process_authorized_ids "$AUTHORIZED_USER_IDS" "$cacheDir" - fi - - # write output key file - log "writing monkeysphere authorized_keys file... " - touch "$msAuthorizedKeys" - if [ "$(ls "$cacheDir")" ] ; then - log -n "adding gpg keys... " - cat "$cacheDir"/* > "$msAuthorizedKeys" - echo "done." - else - log "no gpg keys to add." - fi - if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then - if [ -s "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then - log -n "adding user authorized_keys file... " - cat "$USER_CONTROLLED_AUTHORIZED_KEYS" >> "$msAuthorizedKeys" - echo "done." - fi - fi - log "monkeysphere authorized_keys file generated:" - log "$msAuthorizedKeys" - -else - failure "unknown command '$mode'." -fi diff --git a/src/common b/src/common new file mode 100755 index 0000000..8643080 --- /dev/null +++ b/src/common @@ -0,0 +1,353 @@ +# -*-shell-script-*- + +# Shared bash functions for the monkeysphere +# +# Written by +# Jameson Rollins +# +# Copyright 2008, released under the GPL, version 3 or later + +# all caps variables are meant to be user supplied (ie. from config +# file) and are considered global + +######################################################################## +# managed directories +ETC="/etc/monkeysphere" +export ETC +LIB="/var/lib/monkeysphere" +export LIB +######################################################################## + +failure() { + echo "$1" >&2 + exit ${2:-'1'} +} + +# write output to stdout +log() { + echo -n "ms: " + echo "$@" +} + +# write output to stderr +loge() { + echo -n "ms: " 1>&2 + echo "$@" 1>&2 +} + +# cut out all comments(#) and blank lines from standard input +meat() { + grep -v -e "^[[:space:]]*#" -e '^$' +} + +# cut a specified line from standard input +cutline() { + head --line="$1" | tail -1 +} + +# retrieve all keys with given user id from keyserver +# FIXME: need to figure out how to retrieve all matching keys +# (not just first 5) +gpg_fetch_keys() { + local id + id="$1" + echo 1,2,3,4,5 | \ + gpg --quiet --batch --command-fd 0 --with-colons \ + --keyserver "$KEYSERVER" \ + --search ="$id" >/dev/null 2>&1 +} + +# check that characters are in a string (in an AND fashion). +# used for checking key capability +# check_capability capability a [b...] +check_capability() { + local capability + local capcheck + + capability="$1" + shift 1 + + for capcheck ; do + if echo "$capability" | grep -q -v "$capcheck" ; then + return 1 + fi + done + return 0 +} + +# convert escaped characters from gpg output back into original +# character +# FIXME: undo all escape character translation in with-colons gpg output +unescape() { + echo "$1" | sed 's/\\x3a/:/' +} + +# stand in until we get dkg's gpg2ssh program +gpg2ssh_tmp() { + local keyID + local userID + local host + + keyID="$2" + userID="$3" + + if [ "$mode" = 'authorized_keys' ] ; then + gpgkey2ssh "$keyID" | sed -e "s/COMMENT/${userID}/" + + # NOTE: it seems that ssh-keygen -R removes all comment fields from + # all lines in the known_hosts file. why? + # NOTE: just in case, the COMMENT can be matched with the + # following regexp: + # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' + elif [ "$MODE" = 'known_hosts' ] ; then + host=$(echo "$userID" | sed -e "s|ssh://||") + echo -n "$host "; gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere${DATE}/" + fi +} + +# userid and key policy checking +# the following checks policy on the returned keys +# - checks that full key has appropriate valididy (u|f) +# - checks key has specified capability (REQUIRED_KEY_CAPABILITY) +# - checks that particular desired user id has appropriate validity +# see /usr/share/doc/gnupg/DETAILS.gz +# expects global variable: "MODE" +process_user_id() { + local userID + local cacheDir + local requiredPubCapability + local gpgOut + local line + local type + local validity + local keyid + local uidfpr + local capability + local keyOK + local pubKeyID + local uidOK + local keyIDs + local userIDHash + local keyID + + userID="$1" + cacheDir="$2" + + requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") + + # fetch keys from keyserver, return 1 if none found + gpg_fetch_keys "$userID" || return 1 + + # output gpg info for (exact) userid and store + gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ + ="$userID" 2> /dev/null) + + # return 1 if there only "tru" lines are output from gpg + if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then + loge " key not found." + return 1 + fi + + # loop over all lines in the gpg output and process. + # need to do it this way (as opposed to "while read...") so that + # variables set in loop will be visible outside of loop + for line in $(seq 1 $(echo "$gpgOut" | wc -l)) ; do + + # read the contents of the line + type=$(echo "$gpgOut" | cutline "$line" | cut -d: -f1) + validity=$(echo "$gpgOut" | cutline "$line" | cut -d: -f2) + keyid=$(echo "$gpgOut" | cutline "$line" | cut -d: -f5) + uidfpr=$(echo "$gpgOut" | cutline "$line" | cut -d: -f10) + capability=$(echo "$gpgOut" | cutline "$line" | cut -d: -f12) + + # process based on record type + case $type in + 'pub') # primary keys + # new key, wipe the slate + keyOK= + pubKeyID= + uidOK= + keyIDs= + + pubKeyID="$keyid" + + # check primary key validity + if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + loge " unacceptable primary key validity ($validity)." + continue + fi + # check capability is not Disabled... + if check_capability "$capability" 'D' ; then + loge " key disabled." + continue + fi + # check overall key capability + # must be Encryption and Authentication + if ! check_capability "$capability" $requiredPubCapability ; then + loge " unacceptable primary key capability ($capability)." + continue + fi + + # mark if primary key is acceptable + keyOK=true + + # add primary key ID to key list if it has required capability + if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + keyIDs[${#keyIDs[*]}]="$keyid" + fi + ;; + 'uid') # user ids + # check key ok and we have key fingerprint + if [ -z "$keyOK" ] ; then + continue + fi + # check key validity + if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + continue + fi + # check the uid matches + if [ "$(unescape "$uidfpr")" != "$userID" ] ; then + continue + fi + + # mark if uid acceptable + uidOK=true + ;; + 'sub') # sub keys + # add sub key ID to key list if it has required capability + if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + keyIDs[${#keyIDs[*]}]="$keyid" + fi + ;; + esac + done + + # hash userid for cache file name + userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') + + # touch/clear key cache file + # (will be left empty if there are noacceptable keys) + > "$cacheDir"/"$userIDHash"."$pubKeyID" + + # for each acceptable key, write an ssh key line to the + # key cache file + if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then + for keyID in ${keyIDs[@]} ; do + loge " acceptable key/uid found." + + # export the key with gpg2ssh + # FIXME: needs to apply extra options for authorized_keys + # lines if specified + gpg2ssh_tmp "$keyID" "$userID" >> "$cacheDir"/"$userIDHash"."$pubKeyID" + + # hash the cache file if specified + if [ "$MODE" = 'known_hosts' -a "$HASH_KNOWN_HOSTS" ] ; then + ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 + rm "$cacheDir"/"$userIDHash"."$pubKeyID".old + fi + done + fi + + # echo the path to the key cache file + echo "$cacheDir"/"$userIDHash"."$pubKeyID" +} + +# process a host for addition to a known_host file +process_host() { + local host + local cacheDir + local hostKeyCachePath + + host="$1" + cacheDir="$2" + + log "processing host: '$host'" + + hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") + if [ $? = 0 ] ; then + ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS" + cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS" + fi +} + +# process known_hosts file +# go through line-by-line, extract each host, and process with the +# host processing function +process_known_hosts() { + local knownHosts + local cacheDir + local hosts + local host + + knownHosts="$1" + cacheDir="$2" + + # take all the hosts from the known_hosts file (first field), + # grep out all the hashed hosts (lines starting with '|') + cut -d ' ' -f 1 "$knownHosts" | \ + grep -v '^|.*$' | \ + while IFS=, read -r -a hosts ; do + # process each host + for host in ${hosts[*]} ; do + process_host "$host" "$cacheDir" + done + done +} + +# process authorized_keys file +# go through line-by-line, extract monkeysphere userids from comment +# fields, and process each userid +process_authorized_keys() { + local authorizedKeys + local cacheDir + local userID + + authorizedKeys="$1" + cacheDir="$2" + + # take all the monkeysphere userids from the authorized_keys file + # comment field (third field) that starts with "MonkeySphere uid:" + # FIXME: needs to handle authorized_keys options (field 0) + cat "$authorizedKeys" | \ + while read -r options keytype key comment ; do + # if the comment field is empty, assume the third field was + # the comment + if [ -z "$comment" ] ; then + comment="$key" + fi + if ! echo "$comment" | grep '^MonkeySphere userID:.*$' ; then + continue + fi + userID=$(echo "$comment" | sed -e "/^MonkeySphere userID://") + if [ -z "$userID" ] ; then + continue + fi + # process the userid + log "processing userid: '$userID'" + process_user_id "$userID" "$cacheDir" > /dev/null + done +} + +# process an authorized_*_ids file +# go through line-by-line, extract each userid, and process +process_authorized_ids() { + local authorizedIDs + local cacheDir + local userID + + authorizedIDs="$1" + cacheDir="$2" + + # clean out keys file and remake keys directory + rm -rf "$cacheDir" + mkdir -p "$cacheDir" + + # loop through all user ids in file + # FIXME: needs to handle authorized_keys options + cat "$authorizedIDs" | meat | \ + while read -r userID ; do + # process the userid + log "processing userid: '$userID'" + process_user_id "$userID" "$cacheDir" > /dev/null + done +} diff --git a/src/gpg2ssh/Makefile b/src/gpg2ssh/Makefile new file mode 100644 index 0000000..a0b7241 --- /dev/null +++ b/src/gpg2ssh/Makefile @@ -0,0 +1,18 @@ +all: monkeysphere gpg2ssh + +monkeysphere: main.c gnutls-helpers.o + gcc -g -Wall --pedantic -o monkeysphere main.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + +gpg2ssh: gpg2ssh.c gnutls-helpers.o + gcc -g -Wall --pedantic -o gpg2ssh gpg2ssh.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + +ssh2gpg: ssh2gpg.c gnutls-helpers.o + gcc -g -Wall --pedantic -o ssh2gpg ssh2gpg.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + +%.o: %.c + gcc -g -Wall --pedantic -o $@ -c $< + +clean: + rm -f monkeysphere gpg2ssh *.o + +.PHONY: clean all diff --git a/src/gpg2ssh/gnutls-helpers.c b/src/gpg2ssh/gnutls-helpers.c new file mode 100644 index 0000000..6eae29e --- /dev/null +++ b/src/gpg2ssh/gnutls-helpers.c @@ -0,0 +1,364 @@ +/* Author: Daniel Kahn Gillmor */ +/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ +/* License: GPL v3 or later */ + +#include "gnutls-helpers.h" +/* for htonl() */ +#include + +/* for setlocale() */ +#include + +/* for isalnum() */ +#include + +int loglevel = 0; + + +void err(const char* fmt, ...) { + va_list ap; + va_start(ap, fmt); + vfprintf(stderr, fmt, ap); + va_end(ap); + fflush(stderr); +} + +void logfunc(int level, const char* string) { + fprintf(stderr, "GnuTLS Logging (%d): %s\n", level, string); +} + +void init_keyid(gnutls_openpgp_keyid_t keyid) { + memset(keyid, 'x', sizeof(gnutls_openpgp_keyid_t)); +} + + + +void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid) +{ + static const char hex[16] = "0123456789ABCDEF"; + unsigned int kix = 0, outix = 0; + + while (kix < sizeof(gnutls_openpgp_keyid_t)) { + out[outix] = hex[(keyid[kix] >> 4) & 0x0f]; + out[outix + 1] = hex[keyid[kix] & 0x0f]; + kix++; + outix += 2; + } +} + + +int init_gnutls() { + const char* version = NULL; + const char* debug_string = NULL; + int ret; + + if (ret = gnutls_global_init(), ret) { + err("Failed to do gnutls_global_init() (error: %d)\n", ret); + return 1; + } + + version = gnutls_check_version(NULL); + + if (version) + err("gnutls version: %s\n", version); + else { + err("no version found!\n"); + return 1; + } + + if (debug_string = getenv("MONKEYSPHERE_DEBUG"), debug_string) { + loglevel = atoi(debug_string); + gnutls_global_set_log_function(logfunc); + + gnutls_global_set_log_level(loglevel); + err("set log level to %d\n", loglevel); + } + return 0; +} + +void init_datum(gnutls_datum_t* d) { + d->data = NULL; + d->size = 0; +} +void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src) { + dest->data = gnutls_realloc(dest->data, src->size); + dest->size = src->size; + memcpy(dest->data, src->data, src->size); +} +int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b) { + if (a->size > b->size) { + err("a is larger\n"); + return 1; + } + if (a->size < b->size) { + err("b is larger\n"); + return -1; + } + return memcmp(a->data, b->data, a->size); +} +void free_datum(gnutls_datum_t* d) { + gnutls_free(d->data); + d->data = NULL; + d->size = 0; +} + +/* read the passed-in string, store in a single datum */ +int set_datum_string(gnutls_datum_t* d, const char* s) { + unsigned int x = strlen(s)+1; + unsigned char* c = NULL; + + c = gnutls_realloc(d->data, x); + if (NULL == c) + return -1; + d->data = c; + d->size = x; + memcpy(d->data, s, x); + return 0; +} + +/* read the passed-in file descriptor until EOF, store in a single + datum */ +int set_datum_fd(gnutls_datum_t* d, int fd) { + unsigned int bufsize = 1024; + unsigned int len = 0; + + FILE* f = fdopen(fd, "r"); + if (bufsize > d->size) { + bufsize = 1024; + d->data = gnutls_realloc(d->data, bufsize); + if (d->data == NULL) { + err("out of memory!\n"); + return -1; + } + d->size = bufsize; + } else { + bufsize = d->size; + } + f = fdopen(fd, "r"); + if (NULL == f) { + err("could not fdopen FD %d\n", fd); + } + clearerr(f); + while (!feof(f) && !ferror(f)) { + if (len == bufsize) { + /* allocate more space by doubling: */ + bufsize *= 2; + d->data = gnutls_realloc(d->data, bufsize); + if (d->data == NULL) { + err("out of memory!\n"); + return -1; + }; + d->size = bufsize; + } + len += fread(d->data + len, 1, bufsize - len, f); + /* err("read %d bytes\n", len); */ + } + if (ferror(f)) { + err("Error reading from fd %d (error: %d) (error: %d '%s')\n", fd, ferror(f), errno, strerror(errno)); + return -1; + } + + /* touch up buffer size to match reality: */ + d->data = gnutls_realloc(d->data, len); + d->size = len; + return 0; +} + +/* read the file indicated (by name) in the fname parameter. store + its entire contents in a single datum. */ +int set_datum_file(gnutls_datum_t* d, const char* fname) { + struct stat sbuf; + unsigned char* c = NULL; + FILE* file = NULL; + size_t x = 0; + + if (0 != stat(fname, &sbuf)) { + err("failed to stat '%s'\n", fname); + return -1; + } + + c = gnutls_realloc(d->data, sbuf.st_size); + if (NULL == c) { + err("failed to allocate %d bytes for '%s'\n", sbuf.st_size, fname); + return -1; + } + + d->data = c; + d->size = sbuf.st_size; + file = fopen(fname, "r"); + if (NULL == file) { + err("failed to open '%s' for reading\n", fname); + return -1; + } + + x = fread(d->data, d->size, 1, file); + if (x != 1) { + err("tried to read %d bytes, read %d instead from '%s'\n", d->size, x, fname); + fclose(file); + return -1; + } + fclose(file); + return 0; +} + +int write_datum_fd(int fd, const gnutls_datum_t* d) { + if (d->size != write(fd, d->data, d->size)) { + err("failed to write body of datum.\n"); + return -1; + } + return 0; +} + + +int write_datum_fd_with_length(int fd, const gnutls_datum_t* d) { + uint32_t len; + int looks_negative = (d->data[0] & 0x80); + unsigned char zero = 0; + + /* if the first bit is 1, then the datum will appear negative in the + MPI encoding style used by OpenSSH. In that case, we'll increase + the length by one, and dump out one more byte */ + + if (looks_negative) { + len = htonl(d->size + 1); + } else { + len = htonl(d->size); + } + if (write(fd, &len, sizeof(len)) != sizeof(len)) { + err("failed to write size of datum.\n"); + return -2; + } + if (looks_negative) { + if (write(fd, &zero, 1) != 1) { + err("failed to write padding byte for MPI.\n"); + return -2; + } + } + return write_datum_fd(fd, d); +} + +int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num) { + unsigned int i; + int ret; + + for (i = 0; i < num; i++) + if (ret = write_datum_fd_with_length(fd, d[i]), ret != 0) + return ret; + + return 0; +} + + +int datum_from_string(gnutls_datum_t* d, const char* str) { + d->size = strlen(str); + d->data = gnutls_realloc(d->data, d->size); + if (d->data == 0) + return ENOMEM; + memcpy(d->data, str, d->size); + return 0; +} + + +int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]) { + int p[2]; + int ret; + + if (pid == NULL) { + err("bad pointer passed to create_writing_pipe()\n"); + return -1; + } + + if (ret = pipe(p), ret == -1) { + err("failed to create a pipe (error: %d \"%s\")\n", errno, strerror(errno)); + return -1; + } + + *pid = fork(); + if (*pid == -1) { + err("Failed to fork (error: %d \"%s\")\n", errno, strerror(errno)); + return -1; + } + if (*pid == 0) { /* this is the child */ + close(p[1]); /* close unused write end */ + + if (0 != dup2(p[0], 0)) { /* map the reading end into stdin */ + err("Failed to transfer reading file descriptor to stdin (error: %d \"%s\")\n", errno, strerror(errno)); + exit(1); + } + execv(path, argv); + err("exec %s failed (error: %d \"%s\")\n", path, errno, strerror(errno)); + /* close the open file descriptors */ + close(p[0]); + close(0); + + exit(1); + } else { /* this is the parent */ + close(p[0]); /* close unused read end */ + return p[1]; + } +} + +int validate_ssh_host_userid(const char* userid) { + char* oldlocale = setlocale(LC_ALL, "C"); + + /* choke if userid does not match the expected format + ("ssh://fully.qualified.domain.name") */ + if (strncmp("ssh://", userid, strlen("ssh://")) != 0) { + err("The user ID should start with ssh:// for a host key\n"); + goto fail; + } + /* so that isalnum will work properly */ + userid += strlen("ssh://"); + while (0 != (*userid)) { + if (!isalnum(*userid)) { + err("label did not start with a letter or a digit! (%s)\n", userid); + goto fail; + } + userid++; + while (isalnum(*userid) || ('-' == (*userid))) + userid++; + if (('.' == (*userid)) || (0 == (*userid))) { /* clean end of label: + check last char + isalnum */ + if (!isalnum(*(userid - 1))) { + err("label did not end with a letter or a digit!\n"); + goto fail; + } + if ('.' == (*userid)) /* advance to the start of the next label */ + userid++; + } else { + err("invalid character in domain name: %c\n", *userid); + goto fail; + } + } + /* ensure that the last character is valid: */ + if (!isalnum(*(userid - 1))) { + err("hostname did not end with a letter or a digit!\n"); + goto fail; + } + /* FIXME: fqdn's can be unicode now, thanks to RFC 3490 -- how do we + make sure that we've got an OK string? */ + + return 0; + + fail: + setlocale(LC_ALL, oldlocale); + return 1; +} + +/* http://tools.ietf.org/html/rfc4880#section-5.5.2 */ +size_t get_openpgp_mpi_size(gnutls_datum_t* d) { + return 2 + d->size; +} + +int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d) { + uint16_t x; + + x = d->size * 8; + x = htons(x); + + write(fd, &x, sizeof(x)); + write(fd, d->data, d->size); + + return 0; +} diff --git a/src/gpg2ssh/gnutls-helpers.h b/src/gpg2ssh/gnutls-helpers.h new file mode 100644 index 0000000..9ea22a3 --- /dev/null +++ b/src/gpg2ssh/gnutls-helpers.h @@ -0,0 +1,72 @@ +/* Author: Daniel Kahn Gillmor */ +/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ +/* License: GPL v3 or later */ + + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* Functions to help dealing with GnuTLS for monkeysphere key + translation projects: */ + +/* set everything up, including logging levels. Return 0 on + success */ +int init_gnutls(); + +/* logging and output functions: */ + +void err(const char* fmt, ...); +void logfunc(int level, const char* string); + +/* basic datum manipulations: */ + +void init_datum(gnutls_datum_t* d); +void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src); +int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b); +void free_datum(gnutls_datum_t* d); +int write_datum_fd(int fd, const gnutls_datum_t* d); +int write_datum_fd_with_length(int fd, const gnutls_datum_t* d); +int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num); + +/* set up a datum from a null-terminated string */ +int datum_from_string(gnutls_datum_t* d, const char* str); + +/* keyid manipulations: */ +typedef unsigned char printable_keyid[16]; + +void init_keyid(gnutls_openpgp_keyid_t keyid); +void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid); + +/* functions to get data into datum objects: */ + +/* read the passed-in string, store in a single datum */ +int set_datum_string(gnutls_datum_t* d, const char* s); + +/* read the passed-in file descriptor until EOF, store in a single + datum */ +int set_datum_fd(gnutls_datum_t* d, int fd); + +/* read the file indicated (by name) in the fname parameter. store + its entire contents in a single datum. */ +int set_datum_file(gnutls_datum_t* d, const char* fname); + +/* set up file descriptor pipe for writing (child process pid gets + stored in pid, fd is returned)*/ +int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]); + +/* return 0 if userid matches the monkeysphere spec for ssh host user IDs */ +int validate_ssh_host_userid(const char* userid); + +/* how many bytes will it take to write out this datum in OpenPGP MPI form? */ +size_t get_openpgp_mpi_size(gnutls_datum_t* d); + +/* write the MPI stored in gnutls_datum_t to file descriptor fd: */ +int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d); diff --git a/src/gpg2ssh/gpg2ssh.c b/src/gpg2ssh/gpg2ssh.c new file mode 100644 index 0000000..c99f03f --- /dev/null +++ b/src/gpg2ssh/gpg2ssh.c @@ -0,0 +1,293 @@ +#include "gnutls-helpers.h" + +#include +#include + +/* for waitpid() */ +#include +#include + +/* + Author: Daniel Kahn Gillmor + Date: Tue, 08 Apr 2008 + License: GPL v3 or later + + monkeysphere public key translator: execute this with an GPG + certificate (public key(s) + userid(s)) on stdin. It currently + only works with RSA keys. + + It will spit out a version of the first key capable of being used + for authentication on stdout. The output format should be suitable + for appending a known_hosts file. + + Requirements: I've only built this so far with GnuTLS v2.3.4 -- + version 2.2.0 does not contain the appropriate pieces. + + */ + +int main(int argc, char* argv[]) { + gnutls_datum_t data; + int ret; + gnutls_openpgp_crt_t openpgp_crt; + gnutls_openpgp_keyid_t keyid; + printable_keyid p_keyid; + unsigned int keyidx; + unsigned int usage, bits; + gnutls_pk_algorithm_t algo; + + gnutls_datum_t m, e, p, q, g, y; + gnutls_datum_t algolabel; + + char output_data[10240]; + char userid[10240]; + size_t uidsz = sizeof(userid); + + const gnutls_datum_t* all[5]; + int pipefd; + pid_t child_pid; + char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; + const char* algoname; + int mpicount; + int pipestatus; + + init_gnutls(); + + init_datum(&data); + + init_datum(&m); + init_datum(&e); + init_datum(&p); + init_datum(&q); + init_datum(&g); + init_datum(&y); + + init_datum(&algolabel); + + init_keyid(keyid); + + /* slurp in the private key from stdin */ + if (ret = set_datum_fd(&data, 0), ret) { + err("didn't read file descriptor 0\n"); + return 1; + } + + + if (ret = gnutls_openpgp_crt_init(&openpgp_crt), ret) { + err("Failed to initialize OpenPGP certificate (error: %d)\n", ret); + return 1; + } + + /* format could be either: GNUTLS_OPENPGP_FMT_RAW, + GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, + otherwise, use BASE64: */ + + /* FIXME: we should be auto-detecting the input format, and + translating it as needed. */ + + if (getenv("MONKEYSPHERE_RAW")) { + err("assuming RAW formatted certificate\n"); + if (ret = gnutls_openpgp_crt_import(openpgp_crt, &data, GNUTLS_OPENPGP_FMT_RAW), ret) { + err("failed to import the OpenPGP certificate in RAW format (error: %d)\n", ret); + return ret; + } + } else { + err("assuming BASE64 formatted certificate\n"); + if (ret = gnutls_openpgp_crt_import (openpgp_crt, &data, GNUTLS_OPENPGP_FMT_BASE64), ret) { + err("failed to import the OpenPGP certificate in BASE64 format (error: %d)\n", ret); + return ret; + } + } + + if (gnutls_openpgp_crt_get_revoked_status(openpgp_crt)) { + err("the primary key was revoked!\n"); + return 1; + } + + /* FIXME: We're currently looking at the primary key or maybe the + first authentication-capable subkey. + + Instead, we should be iterating through the primary key and all + subkeys: for each one with the authentication usage flag set of a + algorithm we can handle, we should output matching UserIDs and + the SSH version of the key. */ + + + if (ret = gnutls_openpgp_crt_get_key_usage(openpgp_crt, &usage), ret) { + err("failed to get the usage flags for the primary key (error: %d)\n", ret); + return ret; + } + if (usage & GNUTLS_KEY_KEY_AGREEMENT && + usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { + err("the primary key can be used for authentication and communication encryption!\n"); + + algo = gnutls_openpgp_crt_get_pk_algorithm(openpgp_crt, &bits); + if (algo < 0) { + err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + + err("OpenPGP RSA certificate, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_pk_rsa_raw(openpgp_crt, &m, &e); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA Key, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_pk_dsa_raw(openpgp_crt, &p, &q, &g, &y); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); + return 1; + } + + } else { + err("primary key is not good for authentication and communication encryption. Trying subkeys...\n"); + + if (ret = gnutls_openpgp_crt_get_auth_subkey(openpgp_crt, keyid, 0), ret) { + err("failed to find a subkey capable of authentication and communication encryption (error: %d)\n", ret); + return ret; + } + make_keyid_printable(p_keyid, keyid); + err("found authentication subkey %.16s\n", p_keyid); + + ret = gnutls_openpgp_crt_get_subkey_idx(openpgp_crt, keyid); + if (ret < 0) { + err("could not get the index of subkey %.16s (error: %d)\n", ret); + return ret; + } + keyidx = ret; + + if (gnutls_openpgp_crt_get_subkey_revoked_status(openpgp_crt, keyidx)) { + err("The authentication subkey was revoked!\n"); + return 1; + } + + if (ret = gnutls_openpgp_crt_get_subkey_usage(openpgp_crt, keyidx, &usage), ret) { + err("could not figure out usage of subkey %.16s (error: %d)\n", p_keyid, ret); + return ret; + } + if ((usage & GNUTLS_KEY_KEY_AGREEMENT) == 0 && + usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { + err("could not find a subkey with authentication and communication encryption.\n"); + return 1; + } + + /* switch, based on the algorithm in question, to extract the MPI + components: */ + + algo = gnutls_openpgp_crt_get_subkey_pk_algorithm(openpgp_crt, keyidx, &bits); + if (algo < 0) { + err("failed to get the algorithm of the authentication subkey (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + + err("OpenPGP RSA subkey, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(openpgp_crt, keyidx, &m, &e); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA subkey parameters (error: %d)\n", ret); + return 1; + } + } else if (algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA subkey, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(openpgp_crt, keyidx, &p, &q, &g, &y); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA subkey parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP subkey was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); + return 1; + } + } + + /* make sure userid is NULL-terminated */ + userid[sizeof(userid) - 1] = 0; + uidsz--; + + /* FIXME: we're just choosing the first UserID from the certificate: + instead, we should be selecting every User ID that is adequately + signed and matches the spec, and aggregating them with commas for + known_hosts output */ + + if (ret = gnutls_openpgp_crt_get_name(openpgp_crt, 0, userid, &uidsz), ret) { + err("Failed to fetch the first UserID (error: %d)\n", ret); + return ret; + } + + if (ret = validate_ssh_host_userid(userid), ret) { + err("bad userid: not a valid ssh host.\n"); + return ret; + } + + /* remove ssh:// from the beginning of userid */ + memmove(userid, userid + strlen("ssh://"), 1 + strlen(userid) - strlen("ssh://")); + + + /* now we have algo, and the various MPI data are set. Can we + export them cleanly? */ + + /* for the moment, we'll just dump the info raw, and pipe it + externally through coreutils' /usr/bin/base64 */ + + if (algo == GNUTLS_PK_RSA) { + algoname = "ssh-rsa"; + mpicount = 3; + + all[0] = &algolabel; + all[1] = &e; + all[2] = &m; + } else if (algo == GNUTLS_PK_DSA) { + algoname = "ssh-dss"; + mpicount = 5; + + all[0] = &algolabel; + all[1] = &p; + all[2] = &q; + all[3] = &g; + all[4] = &y; + } else { + err("no idea what this algorithm is: %d\n", algo); + return 1; + } + + if (ret = datum_from_string(&algolabel, algoname), ret) { + err("couldn't label string (error: %d)\n", ret); + return ret; + } + + snprintf(output_data, sizeof(output_data), "%s %s ", userid, algoname); + + pipefd = create_writing_pipe(&child_pid, args[0], args); + if (pipefd < 0) { + err("failed to create a writing pipe (returned %d)\n", pipefd); + return pipefd; + } + + write(1, output_data, strlen(output_data)); + + if (0 != write_data_fd_with_length(pipefd, all, mpicount)) { + err("was not able to write out RSA key data\n"); + return 1; + } + close(pipefd); + if (child_pid != waitpid(child_pid, &pipestatus, 0)) { + err("could not wait for child process to return for some reason.\n"); + return 1; + } + if (pipestatus != 0) { + err("base64 pipe died with return code %d\n", pipestatus); + return pipestatus; + } + + write(1, "\n", 1); + + + + gnutls_openpgp_crt_deinit(openpgp_crt); + gnutls_global_deinit(); + return 0; +} diff --git a/src/gpg2ssh/main.c b/src/gpg2ssh/main.c new file mode 100644 index 0000000..d6bac68 --- /dev/null +++ b/src/gpg2ssh/main.c @@ -0,0 +1,271 @@ +#include "gnutls-helpers.h" + +#include +#include + +/* + Author: Daniel Kahn Gillmor + Date: Tue, 01 Apr 2008 + License: GPL v3 or later + + monkeysphere private key translator: execute this with an GPG + secret key on stdin (at the moment, only passphraseless RSA keys + work). + + It will spit out a PEM-encoded version of the key on stdout, which + can be fed into ssh-add like this: + + gpg --export-secret-keys $KEYID | monkeysphere | ssh-add -c /dev/stdin + + Requirements: I've only built this so far with GnuTLS v2.3.4 -- + version 2.2.0 does not contain the appropriate pieces. + + Notes: gpgkey2ssh doesn't seem to provide the same public + keys. Mighty weird! + +0 wt215@squeak:~/monkeysphere$ gpg --export-secret-keys 1DCDF89F | ~dkg/src/monkeysphere/monkeysphere | ssh-add -c /dev/stdin +gnutls version: 2.3.4 +OpenPGP RSA Key, with 1024 bits +Identity added: /dev/stdin (/dev/stdin) +The user has to confirm each use of the key +0 wt215@squeak:~/monkeysphere$ ssh-add -L +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC9gWQqfrnhQKDQnND/3eOexpddE64J+1zp9fcyCje7H5LKclb6DBV2HS6WgW32PJhIzvP+fYZM3dzXea3fpv14y1SicXiRBDgF9SnsNA1qWn2RyzkLcKy7PmM0PDYtU1oiLTcQj/xkWcqW2sLKHT/WW+vZP5XP7RMGN/yWNMfE2Q== /dev/stdin +0 wt215@squeak:~/monkeysphere$ gpgkey2ssh 1DCDF89F +ssh-rsa AAAAB3NzaC1yc2EAAACBAL2BZCp+ueFAoNCc0P/d457Gl10Trgn7XOn19zIKN7sfkspyVvoMFXYdLpaBbfY8mEjO8/59hkzd3Nd5rd+m/XjLVKJxeJEEOAX1Kew0DWpafZHLOQtwrLs+YzQ8Ni1TWiItNxCP/GRZypbawsodP9Zb69k/lc/tEwY3/JY0x8TZAAAAAwEAAQ== COMMENT +0 wt215@squeak:~/monkeysphere$ + + */ + + +int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { + gnutls_openpgp_privkey_t pgp_privkey; + gnutls_datum_t m, e, d, p, q, u, g, y, x; + gnutls_pk_algorithm_t pgp_algo; + unsigned int pgp_bits; + int ret; + + init_datum(&m); + init_datum(&e); + init_datum(&d); + init_datum(&p); + init_datum(&q); + init_datum(&u); + init_datum(&g); + init_datum(&y); + init_datum(&x); + + if (ret = gnutls_openpgp_privkey_init(&pgp_privkey), ret) { + err("Failed to initialized OpenPGP private key (error: %d)\n", ret); + return 1; + } + + + /* format could be either: GNUTLS_OPENPGP_FMT_RAW, + GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, + otherwise, use BASE64: */ + + if (getenv("MONKEYSPHERE_RAW")) { + err("assuming RAW formatted private keys\n"); + if (ret = gnutls_openpgp_privkey_import(pgp_privkey, input, GNUTLS_OPENPGP_FMT_RAW, NULL, 0), ret) + err("failed to import the OpenPGP private key in RAW format (error: %d)\n", ret); + } else { + err("assuming BASE64 formatted private keys\n"); + if (ret = gnutls_openpgp_privkey_import (pgp_privkey, input, GNUTLS_OPENPGP_FMT_BASE64, NULL, 0), ret) + err("failed to import the OpenPGP private key in BASE64 format (error: %d)\n", ret); + } + + pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(pgp_privkey, &pgp_bits); + if (pgp_algo < 0) { + err("failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); + return 1; + } + if (pgp_algo == GNUTLS_PK_RSA) { + err("OpenPGP RSA Key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_rsa_raw(pgp_privkey, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + + ret = gnutls_x509_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (pgp_algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA Key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_dsa_raw(pgp_privkey, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + + ret = gnutls_x509_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import DSA key parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", pgp_algo); + return 1; + } + + ret = gnutls_x509_privkey_fix(*output); + if (ret != 0) { + err("failed to fix up the private key in X.509 format (error: %d)\n", ret); + return 1; + } + + gnutls_openpgp_privkey_deinit(pgp_privkey); + return 0; +} + +int convert_x509_to_pgp(gnutls_openpgp_privkey_t* output, gnutls_datum_t* input) { + gnutls_x509_privkey_t x509_privkey; + gnutls_datum_t m, e, d, p, q, u, g, y, x; + gnutls_pk_algorithm_t x509_algo; + int ret; + + init_datum(&m); + init_datum(&e); + init_datum(&d); + init_datum(&p); + init_datum(&q); + init_datum(&u); + init_datum(&g); + init_datum(&y); + init_datum(&x); + + if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { + err("Failed to initialized X.509 private key (error: %d)\n", ret); + return 1; + } + + + /* format could be either: GNUTLS_X509_FMT_DER, + GNUTLS_X509_FMT_PEM; if MONKEYSPHERE_DER is set, use DER, + otherwise, use PEM: */ + + if (getenv("MONKEYSPHERE_DER")) { + err("assuming DER formatted private keys\n"); + if (ret = gnutls_x509_privkey_import(x509_privkey, input, GNUTLS_X509_FMT_DER), ret) + err("failed to import the X.509 private key in DER format (error: %d)\n", ret); + } else { + err("assuming PEM formatted private keys\n"); + if (ret = gnutls_x509_privkey_import (x509_privkey, input, GNUTLS_X509_FMT_PEM), ret) + err("failed to import the X.509 private key in PEM format (error: %d)\n", ret); + } + + x509_algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); + if (x509_algo < 0) { + err("failed to get X.509 key algorithm (error: %d)\n", x509_algo); + return 1; + } + if (x509_algo == GNUTLS_PK_RSA) { + err("X.509 RSA Key\n"); + ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + + /* ret = gnutls_openpgp_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); */ + ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (x509_algo == GNUTLS_PK_DSA) { + err("X.509 DSA Key\n"); + ret = gnutls_x509_privkey_export_dsa_raw(x509_privkey, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + + /* ret = gnutls_openpgp_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); */ + ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import DSA key parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", x509_algo); + return 1; + } + + gnutls_x509_privkey_deinit(x509_privkey); + return 0; +} + + +int main(int argc, char* argv[]) { + gnutls_datum_t data; + int ret; + gnutls_x509_privkey_t x509_privkey; + + char output_data[10240]; + size_t ods = sizeof(output_data); + + init_gnutls(); + + init_datum(&data); + + /* slurp in the private key from stdin */ + if (ret = set_datum_fd(&data, 0), ret) { + err("didn't read file descriptor 0\n"); + return 1; + } + + + + /* Or, instead, read in key from a file name: + if (ret = set_datum_file(&data, argv[1]), ret) { + err("didn't read file '%s'\n", argv[1]); + return 1; + } +*/ + + /* treat the passed file as an X.509 private key, and extract its + component values: */ + +/* if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { */ +/* err("Failed to import the X.509 key (error: %d)\n", ret); */ +/* return 1; */ +/* } */ +/* gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); */ + + /* try to print the PEM-encoded private key: */ +/* ret = gnutls_x509_privkey_export (x509_privkey, */ +/* GNUTLS_X509_FMT_PEM, */ +/* output_data, */ +/* &ods); */ +/* printf("ret: %u; ods: %u;\n", ret, ods); */ +/* if (ret == 0) { */ +/* write(0, output_data, ods); */ +/* } */ + + + if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { + err("Failed to initialize X.509 private key (error: %d)\n", ret); + return 1; + } + + if (ret = convert_pgp_to_x509(&x509_privkey, &data), ret) { + return ret; + } + + ret = gnutls_x509_privkey_export (x509_privkey, + GNUTLS_X509_FMT_PEM, + output_data, + &ods); + printf("ret: %u; ods: %u;\n", ret, ods); + if (ret == 0) { + write(1, output_data, ods); + } + + + gnutls_x509_privkey_deinit(x509_privkey); + gnutls_global_deinit(); + return 0; +} diff --git a/src/gpg2ssh/ssh2gpg.c b/src/gpg2ssh/ssh2gpg.c new file mode 100644 index 0000000..b14a540 --- /dev/null +++ b/src/gpg2ssh/ssh2gpg.c @@ -0,0 +1,171 @@ +#include "gnutls-helpers.h" + +#include +#include + +/* for waitpid() */ +#include +#include + +/* for time() */ +#include + +/* for htons() */ +#include + + +/* + Author: Daniel Kahn Gillmor + Date: Sun, 2008-04-20 + License: GPL v3 or later + + monkeysphere public key translator: execute this with an ssh + private key on stdin. It currently only works with RSA keys. + + it should eventually work with OpenSSH-style public keys instead of + the full private key, but it was easier to do this way. + + It shoud spit out a version of the public key suitable for acting + as an OpenPGP public sub key packet. + + */ + +int main(int argc, char* argv[]) { + gnutls_datum_t data; + int ret; + gnutls_x509_privkey_t x509_privkey; + gnutls_openpgp_crt_t openpgp_crt; + gnutls_openpgp_keyid_t keyid; + printable_keyid p_keyid; + unsigned int keyidx; + unsigned int usage, bits; + gnutls_pk_algorithm_t algo; + + unsigned char packettag; + unsigned char openpgpversion; + time_t timestamp; + uint32_t clunkytime; + unsigned char openpgpalgo; + unsigned int packetlen; + uint16_t plen; + + gnutls_datum_t m, e, d, p, q, u, g, y; + gnutls_datum_t algolabel; + + char output_data[10240]; + char userid[10240]; + size_t uidsz = sizeof(userid); + + const gnutls_datum_t* all[5]; + int pipefd; + pid_t child_pid; + char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; + const char* algoname; + int mpicount; + int pipestatus; + + init_gnutls(); + + init_datum(&data); + + init_datum(&m); + init_datum(&e); + init_datum(&d); + init_datum(&p); + init_datum(&q); + init_datum(&u); + init_datum(&g); + init_datum(&y); + + init_datum(&algolabel); + + init_keyid(keyid); + + /* slurp in the private key from stdin */ + if (ret = set_datum_fd(&data, 0), ret) { + err("didn't read file descriptor 0\n"); + return 1; + } + + + if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { + err("Failed to initialize private key structure (error: %d)\n", ret); + return 1; + } + + err("assuming PEM formatted private key\n"); + if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { + err("failed to import the PEM-encoded private key (error: %d)\n", ret); + return ret; + } + + algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); + if (algo < 0) { + err("failed to get the algorithm of the PEM-encoded public key (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + err("RSA private key\n"); + ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + err("Modulus size %d, exponent size %d\n", m.size, e.size); + } else if (algo == GNUTLS_PK_DSA) { + err("DSA Key, not implemented!!\n", bits); + return 1; + } else { + err("Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); + return 1; + } + + /* now we have algo, and the various MPI data are set. Can we + export them as a public subkey packet? */ + + /* this packet should be tagged 14, and should contain: + + 1 octet: version (4) + 4 octets: time of generation (seconds since 1970) + 1 octet: algo (http://tools.ietf.org/html/rfc4880#section-5.5.2 implies 1 for RSA) + + MPI: modulus + MPI: exponent + */ + + packetlen = 1 + 4 + 1; + /* FIXME: this is RSA only. for DSA, there'll be more: */ + packetlen += get_openpgp_mpi_size(&m) + get_openpgp_mpi_size(&e); + + /* FIXME: we should generate this bound more cleanly -- i just + happen to know that 65535 is 2^16-1: */ + if (packetlen > 65535) { + err("packet length is too long (%d)\n", packetlen); + return 1; + } + + /* we're going to emit an old-style packet, with tag 14 (public + subkey), with a two-octet packet length */ + packettag = 0x80 | (14 << 2) | 1; + + write(1, &packettag, sizeof(packettag)); + plen = htons(packetlen); + write(1, &plen, sizeof(plen)); + + openpgpversion = 4; + write(1, &openpgpversion, 1); + + timestamp = time(NULL); + clunkytime = htonl(timestamp); + write(1, &clunkytime, 4); + + /* FIXME: handle things other than RSA */ + openpgpalgo = 1; + write(1, &openpgpalgo, 1); + + write_openpgp_mpi_to_fd(1, &m); + write_openpgp_mpi_to_fd(1, &e); + + gnutls_x509_privkey_deinit(x509_privkey); + gnutls_global_deinit(); + return 0; +} diff --git a/src/howler/howler b/src/howler/howler new file mode 100755 index 0000000..0b67c02 --- /dev/null +++ b/src/howler/howler @@ -0,0 +1,134 @@ +#!/bin/sh + +# howler: monkeysphere server gpg generator/publisher/maintainer +# +# Written by +# Jameson Rollins +# +# Copyright 2008, released under the GPL, version 3 or later + +PGRM=$(basename $0) + +######################################################################## +# FUNCTIONS +######################################################################## + +usage() { +cat <&2 + exit ${2:-'1'} +} + +# generate server gpg key +gen_key() { + KEY_TYPE=${KEY_TYPE:-RSA} + KEY_LENGTH=${KEY_LENGTH:-2048} + KEY_USAGE=${KEY_USAGE:-encrypt,auth} + SERVICE=${SERVICE:-ssh} + HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} + + USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} + + echo "key parameters:" + cat < /dev/null 2>&1 ; then + failure "key for '$USERID' already exists" + fi + + echo "generating server key..." + gpg --batch --gen-key < /dev/null | grep '^pub:' | cut -d: -f5) + + # dummy command so as not to publish fakes keys during testing + # eventually: + #gpg --send-keys --keyserver "$KEYSERVER" "$keyID" + echo "gpg --send-keys --keyserver $KEYSERVER $keyID" +} + +trust_key() { + for keyID ; do + # get the key from the key server + gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" + + # edit the key to change trust + # FIXME: need to figure out how to automate this, + # in a batch mode or something. + gpg --edit-key "$keyID" + done +} + +######################################################################## +# MAIN +######################################################################## + +# set ms home directory +MS_HOME=${MS_HOME:-/etc/monkeysphere} + +# load configuration file +MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} +[ -e "$MS_CONF" ] && . "$MS_CONF" + +GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} +export GNUPGHOME +KEYSERVER=${KEYSERVER:-subkeys.pgp.net} +export KEYSERVER + +COMMAND="$1" +[ "$COMMAND" ] || failure "Type '$PGRM help' for usage." +shift 1 + +case $COMMAND in + 'gen-key') + gen_key + ;; + 'publish-key') + publish_key + ;; + 'trust-key') + if [ -z "$1" ] ; then + failure "you must specify at least one key to trust." + fi + trust_key "$@" + ;; + 'help') + usage + exit + ;; + *) + failure "Unknown command: '$COMMAND' +Type '$PGRM help' for usage." + ;; +esac diff --git a/src/monkeysphere b/src/monkeysphere new file mode 100755 index 0000000..f279d86 --- /dev/null +++ b/src/monkeysphere @@ -0,0 +1,154 @@ +#!/bin/sh + +######################################################################## +PGRM=$(basename $0) + +SHAREDIR=${SHAREDIR:-"/usr/share/monkeysphere"} +export SHAREDIR +. "${SHAREDIR}/common" + +GLOBAL_CONFIG=${GLOBAL_CONFIG:-"${ETC}"/monkeysphere.conf} +[ -r "$GLOBAL_CONFIG" ] && . "$GLOBAL_CONFIG" + +# date in UTF format if needed +DATE=$(date -u '+%FT%T') + +# unset some environment variables that could screw things up +GREP_OPTIONS= + +######################################################################## +# FUNCTIONS +######################################################################## + +usage() { +cat < [args] +Monkeysphere client tool. + +subcommands: + update-known-hosts (k) [HOST]... update known_hosts file + update-authorized-keys (a) update authorized_keys file + update-userid (u) [USERID]... add/update userid to + authorized_user_ids + help (h,?) this help + +EOF +} + +######################################################################## +# MAIN +######################################################################## + +COMMAND="$1" +[ "$COMMAND" ] || failure "Type '$PGRM help' for usage." +shift + +# set ms home directory +MS_HOME=${MS_HOME:-"$HOME"/.config/monkeysphere} + +# load configuration file +MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} +[ -e "$MS_CONF" ] && . "$MS_CONF" + +# set empty config variable with defaults +AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids} +GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg} +KEYSERVER=${KEYSERVER:-subkeys.pgp.net} +REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys} +USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts} +HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-} + +export GNUPGHOME + +# stagging locations +hostKeysCacheDir="$MS_HOME"/host_keys +userKeysCacheDir="$MS_HOME"/user_keys +msAuthorizedKeys="$MS_HOME"/authorized_keys + +# make sure gpg home exists with proper permissions +mkdir -p -m 0700 "$GNUPGHOME" + +case $COMMAND in + 'update-known-hosts'|'k') + MODE='known_hosts' + + # touch the known_hosts file to make sure it exists + touch "$USER_KNOWN_HOSTS" + + # if hosts are specified on the command line, process just + # those hosts + if [ "$1" ] ; then + for host ; do + process_host "$host" "$hostKeysCacheDir" + done + + # otherwise, if no hosts are specified, process the user + # known_hosts file + else + if [ ! -s "$USER_KNOWN_HOSTS" ] ; then + failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." + fi + log "processing known_hosts file..." + process_known_hosts "$USER_KNOWN_HOSTS" "$hostKeysCacheDir" + fi + ;; + + 'update-authorized-keys'|'a') + MODE='authorized_keys' + + log "processing authorized_user_ids file..." + + # make sure authorized_user_ids file exists + if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then + log "authorized_user_ids file is empty or does not exist." + exit + fi + + process_authorized_ids "$AUTHORIZED_USER_IDS" "$userKeysCacheDir" + + # write output key file + log "writing monkeysphere authorized_keys file... " + touch "$msAuthorizedKeys" + if [ "$(ls "$userKeysCacheDir")" ] ; then + log -n "adding gpg keys... " + cat "$userKeysCacheDir"/* > "$msAuthorizedKeys" + echo "done." + else + log "no gpg keys to add." + fi + if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then + userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$HOME"} + if [ -s "$userAuthorizedKeys" ] ; then + log -n "adding user authorized_keys file... " + cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" + echo "done." + fi + fi + log "monkeysphere authorized_keys file generated:" + log "$msAuthorizedKeys" + ;; + + 'update-userid'|'u') + if [ -z "$1" ] ; then + failure "you must specify at least one userid." + fi + for userID ; do + if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + log "userid '$userID' not in authorized_user_ids file." + continue + fi + log "processing user id: '$userID'" + process_user_id "$userID" "$userKeysCacheDir" > /dev/null + done + ;; + + 'help'|'h'|'?') + usage + ;; + + *) + failure "Unknown command: '$COMMAND' +Type 'cereal-admin help' for usage." + ;; +esac diff --git a/src/monkeysphere-server b/src/monkeysphere-server new file mode 100755 index 0000000..f1b4892 --- /dev/null +++ b/src/monkeysphere-server @@ -0,0 +1,219 @@ +#!/bin/sh + +######################################################################## +PGRM=$(basename $0) + +SHAREDIR=${SHAREDIR:-"/usr/share/monkeysphere"} +export SHAREDIR +. "${SHAREDIR}/common" + +# date in UTF format if needed +DATE=$(date -u '+%FT%T') + +# unset some environment variables that could screw things up +GREP_OPTIONS= + +######################################################################## +# FUNCTIONS +######################################################################## + +usage() { +cat < [args] +Monkeysphere server admin tool. + +subcommands: + update-users (s) [USER]... update authorized_keys file + gen-key (g) generate gpg key for the host + publish-key (p) publish host gpg to keyserver + trust-key (t) KEYID [KEYID]... mark keyid as trusted + update-user-userid (u) USER UID [UID]... add/update userid for user + help (h,?) this help + +EOF +} + +# generate server gpg key +gen_key() { + KEY_TYPE=${KEY_TYPE:-RSA} + KEY_LENGTH=${KEY_LENGTH:-2048} + KEY_USAGE=${KEY_USAGE:-encrypt,auth} + SERVICE=${SERVICE:-ssh} + HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} + + USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} + + echo "key parameters:" + cat < /dev/null 2>&1 ; then + failure "key for '$USERID' already exists" + fi + + echo "generating server key..." + gpg --batch --gen-key < /dev/null | grep '^pub:' | cut -d: -f5) + + # dummy command so as not to publish fakes keys during testing + # eventually: + #gpg --send-keys --keyserver "$KEYSERVER" "$keyID" + echo "gpg --send-keys --keyserver $KEYSERVER $keyID" +} + +# trust key +trust_key() { + for keyID ; do + # get the key from the key server + gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" + + # edit the key to change trust + # FIXME: need to figure out how to automate this, + # in a batch mode or something. + gpg --edit-key "$keyID" + done +} + +######################################################################## +# MAIN +######################################################################## + +COMMAND="$1" +[ "$COMMAND" ] || failure "Type '$PGRM help' for usage." +shift + +# set ms home directory +MS_HOME=${MS_HOME:-"$ETC"} + +# load configuration file +MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere-server.conf} +[ -e "$MS_CONF" ] && . "$MS_CONF" + +# set empty config variable with defaults +GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} +KEYSERVER=${KEYSERVER:-subkeys.pgp.net} +REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys} +STAGING_AREA=${STAGING_AREA:-"$LIB"/stage} + +export GNUPGHOME + +# make sure gpg home exists with proper permissions +mkdir -p -m 0700 "$GNUPGHOME" + +case $COMMAND in + 'update-users'|'s') + if [ "$1" ] ; then + unames="$@" + else + unames=$(ls -1 "$MS_HOME"/authorized_user_ids) + fi + + for uname in $unames ; do + MODE="authorized_keys" + authorizedUserIDs="$MS_HOME"/authorized_user_ids/"$uname" + cacheDir="$STAGING_AREA"/"$uname"/user_keys + msAuthorizedKeys="$STAGING_AREA"/"$uname"/authorized_keys + + # make sure authorized_user_ids file exists + if [ ! -s "$authorizedUserIDs" ] ; then + log "authorized_user_ids file for '$uname' is empty or does not exist." + continue + fi + + log "processing authorized_keys for user '$uname'..." + + process_authorized_ids "$authorizedUserIDs" "$cacheDir" + + # write output key file + log "writing monkeysphere authorized_keys file... " + touch "$msAuthorizedKeys" + if [ "$(ls "$cacheDir")" ] ; then + log -n "adding gpg keys... " + cat "$cacheDir"/* > "$msAuthorizedKeys" + echo "done." + else + log "no gpg keys to add." + fi + if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then + userHome=$(getent passwd "$uname" | cut -d: -f6) + userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$userHome"} + if [ -s "$userAuthorizedKeys" ] ; then + log -n "adding user authorized_keys file... " + cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" + echo "done." + fi + fi + log "monkeysphere authorized_keys file generated:" + log "$msAuthorizedKeys" + done + ;; + + 'gen-key'|'g') + gen_key + ;; + + 'publish-key'|'p') + publish_key + ;; + + 'trust-key'|'t') + if [ -z "$1" ] ; then + failure "you must specify at least one key to trust." + fi + trust_key "$@" + ;; + + 'update-user-userid'|'u') + uname="$1" + shift + if [ -z "$uname" ] ; then + failure "you must specify user." + fi + if [ -z "$1" ] ; then + failure "you must specify at least one userid." + fi + for userID ; do + AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" + if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + log "userid '$userID' not in authorized_user_ids file." + continue + fi + log "processing user id: '$userID'" + process_user_id "$userID" "$userKeysCacheDir" > /dev/null + done + ;; + + 'help'|'h'|'?') + usage + ;; + + *) + failure "Unknown command: '$COMMAND' +Type 'cereal-admin help' for usage." + ;; +esac diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand new file mode 100755 index 0000000..1724966 --- /dev/null +++ b/src/monkeysphere-ssh-proxycommand @@ -0,0 +1,16 @@ +#!/bin/sh -e + +# MonkeySphere ssh ProxyCommand hook +# Proxy command script to initiate a monkeysphere known_hosts update +# before an ssh connection to host is established. +# Can be added to ~/.ssh/config as follows: +# ProxyCommand monkeysphere-ssh-proxycommand %h %p + +HOST="$1" +PORT="$2" + +# update the known_hosts file for the host +monkeysphere update-known-hosts "$HOST" + +# make a netcat connection to host for the ssh connection +exec nc "$HOST" "$PORT" diff --git a/src/rhesus/README b/src/rhesus/README new file mode 100644 index 0000000..4d383d5 --- /dev/null +++ b/src/rhesus/README @@ -0,0 +1,30 @@ +rhesus is the monkeysphere authorized_keys/known_hosts generator. + +In authorized_keys mode, rhesus takes an auth_user_ids file, which +contains gpg user ids, uses gpg to fetch the keys of the specified +users, does a monkeysphere policy check on each id, and uses gpg2ssh +to generate authorized_keys lines for each verified id. The lines are +then combined with a user's traditional authorized_keys file to create +a new authorized_keys file. + +In known_hosts mode, rhesus takes an auth_host_ids file, which +contains gpg user ids of the form ssh://URL, uses gpg to fetch the +keys of the specified hosts, does a monkeysphere policy check on each +id, and uses gpg2ssh to generate a known_hosts lines for each verified +id. The lines are then combined with a user's traditional known_hosts +file to create a new known_hosts file. + +When run as a normal user, no special configuration is needed. + +When run as an administrator to update system-maintained +authorized_keys files for each user, the following environment +variables should be defined first: + + MS_CONF=/etc/monkeysphere/monkeysphere.conf + USER=foo + +For example, the command might be run like this: + + for USER in $(ls -1 /home) ; do + MS_CONF=/etc/monkeysphere/monkeysphere.conf rhesus --authorized_keys + done diff --git a/src/rhesus/rhesus b/src/rhesus/rhesus new file mode 100755 index 0000000..f607f0b --- /dev/null +++ b/src/rhesus/rhesus @@ -0,0 +1,466 @@ +#!/bin/sh + +# rhesus: monkeysphere authorized_keys/known_hosts generating script +# +# Written by +# Jameson Rollins +# +# Copyright 2008, released under the GPL, version 3 or later + +# all caps variables are meant to be user supplied (ie. from config +# file) and are considered global + +PGRM=$(basename $0) + +# date in UTF format if needed +DATE=$(date -u '+%FT%T') + +# unset some environment variables that could screw things up +GREP_OPTIONS= + +######################################################################## +# FUNCTIONS +######################################################################## + +usage() { +cat <&2 + exit ${2:-'1'} +} + +# write output to stdout +log() { + echo -n "ms: " + echo "$@" +} + +# write output to stderr +loge() { + echo -n "ms: " 1>&2 + echo "$@" 1>&2 +} + +# cut out all comments(#) and blank lines from standard input +meat() { + grep -v -e "^[[:space:]]*#" -e '^$' +} + +# cut a specified line from standard input +cutline() { + head --line="$1" | tail -1 +} + +# retrieve all keys with given user id from keyserver +# FIXME: need to figure out how to retrieve all matching keys +# (not just first 5) +gpg_fetch_keys() { + local id + id="$1" + echo 1,2,3,4,5 | \ + gpg --quiet --batch --command-fd 0 --with-colons \ + --keyserver "$KEYSERVER" \ + --search ="$id" >/dev/null 2>&1 +} + +# check that characters are in a string (in an AND fashion). +# used for checking key capability +# check_capability capability a [b...] +check_capability() { + local capability + local capcheck + + capability="$1" + shift 1 + + for capcheck ; do + if echo "$capability" | grep -q -v "$capcheck" ; then + return 1 + fi + done + return 0 +} + +# convert escaped characters from gpg output back into original +# character +# FIXME: undo all escape character translation in with-colons gpg output +unescape() { + echo "$1" | sed 's/\\x3a/:/' +} + +# stand in until we get dkg's gpg2ssh program +gpg2ssh_tmp() { + local mode + local keyID + local userID + local host + + mode="$1" + keyID="$2" + userID="$3" + + if [ "$mode" = 'authorized_keys' ] ; then + gpgkey2ssh "$keyID" | sed -e "s/COMMENT/${userID}/" + + # NOTE: it seems that ssh-keygen -R removes all comment fields from + # all lines in the known_hosts file. why? + # NOTE: just in case, the COMMENT can be matched with the + # following regexp: + # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' + elif [ "$mode" = 'known_hosts' ] ; then + host=$(echo "$userID" | sed -e "s|ssh://||") + echo -n "$host "; gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere${DATE}/" + fi +} + +# userid and key policy checking +# the following checks policy on the returned keys +# - checks that full key has appropriate valididy (u|f) +# - checks key has specified capability (REQUIRED_KEY_CAPABILITY) +# - checks that particular desired user id has appropriate validity +# see /usr/share/doc/gnupg/DETAILS.gz +# expects global variable: "mode" +process_user_id() { + local userID + local cacheDir + local requiredPubCapability + local gpgOut + local line + local type + local validity + local keyid + local uidfpr + local capability + local keyOK + local pubKeyID + local uidOK + local keyIDs + local userIDHash + local keyID + + userID="$1" + cacheDir="$2" + + requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") + + # fetch keys from keyserver, return 1 if none found + gpg_fetch_keys "$userID" || return 1 + + # output gpg info for (exact) userid and store + gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ + ="$userID" 2> /dev/null) + + # return 1 if there only "tru" lines are output from gpg + if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then + return 1 + fi + + # loop over all lines in the gpg output and process. + # need to do it this way (as opposed to "while read...") so that + # variables set in loop will be visible outside of loop + for line in $(seq 1 $(echo "$gpgOut" | wc -l)) ; do + + # read the contents of the line + type=$(echo "$gpgOut" | cutline "$line" | cut -d: -f1) + validity=$(echo "$gpgOut" | cutline "$line" | cut -d: -f2) + keyid=$(echo "$gpgOut" | cutline "$line" | cut -d: -f5) + uidfpr=$(echo "$gpgOut" | cutline "$line" | cut -d: -f10) + capability=$(echo "$gpgOut" | cutline "$line" | cut -d: -f12) + + # process based on record type + case $type in + 'pub') # primary keys + # new key, wipe the slate + keyOK= + pubKeyID= + uidOK= + keyIDs= + + pubKeyID="$keyid" + + # check primary key validity + if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + loge " unacceptable primary key validity ($validity)." + continue + fi + # check capability is not Disabled... + if check_capability "$capability" 'D' ; then + loge " key disabled." + continue + fi + # check overall key capability + # must be Encryption and Authentication + if ! check_capability "$capability" $requiredPubCapability ; then + loge " unacceptable primary key capability ($capability)." + continue + fi + + # mark if primary key is acceptable + keyOK=true + + # add primary key ID to key list if it has required capability + if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + keyIDs[${#keyIDs[*]}]="$keyid" + fi + ;; + 'uid') # user ids + # check key ok and we have key fingerprint + if [ -z "$keyOK" ] ; then + continue + fi + # check key validity + if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + continue + fi + # check the uid matches + if [ "$(unescape "$uidfpr")" != "$userID" ] ; then + continue + fi + + # mark if uid acceptable + uidOK=true + ;; + 'sub') # sub keys + # add sub key ID to key list if it has required capability + if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + keyIDs[${#keyIDs[*]}]="$keyid" + fi + ;; + esac + done + + # hash userid for cache file name + userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') + + # touch/clear key cache file + # (will be left empty if there are noacceptable keys) + > "$cacheDir"/"$userIDHash"."$pubKeyID" + + # for each acceptable key, write an ssh key line to the + # key cache file + if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then + for keyID in ${keyIDs[@]} ; do + # export the key with gpg2ssh + # FIXME: needs to apply extra options for authorized_keys + # lines if specified + gpg2ssh_tmp "$mode" "$keyID" "$userID" >> "$cacheDir"/"$userIDHash"."$pubKeyID" + + # hash the cache file if specified + if [ "$mode" = 'known_hosts' -a "$HASH_KNOWN_HOSTS" ] ; then + ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 + rm "$cacheDir"/"$userIDHash"."$pubKeyID".old + fi + done + fi + + # echo the path to the key cache file + echo "$cacheDir"/"$userIDHash"."$pubKeyID" +} + +# process a host for addition to a known_host file +process_host() { + local host + local cacheDir + local hostKeyCachePath + + host="$1" + cacheDir="$2" + + log "processing host: '$host'" + + hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") + if [ $? = 0 ] ; then + ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS" + cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS" + fi +} + +# process known_hosts file +# go through line-by-line, extract each host, and process with the +# host processing function +process_known_hosts() { + local cacheDir + local userID + + cacheDir="$1" + + # take all the hosts from the known_hosts file (first field), + # grep out all the hashed hosts (lines starting with '|') + cut -d ' ' -f 1 "$USER_KNOWN_HOSTS" | \ + grep -v '^|.*$' | \ + while IFS=, read -r -a hosts ; do + # process each host + for host in ${hosts[*]} ; do + process_host "$host" "$cacheDir" + done + done +} + +# process an authorized_*_ids file +# go through line-by-line, extract each userid, and process +process_authorized_ids() { + local authorizedIDsFile + local cacheDir + local userID + local userKeyCachePath + + authorizedIDsFile="$1" + cacheDir="$2" + + # clean out keys file and remake keys directory + rm -rf "$cacheDir" + mkdir -p "$cacheDir" + + # loop through all user ids in file + # FIXME: needs to handle extra options if necessary + cat "$authorizedIDsFile" | meat | \ + while read -r userID ; do + # process the userid + log "processing userid: '$userID'" + userKeyCachePath=$(process_user_id "$userID" "$cacheDir") + if [ -s "$userKeyCachePath" ] ; then + loge " acceptable key/uid found." + fi + done +} + +######################################################################## +# MAIN +######################################################################## + +if [ -z "$1" ] ; then + usage + exit 1 +fi + +# mode given in first variable +mode="$1" +shift 1 + +# check user +if ! id -u "$USER" > /dev/null 2>&1 ; then + failure "invalid user '$USER'." +fi + +# set user home directory +HOME=$(getent passwd "$USER" | cut -d: -f6) + +# set ms home directory +MS_HOME=${MS_HOME:-"$HOME"/.config/monkeysphere} + +# load configuration file +MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} +[ -e "$MS_CONF" ] && . "$MS_CONF" + +# set config variable defaults +STAGING_AREA=${STAGING_AREA:-"$MS_HOME"} +AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids} +GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg} +KEYSERVER=${KEYSERVER:-subkeys.pgp.net} +REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"$HOME"/.ssh/authorized_keys} +USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts} +HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-} + +# export USER and GNUPGHOME variables, since they are used by gpg +export USER +export GNUPGHOME + +# stagging locations +hostKeysCacheDir="$STAGING_AREA"/host_keys +userKeysCacheDir="$STAGING_AREA"/user_keys +msKnownHosts="$STAGING_AREA"/known_hosts +msAuthorizedKeys="$STAGING_AREA"/authorized_keys + +# make sure gpg home exists with proper permissions +mkdir -p -m 0700 "$GNUPGHOME" + +## KNOWN_HOST MODE +if [ "$mode" = 'known_hosts' -o "$mode" = 'k' ] ; then + mode='known_hosts' + + cacheDir="$hostKeysCacheDir" + + log "user '$USER': monkeysphere known_hosts processing" + + # touch the known_hosts file to make sure it exists + touch "$USER_KNOWN_HOSTS" + + # if hosts are specified on the command line, process just + # those hosts + if [ "$1" ] ; then + for host ; do + process_host "$host" "$cacheDir" + done + + # otherwise, if no hosts are specified, process the user + # known_hosts file + else + if [ ! -s "$USER_KNOWN_HOSTS" ] ; then + failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." + fi + process_known_hosts "$cacheDir" + fi + +## AUTHORIZED_KEYS MODE +elif [ "$mode" = 'authorized_keys' -o "$mode" = 'a' ] ; then + mode='authorized_keys' + + cacheDir="$userKeysCacheDir" + + # check auth ids file + if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then + log "authorized_user_ids file is empty or does not exist." + exit + fi + + log "user '$USER': monkeysphere authorized_keys processing" + + # if userids are specified on the command line, process just + # those userids + if [ "$1" ] ; then + for userID ; do + if ! grep -q "$userID" "$AUTHORIZED_USER_IDS" ; then + log "userid '$userID' not in authorized_user_ids file." + continue + fi + log "processing user id: '$userID'" + process_user_id "$userID" "$cacheDir" > /dev/null + done + + # otherwise, if no userids are specified, process the entire + # authorized_user_ids file + else + process_authorized_ids "$AUTHORIZED_USER_IDS" "$cacheDir" + fi + + # write output key file + log "writing monkeysphere authorized_keys file... " + touch "$msAuthorizedKeys" + if [ "$(ls "$cacheDir")" ] ; then + log -n "adding gpg keys... " + cat "$cacheDir"/* > "$msAuthorizedKeys" + echo "done." + else + log "no gpg keys to add." + fi + if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then + if [ -s "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then + log -n "adding user authorized_keys file... " + cat "$USER_CONTROLLED_AUTHORIZED_KEYS" >> "$msAuthorizedKeys" + echo "done." + fi + fi + log "monkeysphere authorized_keys file generated:" + log "$msAuthorizedKeys" + +else + failure "unknown command '$mode'." +fi -- cgit v1.2.3 From 48cd196efb86f8661fbf77552ef6c26b11fe20c6 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 10 Jun 2008 17:34:08 -0400 Subject: Add some skeletal debian packaging stuff and man pages, and moved conf files to etc directory. --- debian/changelog | 6 ++++++ debian/compat | 1 + debian/control | 13 +++++++++++++ debian/dirs | 11 +++++++++++ etc/monkeysphere-server.conf | 23 +++++++++++++++++++++++ etc/monkeysphere.conf | 31 +++++++++++++++++++++++++++++++ man/man1/monkeysphere.1 | 6 ++++++ man/man8/monkeysphere-server.8 | 6 ++++++ monkeysphere-server.conf | 23 ----------------------- monkeysphere.conf | 31 ------------------------------- 10 files changed, 97 insertions(+), 54 deletions(-) create mode 100644 debian/changelog create mode 100644 debian/compat create mode 100644 debian/control create mode 100644 debian/dirs create mode 100644 etc/monkeysphere-server.conf create mode 100644 etc/monkeysphere.conf create mode 100644 man/man1/monkeysphere.1 create mode 100644 man/man8/monkeysphere-server.8 delete mode 100644 monkeysphere-server.conf delete mode 100644 monkeysphere.conf diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 0000000..2b68de6 --- /dev/null +++ b/debian/changelog @@ -0,0 +1,6 @@ +monkeysphere (0.1-1) unstable; urgency=low + + * to be first release... + + -- Jameson Graef Rollins Tue, 10 Jun 2008 17:20:16 -0400 + diff --git a/debian/compat b/debian/compat new file mode 100644 index 0000000..7ed6ff8 --- /dev/null +++ b/debian/compat @@ -0,0 +1 @@ +5 diff --git a/debian/control b/debian/control new file mode 100644 index 0000000..bd53601 --- /dev/null +++ b/debian/control @@ -0,0 +1,13 @@ +Source: monkeysphere +Section: net +Priority: extra +Maintainer: Daniel Kahn Gillmor +Uploaders: Jameson Rollins +Build-Depends: debhelper (>= 5.0) +Standards-Version: 3.7.3 +XS-Dm-Upload-Allowed: yes + +Package: monkeysphere +Architecture: all +Depends: ssh, gnupg, gnupg2 +Description: use GNUPG for ssh connections diff --git a/debian/dirs b/debian/dirs new file mode 100644 index 0000000..277c0b5 --- /dev/null +++ b/debian/dirs @@ -0,0 +1,11 @@ +var/lib/monkeysphere +var/lib/monkeysphere/stage +usr/bin +usr/sbin +usr/share +usr/share/monkeysphere +usr/share/man +usr/share/man1 +usr/share/man8 +etc/monkeysphere +etc/monkeysphere/authorized_user_ids diff --git a/etc/monkeysphere-server.conf b/etc/monkeysphere-server.conf new file mode 100644 index 0000000..bed5c09 --- /dev/null +++ b/etc/monkeysphere-server.conf @@ -0,0 +1,23 @@ +# MonkeySphere server configuration file. + +# GPG home directory for server +#GNUPGHOME=/etc/monkeysphere/gnupg + +# GPG keyserver to search for keys +#KEYSERVER=subkeys.pgp.net + +# Required key capabilities +# Must be quoted, lowercase, space-seperated list of the following: +# e = encrypt +# s = sign +# c = certify +# a = authentication +#REQUIRED_KEY_CAPABILITY="e a" + +# Whether to add user controlled authorized_keys file to +# monkeysphere-generated authorized_keys file. Should be path to file +# where '%h' will be substituted for the user's home directory. +#USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys + +# where to cache user authorized_keys lines +#STAGING_AREA=/var/lib/monkeysphere/stage diff --git a/etc/monkeysphere.conf b/etc/monkeysphere.conf new file mode 100644 index 0000000..385165a --- /dev/null +++ b/etc/monkeysphere.conf @@ -0,0 +1,31 @@ +# MonkeySphere system-wide client configuration file. + +# authorized_user_ids file +#AUTHORIZED_USER_IDS=~/.config/monkeysphere/authorized_user_ids + +# GPG home directory +#GNUPGHOME=~/.gnupg + +# GPG keyserver to search for keys +#KEYSERVER=subkeys.pgp.net + +# Required key capabilities +# Must be quoted, lowercase, space-seperated list of the following: +# e = encrypt +# s = sign +# c = certify +# a = authentication +#REQUIRED_KEY_CAPABILITY="e a" + +# Path to user-controlled authorized_keys file to add to +# Monkeysphere-generated authorized_keys file. If empty, then no +# user-controlled file will be added. +#USER_CONTROLLED_AUTHORIZED_KEYS=~/.ssh/authorized_keys + +# User known_hosts file +#USER_KNOWN_HOSTS=~/.ssh/known_hosts + +# Whether or not to hash the generated known_hosts lines +# (empty mean "no"). +#HASH_KNOWN_HOSTS= + diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 new file mode 100644 index 0000000..4c3d483 --- /dev/null +++ b/man/man1/monkeysphere.1 @@ -0,0 +1,6 @@ +.TH MONKEYSPHERE "1" "June 2008" "monkeysphere 0.1" "User Commands" +.SH NAME +monkeysphere \- monkeysphere client user interface +.SH SYNOPSIS +.B monkeysphere \fIcommand\fP [\fIargs\fP] +.SH DESCRIPTION diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 new file mode 100644 index 0000000..302bffb --- /dev/null +++ b/man/man8/monkeysphere-server.8 @@ -0,0 +1,6 @@ +.TH MONKEYSPHERE-SERVER "1" "June 2008" "monkeysphere 0.1" "User Commands" +.SH NAME +monkeysphere-server \- monkeysphere server admin user interface +.SH SYNOPSIS +.B monkeysphere-server \fIcommand\fP [\fIargs\fP] +.SH DESCRIPTION diff --git a/monkeysphere-server.conf b/monkeysphere-server.conf deleted file mode 100644 index bed5c09..0000000 --- a/monkeysphere-server.conf +++ /dev/null @@ -1,23 +0,0 @@ -# MonkeySphere server configuration file. - -# GPG home directory for server -#GNUPGHOME=/etc/monkeysphere/gnupg - -# GPG keyserver to search for keys -#KEYSERVER=subkeys.pgp.net - -# Required key capabilities -# Must be quoted, lowercase, space-seperated list of the following: -# e = encrypt -# s = sign -# c = certify -# a = authentication -#REQUIRED_KEY_CAPABILITY="e a" - -# Whether to add user controlled authorized_keys file to -# monkeysphere-generated authorized_keys file. Should be path to file -# where '%h' will be substituted for the user's home directory. -#USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys - -# where to cache user authorized_keys lines -#STAGING_AREA=/var/lib/monkeysphere/stage diff --git a/monkeysphere.conf b/monkeysphere.conf deleted file mode 100644 index 385165a..0000000 --- a/monkeysphere.conf +++ /dev/null @@ -1,31 +0,0 @@ -# MonkeySphere system-wide client configuration file. - -# authorized_user_ids file -#AUTHORIZED_USER_IDS=~/.config/monkeysphere/authorized_user_ids - -# GPG home directory -#GNUPGHOME=~/.gnupg - -# GPG keyserver to search for keys -#KEYSERVER=subkeys.pgp.net - -# Required key capabilities -# Must be quoted, lowercase, space-seperated list of the following: -# e = encrypt -# s = sign -# c = certify -# a = authentication -#REQUIRED_KEY_CAPABILITY="e a" - -# Path to user-controlled authorized_keys file to add to -# Monkeysphere-generated authorized_keys file. If empty, then no -# user-controlled file will be added. -#USER_CONTROLLED_AUTHORIZED_KEYS=~/.ssh/authorized_keys - -# User known_hosts file -#USER_KNOWN_HOSTS=~/.ssh/known_hosts - -# Whether or not to hash the generated known_hosts lines -# (empty mean "no"). -#HASH_KNOWN_HOSTS= - -- cgit v1.2.3 From be186e427ac34812e2b2a55489ae55fe2341f6a0 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 10 Jun 2008 18:38:46 -0400 Subject: Cleaned/fix up update-userid function. also some general cleanup. --- src/common | 40 ++++++++++++++++++++++++++++++++ src/monkeysphere | 31 +++++++++++++++---------- src/monkeysphere-server | 49 +++++++++++++++++---------------------- src/monkeysphere-ssh-proxycommand | 19 ++++++++++----- 4 files changed, 93 insertions(+), 46 deletions(-) diff --git a/src/common b/src/common index 8643080..073b8af 100755 --- a/src/common +++ b/src/common @@ -351,3 +351,43 @@ process_authorized_ids() { process_user_id "$userID" "$cacheDir" > /dev/null done } + +# update the cache for userid, and prompt to add file to +# authorized_user_ids file if the userid is found in gpg +# and not already in file. +update_userid() { + local userID + local cacheDir + local userIDKeyCache + + userID="$1" + cacheDir="$2" + + log "processing userid: '$userID'" + userIDKeyCache=$(process_user_id "$userID" "$cacheDir") + if [ -z "$userIDKeyCache" ] ; then + return 1 + fi + if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + echo "the following userid is not in the authorized_user_ids file:" + echo " $userID" + read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y} + if [ ${OK/y/Y} = 'Y' ] ; then + log -n " adding userid to authorized_user_ids file... " + echo "$userID" >> "$AUTHORIZED_USER_IDS" + echo "done." + fi + fi +} + +# retrieve key from web of trust, and set owner trust to "full" +# if key is found. +trust_key() { + # get the key from the key server + gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" + + # edit the key to change trust + # FIXME: need to figure out how to automate this, + # in a batch mode or something. + gpg --edit-key "$keyID" +} diff --git a/src/monkeysphere b/src/monkeysphere index f279d86..d652ab3 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -1,5 +1,13 @@ #!/bin/sh +# monkeysphere: MonkeySphere client tool +# +# The monkeysphere scripts are written by: +# Jameson Rollins +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + ######################################################################## PGRM=$(basename $0) @@ -26,11 +34,11 @@ usage: $PGRM [args] Monkeysphere client tool. subcommands: - update-known-hosts (k) [HOST]... update known_hosts file - update-authorized-keys (a) update authorized_keys file - update-userid (u) [USERID]... add/update userid to - authorized_user_ids - help (h,?) this help + update-known-hosts (k) [HOST]... update known_hosts file + update-authorized-keys (a) update authorized_keys file + update-userids (u) [USERID]... add/update userid + gen-ae-subkey (g) generate an 'ae' capable subkey + help (h,?) this help EOF } @@ -129,20 +137,19 @@ case $COMMAND in log "$msAuthorizedKeys" ;; - 'update-userid'|'u') + 'update-userids'|'u') if [ -z "$1" ] ; then failure "you must specify at least one userid." fi for userID ; do - if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then - log "userid '$userID' not in authorized_user_ids file." - continue - fi - log "processing user id: '$userID'" - process_user_id "$userID" "$userKeysCacheDir" > /dev/null + update_userid "$userID" "$userKeysCacheDir" done ;; + 'gen-ae-subkey'|) + failure "function not implemented yet." + ;; + 'help'|'h'|'?') usage ;; diff --git a/src/monkeysphere-server b/src/monkeysphere-server index f1b4892..fd7b583 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -1,5 +1,13 @@ #!/bin/sh +# monkeysphere-server: MonkeySphere server admin tool +# +# The monkeysphere scripts are written by: +# Jameson Rollins +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + ######################################################################## PGRM=$(basename $0) @@ -23,12 +31,12 @@ usage: $PGRM [args] Monkeysphere server admin tool. subcommands: - update-users (s) [USER]... update authorized_keys file - gen-key (g) generate gpg key for the host - publish-key (p) publish host gpg to keyserver - trust-key (t) KEYID [KEYID]... mark keyid as trusted - update-user-userid (u) USER UID [UID]... add/update userid for user - help (h,?) this help + update-users (s) [USER]... update user authorized_keys file + gen-key (g) generate gpg key for the server + publish-key (p) publish server gpg to keyserver + trust-key (t) KEYID [KEYID]... mark keyid as trusted + update-user-userids (u) USER UID [UID]... add/update userid for user + help (h,?) this help EOF } @@ -85,19 +93,6 @@ publish_key() { echo "gpg --send-keys --keyserver $KEYSERVER $keyID" } -# trust key -trust_key() { - for keyID ; do - # get the key from the key server - gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" - - # edit the key to change trust - # FIXME: need to figure out how to automate this, - # in a batch mode or something. - gpg --edit-key "$keyID" - done -} - ######################################################################## # MAIN ######################################################################## @@ -185,10 +180,12 @@ case $COMMAND in if [ -z "$1" ] ; then failure "you must specify at least one key to trust." fi - trust_key "$@" + for keyID ; do + trust_key "$keyID" + done ;; - 'update-user-userid'|'u') + 'update-user-userids'|'u') uname="$1" shift if [ -z "$uname" ] ; then @@ -197,14 +194,10 @@ case $COMMAND in if [ -z "$1" ] ; then failure "you must specify at least one userid." fi + AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" + userKeysCacheDir="$STAGING_AREA"/"$uname"/user_keys for userID ; do - AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" - if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then - log "userid '$userID' not in authorized_user_ids file." - continue - fi - log "processing user id: '$userID'" - process_user_id "$userID" "$userKeysCacheDir" > /dev/null + update_userid "$userID" "$userKeysCacheDir" done ;; diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand index 1724966..417d013 100755 --- a/src/monkeysphere-ssh-proxycommand +++ b/src/monkeysphere-ssh-proxycommand @@ -1,10 +1,17 @@ #!/bin/sh -e -# MonkeySphere ssh ProxyCommand hook -# Proxy command script to initiate a monkeysphere known_hosts update -# before an ssh connection to host is established. -# Can be added to ~/.ssh/config as follows: -# ProxyCommand monkeysphere-ssh-proxycommand %h %p +# monkeysphere-ssh-proxycommand: MonkeySphere ssh ProxyCommand hook +# +# The monkeysphere scripts are written by: +# Jameson Rollins +# +# They are Copyright 2008, and are all released under the GPL, version 3 +# or later. + +# This is meant to be run as an ssh ProxyCommand to initiate a +# monkeysphere known_hosts update before an ssh connection to host is +# established. Can be added to ~/.ssh/config as follows: +# ProxyCommand monkeysphere-ssh-proxycommand %h %p HOST="$1" PORT="$2" @@ -12,5 +19,5 @@ PORT="$2" # update the known_hosts file for the host monkeysphere update-known-hosts "$HOST" -# make a netcat connection to host for the ssh connection +# exec a netcat passthrough to host for the ssh connection exec nc "$HOST" "$PORT" -- cgit v1.2.3 From 6a278713cc9fd475acae6bb131a44fc9b26ddac6 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 10 Jun 2008 22:25:32 -0400 Subject: More cleanup of scripts - fixed bug in gpg2ssh_tmp call - broke out update_authorized_keys function - cleaned up gen_key function for server - added possible "Revoker:" parameter we might use - started gen_ae_subkey function that for some reason isn't working yet. --- src/common | 91 ++++++++++++++++++++++++++++--------------- src/monkeysphere | 100 +++++++++++++++++++++++++++++++++--------------- src/monkeysphere-server | 80 +++++++++++++++++++------------------- 3 files changed, 172 insertions(+), 99 deletions(-) diff --git a/src/common b/src/common index 073b8af..ff6ba59 100755 --- a/src/common +++ b/src/common @@ -88,11 +88,11 @@ gpg2ssh_tmp() { local userID local host - keyID="$2" - userID="$3" + keyID="$1" + userID="$2" - if [ "$mode" = 'authorized_keys' ] ; then - gpgkey2ssh "$keyID" | sed -e "s/COMMENT/${userID}/" + if [ "$MODE" = 'authorized_keys' ] ; then + gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere userID: ${userID}/" # NOTE: it seems that ssh-keygen -R removes all comment fields from # all lines in the known_hosts file. why? @@ -294,10 +294,65 @@ process_known_hosts() { done } -# process authorized_keys file +# update an authorized_keys file after first processing the +# authorized_user_ids file +update_authorized_keys() { + local cacheDir + local msAuthorizedKeys + local userAuthorizedKeys + + cacheDir="$1" + msAuthorizedKeys="$2" + userAuthorizedKeys="$3" + + process_authorized_ids "$AUTHORIZED_USER_IDS" "$cacheDir" + + # write output key file + log "writing monkeysphere authorized_keys file... " + touch "$msAuthorizedKeys" + if [ "$(ls "$cacheDir")" ] ; then + log -n "adding gpg keys... " + cat "$cacheDir"/* > "$msAuthorizedKeys" + echo "done." + else + log "no gpg keys to add." + fi + if [ "$userAuthorizedKeys" -a -s "$userAuthorizedKeys" ] ; then + log -n "adding user authorized_keys file... " + cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" + echo "done." + fi + log "monkeysphere authorized_keys file generated: $msAuthorizedKeys" +} + +# process an authorized_*_ids file +# go through line-by-line, extract each userid, and process +process_authorized_ids() { + local authorizedIDs + local cacheDir + local userID + + authorizedIDs="$1" + cacheDir="$2" + + # clean out keys file and remake keys directory + rm -rf "$cacheDir" + mkdir -p "$cacheDir" + + # loop through all user ids in file + # FIXME: needs to handle authorized_keys options + cat "$authorizedIDs" | meat | \ + while read -r userID ; do + # process the userid + log "processing userid: '$userID'" + process_user_id "$userID" "$cacheDir" > /dev/null + done +} + +# EXPERIMENTAL (unused) process userids found in authorized_keys file # go through line-by-line, extract monkeysphere userids from comment # fields, and process each userid -process_authorized_keys() { +process_userids_from_authorized_keys() { local authorizedKeys local cacheDir local userID @@ -328,30 +383,6 @@ process_authorized_keys() { done } -# process an authorized_*_ids file -# go through line-by-line, extract each userid, and process -process_authorized_ids() { - local authorizedIDs - local cacheDir - local userID - - authorizedIDs="$1" - cacheDir="$2" - - # clean out keys file and remake keys directory - rm -rf "$cacheDir" - mkdir -p "$cacheDir" - - # loop through all user ids in file - # FIXME: needs to handle authorized_keys options - cat "$authorizedIDs" | meat | \ - while read -r userID ; do - # process the userid - log "processing userid: '$userID'" - process_user_id "$userID" "$cacheDir" > /dev/null - done -} - # update the cache for userid, and prompt to add file to # authorized_user_ids file if the userid is found in gpg # and not already in file. diff --git a/src/monkeysphere b/src/monkeysphere index d652ab3..c417625 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -34,15 +34,70 @@ usage: $PGRM [args] Monkeysphere client tool. subcommands: - update-known-hosts (k) [HOST]... update known_hosts file - update-authorized-keys (a) update authorized_keys file + update-known_hosts (k) [HOST]... update known_hosts file + update-authorized_keys (a) update authorized_keys file update-userids (u) [USERID]... add/update userid - gen-ae-subkey (g) generate an 'ae' capable subkey + gen-ae-subkey (g) KEYID generate an 'ae' capable subkey help (h,?) this help EOF } +# generate a subkey with the 'a' and 'e' usage flags set +gen_ae_subkey(){ + local keyID + local gpgOut + local userID + + log "warning: this function is still not working." + + keyID="$1" + + # set subkey defaults + SUBKEY_TYPE=${KEY_TYPE:-RSA} + SUBKEY_LENGTH=${KEY_LENGTH:-1024} + SUBKEY_USAGE=${KEY_USAGE:-encrypt,auth} + + gpgOut=$(gpg --fixed-list-mode --list-keys --with-colons \ + "$keyID" 2> /dev/null) + + # return 1 if there only "tru" lines are output from gpg + if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then + loge " key not found." + return 1 + fi + + userID=$(echo "$gpgOut" | grep "^uid:" | cut -d: -f10) + + # set key parameters + keyParameters=$(cat < "$msAuthorizedKeys" - echo "done." - else - log "no gpg keys to add." - fi - if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then - userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$HOME"} - if [ -s "$userAuthorizedKeys" ] ; then - log -n "adding user authorized_keys file... " - cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" - echo "done." - fi - fi - log "monkeysphere authorized_keys file generated:" - log "$msAuthorizedKeys" + # update authorized_keys + update_authorized_keys "$userKeysCacheDir" "$msAuthorizedKeys" "$userAuthorizedKeys" ;; 'update-userids'|'u') @@ -146,8 +182,12 @@ case $COMMAND in done ;; - 'gen-ae-subkey'|) - failure "function not implemented yet." + 'gen-ae-subkey'|'g') + keyID="$1" + if [ -z "$keyID" ] ; then + failure "you must specify keyid of primary key." + fi + gen_ae_subkey "$keyID" ;; 'help'|'h'|'?') diff --git a/src/monkeysphere-server b/src/monkeysphere-server index fd7b583..6eeb702 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -31,18 +31,19 @@ usage: $PGRM [args] Monkeysphere server admin tool. subcommands: - update-users (s) [USER]... update user authorized_keys file - gen-key (g) generate gpg key for the server - publish-key (p) publish server gpg to keyserver - trust-key (t) KEYID [KEYID]... mark keyid as trusted - update-user-userids (u) USER UID [UID]... add/update userid for user - help (h,?) this help + update-users (s) [USER]... update users authorized_keys files + gen-key (g) generate gpg key for the server + publish-key (p) publish server key to keyserver + trust-keys (t) KEYID... mark keyids as trusted + update-user-userids (u) USER UID... add/update userids for a user + help (h,?) this help EOF } # generate server gpg key gen_key() { + # set key defaults KEY_TYPE=${KEY_TYPE:-RSA} KEY_LENGTH=${KEY_LENGTH:-2048} KEY_USAGE=${KEY_USAGE:-encrypt,auth} @@ -51,13 +52,26 @@ gen_key() { USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} - echo "key parameters:" - cat < "$msAuthorizedKeys" - echo "done." - else - log "no gpg keys to add." - fi + # set user-controlled authorized_keys file path if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then userHome=$(getent passwd "$uname" | cut -d: -f6) userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$userHome"} - if [ -s "$userAuthorizedKeys" ] ; then - log -n "adding user authorized_keys file... " - cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" - echo "done." - fi fi - log "monkeysphere authorized_keys file generated:" - log "$msAuthorizedKeys" + + # update authorized_keys + update_authorized_keys "$cacheDir" "$msAuthorizedKeys" "$userAuthorizedKeys" done + log "----- done. -----" ;; 'gen-key'|'g') @@ -176,7 +178,7 @@ case $COMMAND in publish_key ;; - 'trust-key'|'t') + 'trust-keys'|'t') if [ -z "$1" ] ; then failure "you must specify at least one key to trust." fi -- cgit v1.2.3 From b489d119fc6c61e43c88efffb2ba4705ac4aeca8 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 11 Jun 2008 12:00:36 -0400 Subject: Fill out a little of the man pages. --- man/man1/monkeysphere.1 | 76 ++++++++++++++++++++++++++++++++++++++++++ man/man8/monkeysphere-server.8 | 54 ++++++++++++++++++++++++++++++ 2 files changed, 130 insertions(+) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index 4c3d483..fff16ba 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -4,3 +4,79 @@ monkeysphere \- monkeysphere client user interface .SH SYNOPSIS .B monkeysphere \fIcommand\fP [\fIargs\fP] .SH DESCRIPTION +.PP +\fBmonkeysphere\fP is the client monkeysphere tool. +.SH SUBCOMMANDS +\fBmonkeysphere\fP takes various subcommands: +.PD +.TP +.B update-known_hosts [HOST]... +Update the known_hosts file. For every host listed, search for a gpg +key for the host in the Web of Trust. If a key is found, any ssh keys +for the host are removed from the known_hosts file. If the found key +is acceptable (see KEY ACCEPTABILITY), then the gpg key is converted +to an ssh key and added to the known_hosts file. If now gpg key is +found for the host, then nothing is done. If no hosts are specified, +all hosts listed in the known_hosts file will be processed. If they +`k' may be used in place of `update-known_hosts'. +.TP +.B update-authorized_keys +Update the authorized_keys file. +.TP +.B update-userids [USERID]... +Update userid +.TP +.B gen-ae-subkey KEYID +Generate an `ae` capable subkey +.TP +.B help +Output a brief usage summary. `h' or `?' may be used in place of +`help'. +.PD +.SH KEY ACCEPTABILITY +GPG keys are considered acceptable if the following criteria are met: +.PD +.TP +.B capability +The key must have both the "authentication" and "encrypt" capability +flags. +.TP +.B validity +The key must be "fully" valid, and must not be expired or revoked. +.PD +.SH FILES +.PD 1 +.TP +~/.config/monkeysphere/monkeysphere.conf +User monkeysphere config file. +.TP +/etc/monkeysphere/monkeysphere.conf +System-wide monkeysphere config file. +.TP +~/.config/monkeysphere/authorized_user_ids +GPG user IDs to validate for addition to the authorized_keys file. +.TP +~/.config/monkeysphere/authorized_keys +Monkeysphere generated authorized_keys file. +.TP +~/.config/monkeysphere/user_keys +User keys cache directory. +.TP +~/.config/monkeysphere/host_keys +Host keys cache directory. +.PD +.SH AUTHOR +Written by Jameson Rollins +.SH "REPORTING BUGS" +Report bugs to . +.SH COPYRIGHT +Copyright \(co 2008 Jameson Graef Rollins and Daniel Kahn Gillmor +.br +This is free software. You may redistribute copies of it under the +terms of the GNU General Public License +. There is NO WARRANTY, to the +extent permitted by law. +.SH "SEE ALSO" +.BR ssh (1), +.BR gpg (1), +.BR monkeysphere-server (8) diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index 302bffb..39a8e5c 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -4,3 +4,57 @@ monkeysphere-server \- monkeysphere server admin user interface .SH SYNOPSIS .B monkeysphere-server \fIcommand\fP [\fIargs\fP] .SH DESCRIPTION +.PP +\fBmonkeysphere-server\fP is the server admin monkeysphere tool. +.SH SUBCOMMANDS +\fBmonkeysphere-server\fP takes various subcommands: +.PD +.TP +.B update-users [HOST]... +.TP +.B gen-key +.TP +.B publish-key +.TP +.B trust-keys KEYID... +.TP +.B update-user-userids USER USERID... +.TP +.B help +Output a brief usage summary. `h' or `?' may be used in place of +`help'. +.PD +.SH FILES +.PD 1 +.TP +/etc/monkeysphere/monkeysphere-server.conf +System monkeysphere-server config file. +.TP +/etc/monkeysphere/monkeysphere.conf +System-wide monkeysphere config file. +.TP +/etc/monkeysphere/gnupg +Monkeysphere GNUPG home directory. +.TP +/etc/monkeysphere/authorized_user_ids/USER +Server maintained authorized_user_ids files for users. +.TP +/var/lib/monkeysphere/stage/USER +Staging directory for user key caches. +.PD +.SH AUTHOR +Written by Jameson Rollins +.SH "REPORTING BUGS" +Report bugs to . +.SH COPYRIGHT +Copyright \(co 2008 Jameson Graef Rollins and Daniel Kahn Gillmor +.br +This is free software. You may redistribute copies of it under the +terms of the GNU General Public License +. There is NO WARRANTY, to the +extent permitted by law. +.SH "SEE ALSO" +.BR monkeysphere (1), +.BR gpg (1), +.BR ssh (1) + -- cgit v1.2.3 From 3250fce7979ada7e94782430801f5fb76fecbc90 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 11 Jun 2008 14:08:29 -0400 Subject: Updates to use the new openpgp2ssh program that dkg wrote. --- man/man8/monkeysphere-server.8 | 1 - src/common | 55 +++++++++++++++++++++++++++--------------- src/monkeysphere-server | 4 ++- 3 files changed, 38 insertions(+), 22 deletions(-) diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index 39a8e5c..7a12e17 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -57,4 +57,3 @@ extent permitted by law. .BR monkeysphere (1), .BR gpg (1), .BR ssh (1) - diff --git a/src/common b/src/common index ff6ba59..d7caefd 100755 --- a/src/common +++ b/src/common @@ -82,27 +82,36 @@ unescape() { echo "$1" | sed 's/\\x3a/:/' } -# stand in until we get dkg's gpg2ssh program -gpg2ssh_tmp() { +# convert key from gpg to ssh known_hosts format +gpg2known_hosts() { local keyID - local userID local host keyID="$1" - userID="$2" - - if [ "$MODE" = 'authorized_keys' ] ; then - gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere userID: ${userID}/" + host=$(echo "$2" | sed -e "s|ssh://||") # NOTE: it seems that ssh-keygen -R removes all comment fields from # all lines in the known_hosts file. why? # NOTE: just in case, the COMMENT can be matched with the # following regexp: # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' - elif [ "$MODE" = 'known_hosts' ] ; then - host=$(echo "$userID" | sed -e "s|ssh://||") - echo -n "$host "; gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere${DATE}/" - fi + echo -n "$host " + gpg --export "$keyID" | \ + openpgp2ssh "$keyID" | tr -d '\n' + echo "MonkeySphere${DATE}" +} + +# convert key from gpg to ssh authorized_keys format +gpg2authorized_keys() { + local keyID + local userID + + keyID="$1" + userID="$2" + + echo -n "MonkeySphere${DATE}:${userID}" + gpg --export "$keyID" | \ + openpgp2ssh "$keyID" } # userid and key policy checking @@ -235,15 +244,21 @@ process_user_id() { for keyID in ${keyIDs[@]} ; do loge " acceptable key/uid found." - # export the key with gpg2ssh - # FIXME: needs to apply extra options for authorized_keys - # lines if specified - gpg2ssh_tmp "$keyID" "$userID" >> "$cacheDir"/"$userIDHash"."$pubKeyID" - - # hash the cache file if specified - if [ "$MODE" = 'known_hosts' -a "$HASH_KNOWN_HOSTS" ] ; then - ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 - rm "$cacheDir"/"$userIDHash"."$pubKeyID".old + if [ "$MODE" = 'known_hosts' ] ; then + # export the key + gpg2known_hosts "$keyID" "$userID" >> \ + "$cacheDir"/"$userIDHash"."$pubKeyID" + # hash the cache file if specified + if [ "$HASH_KNOWN_HOSTS" ] ; then + ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 + rm "$cacheDir"/"$userIDHash"."$pubKeyID".old + fi + elif [ "$MODE" = 'authorized_keys' ] ; then + # export the key + # FIXME: needs to apply extra options for authorized_keys + # lines if specified + gpg2authorized_keys "$keyID" "$userID" >> \ + "$cacheDir"/"$userIDHash"."$pubKeyID" fi done fi diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 6eeb702..34239b6 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -145,9 +145,10 @@ case $COMMAND in fi for uname in $unames ; do + MODE="authorized_keys" + log "----- user: $uname -----" - MODE="authorized_keys" AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" cacheDir="$STAGING_AREA"/"$uname"/user_keys msAuthorizedKeys="$STAGING_AREA"/"$uname"/authorized_keys @@ -167,6 +168,7 @@ case $COMMAND in # update authorized_keys update_authorized_keys "$cacheDir" "$msAuthorizedKeys" "$userAuthorizedKeys" done + log "----- done. -----" ;; -- cgit v1.2.3 From cfa7c2e402991ebcb41502169ba85d9c1874d7d2 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 11 Jun 2008 15:17:54 -0400 Subject: update README --- doc/README | 73 +++++++++++++++++++++----------------------------------------- 1 file changed, 25 insertions(+), 48 deletions(-) diff --git a/doc/README b/doc/README index d8f1897..427f214 100644 --- a/doc/README +++ b/doc/README @@ -1,36 +1,22 @@ Monkeysphere README =================== -Default files locations (by variable): - -MS_HOME=~/.config/monkeysphere -MS_CONF=$MS_HOME/monkeysphere.conf -AUTH_HOST_FILE=$MS_HOME/auth_host_ids -AUTH_USER_FILE=$MS_HOME/auth_user_ids -GNUPGHOME=~/.gnupg -STAGING_AREA=$MS_HOME - -$STAGING_AREA/host_keys/KEYHASH -$STAGING_AREA/known_hosts -$STAGING_AREA/user_keys/KEYHASH -$STAGING_AREA/authorized_keys - user usage ---------- -For a user to update their ms known_hosts file: +For a user to update their known_hosts file: -$ rhesus --known_hosts +$ monkeysphere update-known_hosts -For a user to update their ms authorized_keys file: +For a user to update their monkeysphere authorized_keys file: -$ rhesus --authorized_keys +$ monkeysphere update-authorized_keys server service publication -------------------------- -To publish a server host key use the "howler" component: +To publish a server host key: -# howler gen-key -# howler publish-key +# monkeysphere-server gen-key +# monkeysphere-server publish-key This will generate the key for server with the service URI (ssh://server.hostname). The server admin should now sign the server @@ -42,38 +28,29 @@ $ gpg --sign-key 'ssh://server.hostname' server authorized_keys maintenance ---------------------------------- -A system can maintain ms authorized_keys files for it's users. Some -different variables need to be defined to help manage this. The way -this is done is by first defining a new MS_HOME: +A system can maintain monkeysphere authorized_keys files for it's +users. -MS_HOME=/etc/monkeysphere - -This directory would then have a monkeysphere.conf which defines the -following variables: +For each user account on the server, the userids of people authorized +to log into that account would be placed in: -AUTH_USER_FILE="$MS_HOME"/auth_user_ids/"$USER" -STAGING_AREA=/var/lib/monkeysphere/stage/$USER -GNUPGHOME=$MS_HOME/gnupg +/etc/monkeysphere/authorized_user_file/USER -For each user account on the server, the userids of people authorized -to log into that account would be placed in the AUTH_USER_FILE for -that user. However, in order for users to become authenticated, the -server must determine that the user keys have "full" validity. This -means that the server must fully trust at least one person whose -signature on the connecting users key would validate the user. This -would generally be the server admin. If the server admin's keyid is -XXXXXXXX, then on the server run: +However, in order for users to become authenticated, the server must +determine that the user keys have "full" validity. This means that +the server must fully trust at least one person whose signature on the +connecting users key would validate the user. This would generally be +the server admin. If the server admin's keyid is XXXXXXXX, then on +the server run: -# howler trust-key XXXXXXXX +# monkeysphere-server trust-keys XXXXXXXX -To update the ms authorized_keys file for user "bob", the system would -then run the following: +To update the monkeysphere authorized_keys file for user "bob", the +system would then run the following: -# USER=bob MS_HOME=/etc/monkeysphere rhesus --authorized_keys +# monkeysphere-server update-users bob -To update the ms authorized_keys file for all users on the the system: +To update the monkeysphere authorized_keys file for all users on the +the system, run the same command with no arguments: -MS_HOME=/etc/monkeysphere -for USER in $(ls -1 /etc/monkeysphere/auth_user_ids) ; do - rhesus --authorized_keys -done +# monkeysphere-server update-users bob -- cgit v1.2.3 From b676fea4a45dce7ccd8049ca27e7a5612b343d28 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 11 Jun 2008 15:50:08 -0400 Subject: removing old rhesus and howler components as they have been made defunct by the new monkeysphere and monkeysphere-server tools (I probably could have figured out a way to transition from them smoother, but I didn't. oh well.). --- src/howler/howler | 134 ---------------- src/rhesus/README | 30 ---- src/rhesus/rhesus | 466 ------------------------------------------------------ 3 files changed, 630 deletions(-) delete mode 100755 src/howler/howler delete mode 100644 src/rhesus/README delete mode 100755 src/rhesus/rhesus diff --git a/src/howler/howler b/src/howler/howler deleted file mode 100755 index 0b67c02..0000000 --- a/src/howler/howler +++ /dev/null @@ -1,134 +0,0 @@ -#!/bin/sh - -# howler: monkeysphere server gpg generator/publisher/maintainer -# -# Written by -# Jameson Rollins -# -# Copyright 2008, released under the GPL, version 3 or later - -PGRM=$(basename $0) - -######################################################################## -# FUNCTIONS -######################################################################## - -usage() { -cat <&2 - exit ${2:-'1'} -} - -# generate server gpg key -gen_key() { - KEY_TYPE=${KEY_TYPE:-RSA} - KEY_LENGTH=${KEY_LENGTH:-2048} - KEY_USAGE=${KEY_USAGE:-encrypt,auth} - SERVICE=${SERVICE:-ssh} - HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} - - USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} - - echo "key parameters:" - cat < /dev/null 2>&1 ; then - failure "key for '$USERID' already exists" - fi - - echo "generating server key..." - gpg --batch --gen-key < /dev/null | grep '^pub:' | cut -d: -f5) - - # dummy command so as not to publish fakes keys during testing - # eventually: - #gpg --send-keys --keyserver "$KEYSERVER" "$keyID" - echo "gpg --send-keys --keyserver $KEYSERVER $keyID" -} - -trust_key() { - for keyID ; do - # get the key from the key server - gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" - - # edit the key to change trust - # FIXME: need to figure out how to automate this, - # in a batch mode or something. - gpg --edit-key "$keyID" - done -} - -######################################################################## -# MAIN -######################################################################## - -# set ms home directory -MS_HOME=${MS_HOME:-/etc/monkeysphere} - -# load configuration file -MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} -[ -e "$MS_CONF" ] && . "$MS_CONF" - -GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} -export GNUPGHOME -KEYSERVER=${KEYSERVER:-subkeys.pgp.net} -export KEYSERVER - -COMMAND="$1" -[ "$COMMAND" ] || failure "Type '$PGRM help' for usage." -shift 1 - -case $COMMAND in - 'gen-key') - gen_key - ;; - 'publish-key') - publish_key - ;; - 'trust-key') - if [ -z "$1" ] ; then - failure "you must specify at least one key to trust." - fi - trust_key "$@" - ;; - 'help') - usage - exit - ;; - *) - failure "Unknown command: '$COMMAND' -Type '$PGRM help' for usage." - ;; -esac diff --git a/src/rhesus/README b/src/rhesus/README deleted file mode 100644 index 4d383d5..0000000 --- a/src/rhesus/README +++ /dev/null @@ -1,30 +0,0 @@ -rhesus is the monkeysphere authorized_keys/known_hosts generator. - -In authorized_keys mode, rhesus takes an auth_user_ids file, which -contains gpg user ids, uses gpg to fetch the keys of the specified -users, does a monkeysphere policy check on each id, and uses gpg2ssh -to generate authorized_keys lines for each verified id. The lines are -then combined with a user's traditional authorized_keys file to create -a new authorized_keys file. - -In known_hosts mode, rhesus takes an auth_host_ids file, which -contains gpg user ids of the form ssh://URL, uses gpg to fetch the -keys of the specified hosts, does a monkeysphere policy check on each -id, and uses gpg2ssh to generate a known_hosts lines for each verified -id. The lines are then combined with a user's traditional known_hosts -file to create a new known_hosts file. - -When run as a normal user, no special configuration is needed. - -When run as an administrator to update system-maintained -authorized_keys files for each user, the following environment -variables should be defined first: - - MS_CONF=/etc/monkeysphere/monkeysphere.conf - USER=foo - -For example, the command might be run like this: - - for USER in $(ls -1 /home) ; do - MS_CONF=/etc/monkeysphere/monkeysphere.conf rhesus --authorized_keys - done diff --git a/src/rhesus/rhesus b/src/rhesus/rhesus deleted file mode 100755 index f607f0b..0000000 --- a/src/rhesus/rhesus +++ /dev/null @@ -1,466 +0,0 @@ -#!/bin/sh - -# rhesus: monkeysphere authorized_keys/known_hosts generating script -# -# Written by -# Jameson Rollins -# -# Copyright 2008, released under the GPL, version 3 or later - -# all caps variables are meant to be user supplied (ie. from config -# file) and are considered global - -PGRM=$(basename $0) - -# date in UTF format if needed -DATE=$(date -u '+%FT%T') - -# unset some environment variables that could screw things up -GREP_OPTIONS= - -######################################################################## -# FUNCTIONS -######################################################################## - -usage() { -cat <&2 - exit ${2:-'1'} -} - -# write output to stdout -log() { - echo -n "ms: " - echo "$@" -} - -# write output to stderr -loge() { - echo -n "ms: " 1>&2 - echo "$@" 1>&2 -} - -# cut out all comments(#) and blank lines from standard input -meat() { - grep -v -e "^[[:space:]]*#" -e '^$' -} - -# cut a specified line from standard input -cutline() { - head --line="$1" | tail -1 -} - -# retrieve all keys with given user id from keyserver -# FIXME: need to figure out how to retrieve all matching keys -# (not just first 5) -gpg_fetch_keys() { - local id - id="$1" - echo 1,2,3,4,5 | \ - gpg --quiet --batch --command-fd 0 --with-colons \ - --keyserver "$KEYSERVER" \ - --search ="$id" >/dev/null 2>&1 -} - -# check that characters are in a string (in an AND fashion). -# used for checking key capability -# check_capability capability a [b...] -check_capability() { - local capability - local capcheck - - capability="$1" - shift 1 - - for capcheck ; do - if echo "$capability" | grep -q -v "$capcheck" ; then - return 1 - fi - done - return 0 -} - -# convert escaped characters from gpg output back into original -# character -# FIXME: undo all escape character translation in with-colons gpg output -unescape() { - echo "$1" | sed 's/\\x3a/:/' -} - -# stand in until we get dkg's gpg2ssh program -gpg2ssh_tmp() { - local mode - local keyID - local userID - local host - - mode="$1" - keyID="$2" - userID="$3" - - if [ "$mode" = 'authorized_keys' ] ; then - gpgkey2ssh "$keyID" | sed -e "s/COMMENT/${userID}/" - - # NOTE: it seems that ssh-keygen -R removes all comment fields from - # all lines in the known_hosts file. why? - # NOTE: just in case, the COMMENT can be matched with the - # following regexp: - # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' - elif [ "$mode" = 'known_hosts' ] ; then - host=$(echo "$userID" | sed -e "s|ssh://||") - echo -n "$host "; gpgkey2ssh "$keyID" | sed -e "s/COMMENT/MonkeySphere${DATE}/" - fi -} - -# userid and key policy checking -# the following checks policy on the returned keys -# - checks that full key has appropriate valididy (u|f) -# - checks key has specified capability (REQUIRED_KEY_CAPABILITY) -# - checks that particular desired user id has appropriate validity -# see /usr/share/doc/gnupg/DETAILS.gz -# expects global variable: "mode" -process_user_id() { - local userID - local cacheDir - local requiredPubCapability - local gpgOut - local line - local type - local validity - local keyid - local uidfpr - local capability - local keyOK - local pubKeyID - local uidOK - local keyIDs - local userIDHash - local keyID - - userID="$1" - cacheDir="$2" - - requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") - - # fetch keys from keyserver, return 1 if none found - gpg_fetch_keys "$userID" || return 1 - - # output gpg info for (exact) userid and store - gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ - ="$userID" 2> /dev/null) - - # return 1 if there only "tru" lines are output from gpg - if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - return 1 - fi - - # loop over all lines in the gpg output and process. - # need to do it this way (as opposed to "while read...") so that - # variables set in loop will be visible outside of loop - for line in $(seq 1 $(echo "$gpgOut" | wc -l)) ; do - - # read the contents of the line - type=$(echo "$gpgOut" | cutline "$line" | cut -d: -f1) - validity=$(echo "$gpgOut" | cutline "$line" | cut -d: -f2) - keyid=$(echo "$gpgOut" | cutline "$line" | cut -d: -f5) - uidfpr=$(echo "$gpgOut" | cutline "$line" | cut -d: -f10) - capability=$(echo "$gpgOut" | cutline "$line" | cut -d: -f12) - - # process based on record type - case $type in - 'pub') # primary keys - # new key, wipe the slate - keyOK= - pubKeyID= - uidOK= - keyIDs= - - pubKeyID="$keyid" - - # check primary key validity - if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then - loge " unacceptable primary key validity ($validity)." - continue - fi - # check capability is not Disabled... - if check_capability "$capability" 'D' ; then - loge " key disabled." - continue - fi - # check overall key capability - # must be Encryption and Authentication - if ! check_capability "$capability" $requiredPubCapability ; then - loge " unacceptable primary key capability ($capability)." - continue - fi - - # mark if primary key is acceptable - keyOK=true - - # add primary key ID to key list if it has required capability - if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then - keyIDs[${#keyIDs[*]}]="$keyid" - fi - ;; - 'uid') # user ids - # check key ok and we have key fingerprint - if [ -z "$keyOK" ] ; then - continue - fi - # check key validity - if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then - continue - fi - # check the uid matches - if [ "$(unescape "$uidfpr")" != "$userID" ] ; then - continue - fi - - # mark if uid acceptable - uidOK=true - ;; - 'sub') # sub keys - # add sub key ID to key list if it has required capability - if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then - keyIDs[${#keyIDs[*]}]="$keyid" - fi - ;; - esac - done - - # hash userid for cache file name - userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') - - # touch/clear key cache file - # (will be left empty if there are noacceptable keys) - > "$cacheDir"/"$userIDHash"."$pubKeyID" - - # for each acceptable key, write an ssh key line to the - # key cache file - if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then - for keyID in ${keyIDs[@]} ; do - # export the key with gpg2ssh - # FIXME: needs to apply extra options for authorized_keys - # lines if specified - gpg2ssh_tmp "$mode" "$keyID" "$userID" >> "$cacheDir"/"$userIDHash"."$pubKeyID" - - # hash the cache file if specified - if [ "$mode" = 'known_hosts' -a "$HASH_KNOWN_HOSTS" ] ; then - ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 - rm "$cacheDir"/"$userIDHash"."$pubKeyID".old - fi - done - fi - - # echo the path to the key cache file - echo "$cacheDir"/"$userIDHash"."$pubKeyID" -} - -# process a host for addition to a known_host file -process_host() { - local host - local cacheDir - local hostKeyCachePath - - host="$1" - cacheDir="$2" - - log "processing host: '$host'" - - hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") - if [ $? = 0 ] ; then - ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS" - cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS" - fi -} - -# process known_hosts file -# go through line-by-line, extract each host, and process with the -# host processing function -process_known_hosts() { - local cacheDir - local userID - - cacheDir="$1" - - # take all the hosts from the known_hosts file (first field), - # grep out all the hashed hosts (lines starting with '|') - cut -d ' ' -f 1 "$USER_KNOWN_HOSTS" | \ - grep -v '^|.*$' | \ - while IFS=, read -r -a hosts ; do - # process each host - for host in ${hosts[*]} ; do - process_host "$host" "$cacheDir" - done - done -} - -# process an authorized_*_ids file -# go through line-by-line, extract each userid, and process -process_authorized_ids() { - local authorizedIDsFile - local cacheDir - local userID - local userKeyCachePath - - authorizedIDsFile="$1" - cacheDir="$2" - - # clean out keys file and remake keys directory - rm -rf "$cacheDir" - mkdir -p "$cacheDir" - - # loop through all user ids in file - # FIXME: needs to handle extra options if necessary - cat "$authorizedIDsFile" | meat | \ - while read -r userID ; do - # process the userid - log "processing userid: '$userID'" - userKeyCachePath=$(process_user_id "$userID" "$cacheDir") - if [ -s "$userKeyCachePath" ] ; then - loge " acceptable key/uid found." - fi - done -} - -######################################################################## -# MAIN -######################################################################## - -if [ -z "$1" ] ; then - usage - exit 1 -fi - -# mode given in first variable -mode="$1" -shift 1 - -# check user -if ! id -u "$USER" > /dev/null 2>&1 ; then - failure "invalid user '$USER'." -fi - -# set user home directory -HOME=$(getent passwd "$USER" | cut -d: -f6) - -# set ms home directory -MS_HOME=${MS_HOME:-"$HOME"/.config/monkeysphere} - -# load configuration file -MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} -[ -e "$MS_CONF" ] && . "$MS_CONF" - -# set config variable defaults -STAGING_AREA=${STAGING_AREA:-"$MS_HOME"} -AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids} -GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg} -KEYSERVER=${KEYSERVER:-subkeys.pgp.net} -REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} -USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"$HOME"/.ssh/authorized_keys} -USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts} -HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-} - -# export USER and GNUPGHOME variables, since they are used by gpg -export USER -export GNUPGHOME - -# stagging locations -hostKeysCacheDir="$STAGING_AREA"/host_keys -userKeysCacheDir="$STAGING_AREA"/user_keys -msKnownHosts="$STAGING_AREA"/known_hosts -msAuthorizedKeys="$STAGING_AREA"/authorized_keys - -# make sure gpg home exists with proper permissions -mkdir -p -m 0700 "$GNUPGHOME" - -## KNOWN_HOST MODE -if [ "$mode" = 'known_hosts' -o "$mode" = 'k' ] ; then - mode='known_hosts' - - cacheDir="$hostKeysCacheDir" - - log "user '$USER': monkeysphere known_hosts processing" - - # touch the known_hosts file to make sure it exists - touch "$USER_KNOWN_HOSTS" - - # if hosts are specified on the command line, process just - # those hosts - if [ "$1" ] ; then - for host ; do - process_host "$host" "$cacheDir" - done - - # otherwise, if no hosts are specified, process the user - # known_hosts file - else - if [ ! -s "$USER_KNOWN_HOSTS" ] ; then - failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." - fi - process_known_hosts "$cacheDir" - fi - -## AUTHORIZED_KEYS MODE -elif [ "$mode" = 'authorized_keys' -o "$mode" = 'a' ] ; then - mode='authorized_keys' - - cacheDir="$userKeysCacheDir" - - # check auth ids file - if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - log "authorized_user_ids file is empty or does not exist." - exit - fi - - log "user '$USER': monkeysphere authorized_keys processing" - - # if userids are specified on the command line, process just - # those userids - if [ "$1" ] ; then - for userID ; do - if ! grep -q "$userID" "$AUTHORIZED_USER_IDS" ; then - log "userid '$userID' not in authorized_user_ids file." - continue - fi - log "processing user id: '$userID'" - process_user_id "$userID" "$cacheDir" > /dev/null - done - - # otherwise, if no userids are specified, process the entire - # authorized_user_ids file - else - process_authorized_ids "$AUTHORIZED_USER_IDS" "$cacheDir" - fi - - # write output key file - log "writing monkeysphere authorized_keys file... " - touch "$msAuthorizedKeys" - if [ "$(ls "$cacheDir")" ] ; then - log -n "adding gpg keys... " - cat "$cacheDir"/* > "$msAuthorizedKeys" - echo "done." - else - log "no gpg keys to add." - fi - if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then - if [ -s "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then - log -n "adding user authorized_keys file... " - cat "$USER_CONTROLLED_AUTHORIZED_KEYS" >> "$msAuthorizedKeys" - echo "done." - fi - fi - log "monkeysphere authorized_keys file generated:" - log "$msAuthorizedKeys" - -else - failure "unknown command '$mode'." -fi -- cgit v1.2.3 From dd932542baaca0758856959d5775216e7b6010b0 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 11 Jun 2008 16:00:50 -0400 Subject: add COPYING file --- COPYING | 694 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 694 insertions(+) create mode 100644 COPYING diff --git a/COPYING b/COPYING new file mode 100644 index 0000000..ab8788d --- /dev/null +++ b/COPYING @@ -0,0 +1,694 @@ +MonkeySphere is a system to use the OpenPGP web-of-trust to +authenticate and encrypt ssh connections. + +It is free software, written by: + Jameson Rollins + Daniel Kahn Gillmor +with much help from: + Jamie McClelland + Micah Anderson + Matthew Goins + +MonkeySphere is distributed in the hope that it will be useful, but +WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +MonkeySphere Copyright 2007, and are all released under the GPL, +version 3 or later. + + + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. -- cgit v1.2.3 From c1affebb2e24c129a4baec24d0627abd1ac0b977 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Wed, 11 Jun 2008 16:04:15 -0400 Subject: fix typo in monkeysphere(1) --- man/man1/monkeysphere.1 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index fff16ba..f9a6af4 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -15,9 +15,10 @@ Update the known_hosts file. For every host listed, search for a gpg key for the host in the Web of Trust. If a key is found, any ssh keys for the host are removed from the known_hosts file. If the found key is acceptable (see KEY ACCEPTABILITY), then the gpg key is converted -to an ssh key and added to the known_hosts file. If now gpg key is +to an ssh key and added to the known_hosts file. If no gpg key is found for the host, then nothing is done. If no hosts are specified, all hosts listed in the known_hosts file will be processed. If they + `k' may be used in place of `update-known_hosts'. .TP .B update-authorized_keys -- cgit v1.2.3 From 8dd86c4d70611a65e8a23ae3f6fa155e8c272be9 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 11 Jun 2008 17:05:26 -0400 Subject: quote some strings to not confuse checkbashisms --- src/monkeysphere | 6 +++--- src/monkeysphere-server | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/monkeysphere b/src/monkeysphere index c417625..aaeda11 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -54,9 +54,9 @@ gen_ae_subkey(){ keyID="$1" # set subkey defaults - SUBKEY_TYPE=${KEY_TYPE:-RSA} - SUBKEY_LENGTH=${KEY_LENGTH:-1024} - SUBKEY_USAGE=${KEY_USAGE:-encrypt,auth} + SUBKEY_TYPE=${KEY_TYPE:-"RSA"} + SUBKEY_LENGTH=${KEY_LENGTH:-"1024"} + SUBKEY_USAGE=${KEY_USAGE:-"encrypt,auth"} gpgOut=$(gpg --fixed-list-mode --list-keys --with-colons \ "$keyID" 2> /dev/null) diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 34239b6..a109cf5 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -44,10 +44,10 @@ EOF # generate server gpg key gen_key() { # set key defaults - KEY_TYPE=${KEY_TYPE:-RSA} - KEY_LENGTH=${KEY_LENGTH:-2048} - KEY_USAGE=${KEY_USAGE:-encrypt,auth} - SERVICE=${SERVICE:-ssh} + KEY_TYPE=${KEY_TYPE:-"RSA"} + KEY_LENGTH=${KEY_LENGTH:-"2048"} + KEY_USAGE=${KEY_USAGE:-"encrypt,auth"} + SERVICE=${SERVICE:-"ssh"} HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} -- cgit v1.2.3 From 10100ce2910a95940540cb61d9b995b1e0deef5a Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Wed, 11 Jun 2008 17:08:43 -0400 Subject: first pass at openpgp2ssh man page. --- man/man1/openpgp2ssh.1 | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 man/man1/openpgp2ssh.1 diff --git a/man/man1/openpgp2ssh.1 b/man/man1/openpgp2ssh.1 new file mode 100644 index 0000000..cd79b6c --- /dev/null +++ b/man/man1/openpgp2ssh.1 @@ -0,0 +1,65 @@ +.\" -*- nroff -*- +.Dd $Mdocdate: June 11, 2008 $ +.Dt OPENPGP2SSH 1 +.Os +.Sh NAME +openpgp2ssh +.Nd translate OpenPGP keys to SSH keys +.Sh SYNOPSIS +.Nm openpgp2ssh < mykey.gpg + +.Nm gpg --export $KEYID | openpgp2ssh $KEYID + +.Nm gpg --export-secret-key $KEYID | openpgp2ssh $KEYID +.Sh DESCRIPTION +openpgp2ssh takes OpenPGP-formatted RSA and DSA keys on standard +input, and spits out the requested equivalent SSH-style key on +standard output. + +If the data on standard input contains only a single key, you can +invoke openpgp2ssh without arguments. If the data on standard input +contains multiple keys (e.g. a primary key and associated subkeys), +you must specify a specific OpenPGP keyid (e.g. CCD2ED94D21739E9) or +fingerprint as the first argument to indicate which key to export. +The keyid must be at least 8 hex characters. + +If the input contains an OpenPGP RSA or DSA public key, it will be +converted to the OpenSSH-style single-line keystring, prefixed with +the key type. This format is suitable (with minor alterations) for +insertion into known_hosts files and authorized_keys files. + +If the input contains an OpenPGP RSA or DSA secret key, it will be +converted to the equivalent PEM-encoded private key. + +Note that the output keys from this process are stripped of all +identifying information, including certifications, self-signatures, +etc. + +openpgp2ssh is part of the +.Xr monkeysphere 1 +framework for providing a PKI for SSH. +.Sh EXAMPLES +.Nm gpg --export-secret-key $KEYID | openpgp2ssh $KEYID | ssh-add -c /dev/stdin + +This pushes the secret key into the active +.Xr ssh-agent 1 . +Tools (such as +.Xr ssh 1 ) +which know how to talk to the +.Xr ssh-agent 1 +can now rely on the key. +.Sh AUTHOR +openpgp2ssh and this man page were written by Daniel Kahn Gillmor +. +.Sh BUGS +openpgp2ssh currently only exports into formats used by the OpenSSH. +It should support other key output formats, such as those used by +lsh(1) and putty(1). + +Secret key output is currently not passphrase-protected. + +This program is not yet implemented, and this man page currently only +describes expected functionality. +.Sh SEE ALSO +.Xr monkeysphere 1 , +.Xr monkeysphere-admin 8 -- cgit v1.2.3 From 1caaa3fef8c8256cbf9b867f5d4b947eacd63535 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 11 Jun 2008 17:31:12 -0400 Subject: some very small tweaks to the openpgp2ssh man page --- man/man1/openpgp2ssh.1 | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/man/man1/openpgp2ssh.1 b/man/man1/openpgp2ssh.1 index cd79b6c..27bcb15 100644 --- a/man/man1/openpgp2ssh.1 +++ b/man/man1/openpgp2ssh.1 @@ -31,7 +31,7 @@ insertion into known_hosts files and authorized_keys files. If the input contains an OpenPGP RSA or DSA secret key, it will be converted to the equivalent PEM-encoded private key. -Note that the output keys from this process are stripped of all +Note that the keys output from this process are stripped of all identifying information, including certifications, self-signatures, etc. @@ -61,5 +61,6 @@ Secret key output is currently not passphrase-protected. This program is not yet implemented, and this man page currently only describes expected functionality. .Sh SEE ALSO -.Xr monkeysphere 1 , -.Xr monkeysphere-admin 8 +.Xr monkeysphere 1 , +.Xr ssh 1 , +.Xr monkeysphere-server 8 -- cgit v1.2.3 From 85dc0c4c46d3367642e4ce547faaadbaf8315f5c Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Mon, 26 May 2008 23:36:06 -0400 Subject: fixing spelling, fqdns in MonkeySpec examples --- doc/MonkeySpec | 55 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 26 deletions(-) diff --git a/doc/MonkeySpec b/doc/MonkeySpec index 3b565db..b0a0d6a 100644 --- a/doc/MonkeySpec +++ b/doc/MonkeySpec @@ -61,40 +61,42 @@ USE CASE Dramatis Personae: http://en.wikipedia.org/wiki/Alice_and_Bob Backstory: http://www.conceptlabs.co.uk/alicebob.html -Bob wants to sign on to the computer "mangabey" via monkeysphere -framework. He doesn't yet have access to the machine, but he knows -Alice, who is the admin of magabey. Alice and Bob, being the -contientious netizens that they are, have already published their +Bob wants to sign on to the computer "mangabey.example.org" via +monkeysphere framework. He doesn't yet have access to the machine, +but he knows Alice, who is the admin of magabey. Alice and Bob, being +the conscientious netizens that they are, have already published their personal gpg keys to the web of trust, and being good friends, have both signed each other's keys and marked each others keys with "full" trust. Alice uses howler to publish a gpg key for magabey with the special -"ssh://magabey" URI userid. Alice signs magabey's gpg key and -publishes her signature. Alice then creates a user "bob" on magabey, -and puts Bob's userid in the auth_user_ids file for user bob on -magabey. tamarin triggers on magabey, which triggers rhesus, which -takes all userids in bob's auth_user_ids file, look on a keyserver to -find the public keys for each user, converts the gpg public keys into -ssh public keys if the key validity is acceptable, and finally insert -those keys into an authorized_keys file for bob. - -Bob now adds the "ssh://magabey" userid to the auth_host_ids file in -his account on his localhost. Bob now goes to connect to bob@magabey. -Bob's ssh client, which is monkeysphere enabled, triggers marmoset, -which triggers rhesus on Bob's computer, which takes all server -userids in his auth_host_ids file, looks on a keyserver to find the -public key for each server (based on the server's URI), converts the -gpg public keys into ssh public keys if the key validity is -acceptable, and finally insert those keys into Bob's known_hosts file. +userid of "ssh://mangabey.example.org". Alice signs mangabey's gpg +key and publishes this signature as a certification. Alice then +creates a user "bob" on mangabey, and puts Bob's userid in the +auth_user_ids file for user bob on magabey. tamarin triggers on +mangabey, which invokes rhesus. rhesus takes all userids in bob's +auth_user_ids file, looks on a keyserver to find the public keys for +each user, converts the gpg public keys into ssh public keys if the +key validity is acceptable, and finally inserts those keys into an +authorized_keys file for bob. + +Bob now adds the "ssh://mangabey.example.org" userid to the +auth_host_ids file in his account on his localhost. Bob now goes to +connect to bob@mangabey.example.org. Bob's monkeysphere-enabled ssh +client triggers marmoset, which invokes rhesus on Bob's computer. +rhesus takes all server userids in his auth_host_ids file, looks on a +keyserver to find the public key for each server (based on the +server's URI), converts the gpg public keys into ssh public keys if +the key validity is acceptable, and finally insert those keys into +Bob's known_hosts file. On Bob's side, since mangabey's key had "full" validity (since it was -signed by Alice whom he fully trusts), Bob's ssh client deems magabey +signed by Alice whom he fully trusts), Bob's ssh client deems mangabey "known" and no further host key checking is required. -On magabey's side, since Bob's key has "full" validity (since it had -also been signed by Alice whom magabey fully trusts (since Alice told -him to)), Bob is authenticated to log into bob@magabey. +On mangabey's side, since Bob's key has "full" validity (since it had +also been signed by Alice, mangabey's trusted administrator), Bob is +authenticated and authorized to log into bob@mangabey. NOTES ===== @@ -136,4 +138,5 @@ perform authorization on user identities instead of on keys, it additionally allows the sysadmin also to authenticate the server to the end-user. -git clone http://git.mlcastle.net/monkeysphere.git/ monkeysphere +see doc/git-init for more detail on how to pull from the distributed +repositories. -- cgit v1.2.3 From 35a6f7cf8c455318078c7f94951dbc964bb41006 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Thu, 12 Jun 2008 00:22:02 -0400 Subject: Man page work. - flesh out more of the man pages for monkeysphere and monkeysphere-server - move the server cache directory to /var/cache, where it should be. --- debian/dirs | 3 +- etc/monkeysphere-server.conf | 3 -- man/man1/monkeysphere.1 | 83 +++++++++++++++++++++++++++--------------- man/man8/monkeysphere-server.8 | 35 ++++++++++-------- src/common | 12 +++--- src/monkeysphere | 4 +- src/monkeysphere-server | 11 +++--- 7 files changed, 87 insertions(+), 64 deletions(-) diff --git a/debian/dirs b/debian/dirs index 277c0b5..bdf0fe0 100644 --- a/debian/dirs +++ b/debian/dirs @@ -1,5 +1,4 @@ -var/lib/monkeysphere -var/lib/monkeysphere/stage +var/cache/monkeysphere usr/bin usr/sbin usr/share diff --git a/etc/monkeysphere-server.conf b/etc/monkeysphere-server.conf index bed5c09..3c16c5f 100644 --- a/etc/monkeysphere-server.conf +++ b/etc/monkeysphere-server.conf @@ -18,6 +18,3 @@ # monkeysphere-generated authorized_keys file. Should be path to file # where '%h' will be substituted for the user's home directory. #USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys - -# where to cache user authorized_keys lines -#STAGING_AREA=/var/lib/monkeysphere/stage diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index f9a6af4..410a5d7 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -1,34 +1,53 @@ .TH MONKEYSPHERE "1" "June 2008" "monkeysphere 0.1" "User Commands" .SH NAME -monkeysphere \- monkeysphere client user interface +monkeysphere \- MonkeySphere client user interface .SH SYNOPSIS .B monkeysphere \fIcommand\fP [\fIargs\fP] .SH DESCRIPTION .PP -\fBmonkeysphere\fP is the client monkeysphere tool. +MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh +authentication and encryption. OpenPGP keys are tracked via GnuPG, +and added to the ssh authorized_keys and known_hosts files to be used +for authentication and encryption of ssh connection. + +\fBmonkeysphere\fP is the MonkeySphere client utility. +.PD .SH SUBCOMMANDS \fBmonkeysphere\fP takes various subcommands: -.PD .TP .B update-known_hosts [HOST]... -Update the known_hosts file. For every host listed, search for a gpg -key for the host in the Web of Trust. If a key is found, any ssh keys -for the host are removed from the known_hosts file. If the found key -is acceptable (see KEY ACCEPTABILITY), then the gpg key is converted -to an ssh key and added to the known_hosts file. If no gpg key is -found for the host, then nothing is done. If no hosts are specified, -all hosts listed in the known_hosts file will be processed. If they - -`k' may be used in place of `update-known_hosts'. -.TP -.B update-authorized_keys -Update the authorized_keys file. +Update the known_hosts file. For each specified host, gpg will be +queried for a key associated with the host URI (see HOST URIs), +querying a keyserver if none is found in the user's keychain. search +for a gpg key for the host in the Web of Trust. If a key is found, it +will be added to the host_keys cache (see KEY CACHES) and any ssh keys +for the host will be removed from the user's known_hosts file. If the +found key is acceptable (see KEY ACCEPTABILITY), then the host's gpg +key will be added to the known_hosts file. If no gpg key is found for +the host, then nothing is done. If no hosts are specified, all hosts +listed in the known_hosts file will be processed. `k' may be used in +place of `update-known_hosts'. .TP .B update-userids [USERID]... -Update userid +Add/update a userid in the authorized_user_ids file. The user IDs +specified should be exact matches to OpenPGP user IDs. For each +specified user ID, gpg will be queried for a key associated with that +user ID, querying a keyserver if none is found in the user's keychain. +If a key is found, it will be added to the user_keys cache (see KEY +CACHES) and the user ID will be added to the user's +authorized_user_ids file (if it wasn't already present). +.TP +.B update-authorized_keys +Update the monkeysphere authorized_keys file. The monkeysphere +authorized_keys file will be regenerated from the valid keys in the +user_key cache, and the user's independently controlled +authorized_keys file (usually ~/.ssh/authorized_keys). .TP .B gen-ae-subkey KEYID -Generate an `ae` capable subkey +Generate an `ae` capable subkey. For the primary key with the +specified key ID, generate a subkey with "authentication" and +"encryption" capability that can be used for MonkeySphere +transactions. .TP .B help Output a brief usage summary. `h' or `?' may be used in place of @@ -45,6 +64,20 @@ flags. .B validity The key must be "fully" valid, and must not be expired or revoked. .PD +.SH KEY CACHES +Monkeysphere keeps track of keys in key cache directories. The files +in the cache are named with the format "USERID_HASH.PUB_KEY_ID", where +USERID_HASH is a hash of the exact OpenPGP user ID, and PUB_KEY_ID is +the key ID of the primary key. If the user/key ID combo exists in the +Web of Trust but is not acceptable, then the file is empty. If the +primary key has at least one acceptable sub key, then an ssh-style +key, converted from the OpenPGP key, of all acceptable subkeys will be +stored in the cache file, one per line. known_hosts style key lines +will be stored in the host_keys cache files, and authorized_keys style +key lines will be stored in the user_keys cache files. OpenPGP keys +are converted to ssh-style keys with the openpgp2ssh utility (see `man +openpgp2ssh'). +.PD .SH FILES .PD 1 .TP @@ -55,7 +88,8 @@ User monkeysphere config file. System-wide monkeysphere config file. .TP ~/.config/monkeysphere/authorized_user_ids -GPG user IDs to validate for addition to the authorized_keys file. +GPG user IDs associated with keys that will be checked for addition to +the authorized_keys file. .TP ~/.config/monkeysphere/authorized_keys Monkeysphere generated authorized_keys file. @@ -67,17 +101,8 @@ User keys cache directory. Host keys cache directory. .PD .SH AUTHOR -Written by Jameson Rollins -.SH "REPORTING BUGS" -Report bugs to . -.SH COPYRIGHT -Copyright \(co 2008 Jameson Graef Rollins and Daniel Kahn Gillmor -.br -This is free software. You may redistribute copies of it under the -terms of the GNU General Public License -. There is NO WARRANTY, to the -extent permitted by law. -.SH "SEE ALSO" +Written by Jameson Rollins +.SH SEE ALSO .BR ssh (1), .BR gpg (1), .BR monkeysphere-server (8) diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index 7a12e17..cc07077 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -5,20 +5,32 @@ monkeysphere-server \- monkeysphere server admin user interface .B monkeysphere-server \fIcommand\fP [\fIargs\fP] .SH DESCRIPTION .PP -\fBmonkeysphere-server\fP is the server admin monkeysphere tool. +\fBMonkeySphere\fP is a system to leverage the OpenPGP Web of Trust +for ssh authentication and encryption. OpenPGP keys are tracked via +GnuPG, and added to the ssh authorized_keys and known_hosts files to +be used for authentication and encryption of ssh connection. + +\fBmonkeysphere-server\fP is the MonkeySphere server admin utility. +.PD .SH SUBCOMMANDS \fBmonkeysphere-server\fP takes various subcommands: -.PD .TP -.B update-users [HOST]... +.B update-users [USER]... +Update the admin-controlled authorized_keys files for user. For each +user specified, update the user's authorized_keys file in +/var/cache/monkeysphere/USER. See `man monkeysphere' for more info. .TP .B gen-key +Generate a gpg key for the host. .TP .B publish-key +Publish the host's gpg key to a keyserver. .TP .B trust-keys KEYID... +Mark key specified with KEYID with full owner trust. .TP .B update-user-userids USER USERID... +Add/update a userid in the authorized_user_ids file for USER. .TP .B help Output a brief usage summary. `h' or `?' may be used in place of @@ -39,21 +51,12 @@ Monkeysphere GNUPG home directory. /etc/monkeysphere/authorized_user_ids/USER Server maintained authorized_user_ids files for users. .TP -/var/lib/monkeysphere/stage/USER -Staging directory for user key caches. +/var/cachemonkeysphere/USER +User keys cache directories. .PD .SH AUTHOR -Written by Jameson Rollins -.SH "REPORTING BUGS" -Report bugs to . -.SH COPYRIGHT -Copyright \(co 2008 Jameson Graef Rollins and Daniel Kahn Gillmor -.br -This is free software. You may redistribute copies of it under the -terms of the GNU General Public License -. There is NO WARRANTY, to the -extent permitted by law. -.SH "SEE ALSO" +Written by Jameson Rollins +.SH SEE ALSO .BR monkeysphere (1), .BR gpg (1), .BR ssh (1) diff --git a/src/common b/src/common index d7caefd..914c800 100755 --- a/src/common +++ b/src/common @@ -14,8 +14,8 @@ # managed directories ETC="/etc/monkeysphere" export ETC -LIB="/var/lib/monkeysphere" -export LIB +CACHE="/var/cache/monkeysphere" +export CACHE ######################################################################## failure() { @@ -312,13 +312,13 @@ process_known_hosts() { # update an authorized_keys file after first processing the # authorized_user_ids file update_authorized_keys() { - local cacheDir local msAuthorizedKeys local userAuthorizedKeys + local cacheDir - cacheDir="$1" - msAuthorizedKeys="$2" - userAuthorizedKeys="$3" + msAuthorizedKeys="$1" + userAuthorizedKeys="$2" + cacheDir="$3" process_authorized_ids "$AUTHORIZED_USER_IDS" "$cacheDir" diff --git a/src/monkeysphere b/src/monkeysphere index aaeda11..5d865c9 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -35,8 +35,8 @@ Monkeysphere client tool. subcommands: update-known_hosts (k) [HOST]... update known_hosts file - update-authorized_keys (a) update authorized_keys file update-userids (u) [USERID]... add/update userid + update-authorized_keys (a) update authorized_keys file gen-ae-subkey (g) KEYID generate an 'ae' capable subkey help (h,?) this help @@ -170,7 +170,7 @@ case $COMMAND in userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$HOME"} # update authorized_keys - update_authorized_keys "$userKeysCacheDir" "$msAuthorizedKeys" "$userAuthorizedKeys" + update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir" ;; 'update-userids'|'u') diff --git a/src/monkeysphere-server b/src/monkeysphere-server index a109cf5..0ff06af 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -129,7 +129,6 @@ GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} KEYSERVER=${KEYSERVER:-subkeys.pgp.net} REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys} -STAGING_AREA=${STAGING_AREA:-"$LIB"/stage} export GNUPGHOME @@ -150,8 +149,8 @@ case $COMMAND in log "----- user: $uname -----" AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" - cacheDir="$STAGING_AREA"/"$uname"/user_keys - msAuthorizedKeys="$STAGING_AREA"/"$uname"/authorized_keys + msAuthorizedKeys="$CACHE"/"$uname"/authorized_keys + cacheDir="$CACHE"/"$uname"/user_keys # make sure authorized_user_ids file exists if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then @@ -166,7 +165,7 @@ case $COMMAND in fi # update authorized_keys - update_authorized_keys "$cacheDir" "$msAuthorizedKeys" "$userAuthorizedKeys" + update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$cacheDir" done log "----- done. -----" @@ -199,9 +198,9 @@ case $COMMAND in failure "you must specify at least one userid." fi AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" - userKeysCacheDir="$STAGING_AREA"/"$uname"/user_keys + cacheDir="$CACHE"/"$uname"/user_keys for userID ; do - update_userid "$userID" "$userKeysCacheDir" + update_userid "$userID" "$cacheDir" done ;; -- cgit v1.2.3 From e4ce2240a682a57680e3d4d2d07757e631887d33 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 12 Jun 2008 10:30:05 -0400 Subject: added ssh2gpg to Makefile --- src/gpg2ssh/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/gpg2ssh/Makefile b/src/gpg2ssh/Makefile index a0b7241..65a5f0f 100644 --- a/src/gpg2ssh/Makefile +++ b/src/gpg2ssh/Makefile @@ -1,4 +1,4 @@ -all: monkeysphere gpg2ssh +all: monkeysphere gpg2ssh ssh2gpg monkeysphere: main.c gnutls-helpers.o gcc -g -Wall --pedantic -o monkeysphere main.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o @@ -13,6 +13,6 @@ ssh2gpg: ssh2gpg.c gnutls-helpers.o gcc -g -Wall --pedantic -o $@ -c $< clean: - rm -f monkeysphere gpg2ssh *.o + rm -f monkeysphere gpg2ssh ssh2gpg *.o .PHONY: clean all -- cgit v1.2.3 From e2314e2105e02ec0d2684a3b68b9187982ca812b Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 12 Jun 2008 13:27:54 -0400 Subject: massaging the language in openpgp2ssh(1). --- man/man1/openpgp2ssh.1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/man/man1/openpgp2ssh.1 b/man/man1/openpgp2ssh.1 index 27bcb15..6267141 100644 --- a/man/man1/openpgp2ssh.1 +++ b/man/man1/openpgp2ssh.1 @@ -31,7 +31,7 @@ insertion into known_hosts files and authorized_keys files. If the input contains an OpenPGP RSA or DSA secret key, it will be converted to the equivalent PEM-encoded private key. -Note that the keys output from this process are stripped of all +Note that the keys produced by this process are stripped of all identifying information, including certifications, self-signatures, etc. -- cgit v1.2.3 From 00719770b7608af0c37dfd6c14a04eb7ebc4cad0 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 12 Jun 2008 13:31:13 -0400 Subject: reorganizing to prepare for transition to openpgp2ssh. --- src/gpg2ssh/Makefile | 18 --- src/gpg2ssh/gnutls-helpers.c | 364 ------------------------------------------ src/gpg2ssh/gnutls-helpers.h | 72 --------- src/gpg2ssh/gpg2ssh.c | 293 ---------------------------------- src/gpg2ssh/main.c | 271 ------------------------------- src/gpg2ssh/ssh2gpg.c | 171 -------------------- src/keytrans/Makefile | 19 +++ src/keytrans/gnutls-helpers.c | 364 ++++++++++++++++++++++++++++++++++++++++++ src/keytrans/gnutls-helpers.h | 72 +++++++++ src/keytrans/gpg2ssh.c | 293 ++++++++++++++++++++++++++++++++++ src/keytrans/openpgp2ssh.c | 271 +++++++++++++++++++++++++++++++ src/keytrans/ssh2gpg.c | 171 ++++++++++++++++++++ 12 files changed, 1190 insertions(+), 1189 deletions(-) delete mode 100644 src/gpg2ssh/Makefile delete mode 100644 src/gpg2ssh/gnutls-helpers.c delete mode 100644 src/gpg2ssh/gnutls-helpers.h delete mode 100644 src/gpg2ssh/gpg2ssh.c delete mode 100644 src/gpg2ssh/main.c delete mode 100644 src/gpg2ssh/ssh2gpg.c create mode 100644 src/keytrans/Makefile create mode 100644 src/keytrans/gnutls-helpers.c create mode 100644 src/keytrans/gnutls-helpers.h create mode 100644 src/keytrans/gpg2ssh.c create mode 100644 src/keytrans/openpgp2ssh.c create mode 100644 src/keytrans/ssh2gpg.c diff --git a/src/gpg2ssh/Makefile b/src/gpg2ssh/Makefile deleted file mode 100644 index 65a5f0f..0000000 --- a/src/gpg2ssh/Makefile +++ /dev/null @@ -1,18 +0,0 @@ -all: monkeysphere gpg2ssh ssh2gpg - -monkeysphere: main.c gnutls-helpers.o - gcc -g -Wall --pedantic -o monkeysphere main.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o - -gpg2ssh: gpg2ssh.c gnutls-helpers.o - gcc -g -Wall --pedantic -o gpg2ssh gpg2ssh.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o - -ssh2gpg: ssh2gpg.c gnutls-helpers.o - gcc -g -Wall --pedantic -o ssh2gpg ssh2gpg.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o - -%.o: %.c - gcc -g -Wall --pedantic -o $@ -c $< - -clean: - rm -f monkeysphere gpg2ssh ssh2gpg *.o - -.PHONY: clean all diff --git a/src/gpg2ssh/gnutls-helpers.c b/src/gpg2ssh/gnutls-helpers.c deleted file mode 100644 index 6eae29e..0000000 --- a/src/gpg2ssh/gnutls-helpers.c +++ /dev/null @@ -1,364 +0,0 @@ -/* Author: Daniel Kahn Gillmor */ -/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ -/* License: GPL v3 or later */ - -#include "gnutls-helpers.h" -/* for htonl() */ -#include - -/* for setlocale() */ -#include - -/* for isalnum() */ -#include - -int loglevel = 0; - - -void err(const char* fmt, ...) { - va_list ap; - va_start(ap, fmt); - vfprintf(stderr, fmt, ap); - va_end(ap); - fflush(stderr); -} - -void logfunc(int level, const char* string) { - fprintf(stderr, "GnuTLS Logging (%d): %s\n", level, string); -} - -void init_keyid(gnutls_openpgp_keyid_t keyid) { - memset(keyid, 'x', sizeof(gnutls_openpgp_keyid_t)); -} - - - -void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid) -{ - static const char hex[16] = "0123456789ABCDEF"; - unsigned int kix = 0, outix = 0; - - while (kix < sizeof(gnutls_openpgp_keyid_t)) { - out[outix] = hex[(keyid[kix] >> 4) & 0x0f]; - out[outix + 1] = hex[keyid[kix] & 0x0f]; - kix++; - outix += 2; - } -} - - -int init_gnutls() { - const char* version = NULL; - const char* debug_string = NULL; - int ret; - - if (ret = gnutls_global_init(), ret) { - err("Failed to do gnutls_global_init() (error: %d)\n", ret); - return 1; - } - - version = gnutls_check_version(NULL); - - if (version) - err("gnutls version: %s\n", version); - else { - err("no version found!\n"); - return 1; - } - - if (debug_string = getenv("MONKEYSPHERE_DEBUG"), debug_string) { - loglevel = atoi(debug_string); - gnutls_global_set_log_function(logfunc); - - gnutls_global_set_log_level(loglevel); - err("set log level to %d\n", loglevel); - } - return 0; -} - -void init_datum(gnutls_datum_t* d) { - d->data = NULL; - d->size = 0; -} -void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src) { - dest->data = gnutls_realloc(dest->data, src->size); - dest->size = src->size; - memcpy(dest->data, src->data, src->size); -} -int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b) { - if (a->size > b->size) { - err("a is larger\n"); - return 1; - } - if (a->size < b->size) { - err("b is larger\n"); - return -1; - } - return memcmp(a->data, b->data, a->size); -} -void free_datum(gnutls_datum_t* d) { - gnutls_free(d->data); - d->data = NULL; - d->size = 0; -} - -/* read the passed-in string, store in a single datum */ -int set_datum_string(gnutls_datum_t* d, const char* s) { - unsigned int x = strlen(s)+1; - unsigned char* c = NULL; - - c = gnutls_realloc(d->data, x); - if (NULL == c) - return -1; - d->data = c; - d->size = x; - memcpy(d->data, s, x); - return 0; -} - -/* read the passed-in file descriptor until EOF, store in a single - datum */ -int set_datum_fd(gnutls_datum_t* d, int fd) { - unsigned int bufsize = 1024; - unsigned int len = 0; - - FILE* f = fdopen(fd, "r"); - if (bufsize > d->size) { - bufsize = 1024; - d->data = gnutls_realloc(d->data, bufsize); - if (d->data == NULL) { - err("out of memory!\n"); - return -1; - } - d->size = bufsize; - } else { - bufsize = d->size; - } - f = fdopen(fd, "r"); - if (NULL == f) { - err("could not fdopen FD %d\n", fd); - } - clearerr(f); - while (!feof(f) && !ferror(f)) { - if (len == bufsize) { - /* allocate more space by doubling: */ - bufsize *= 2; - d->data = gnutls_realloc(d->data, bufsize); - if (d->data == NULL) { - err("out of memory!\n"); - return -1; - }; - d->size = bufsize; - } - len += fread(d->data + len, 1, bufsize - len, f); - /* err("read %d bytes\n", len); */ - } - if (ferror(f)) { - err("Error reading from fd %d (error: %d) (error: %d '%s')\n", fd, ferror(f), errno, strerror(errno)); - return -1; - } - - /* touch up buffer size to match reality: */ - d->data = gnutls_realloc(d->data, len); - d->size = len; - return 0; -} - -/* read the file indicated (by name) in the fname parameter. store - its entire contents in a single datum. */ -int set_datum_file(gnutls_datum_t* d, const char* fname) { - struct stat sbuf; - unsigned char* c = NULL; - FILE* file = NULL; - size_t x = 0; - - if (0 != stat(fname, &sbuf)) { - err("failed to stat '%s'\n", fname); - return -1; - } - - c = gnutls_realloc(d->data, sbuf.st_size); - if (NULL == c) { - err("failed to allocate %d bytes for '%s'\n", sbuf.st_size, fname); - return -1; - } - - d->data = c; - d->size = sbuf.st_size; - file = fopen(fname, "r"); - if (NULL == file) { - err("failed to open '%s' for reading\n", fname); - return -1; - } - - x = fread(d->data, d->size, 1, file); - if (x != 1) { - err("tried to read %d bytes, read %d instead from '%s'\n", d->size, x, fname); - fclose(file); - return -1; - } - fclose(file); - return 0; -} - -int write_datum_fd(int fd, const gnutls_datum_t* d) { - if (d->size != write(fd, d->data, d->size)) { - err("failed to write body of datum.\n"); - return -1; - } - return 0; -} - - -int write_datum_fd_with_length(int fd, const gnutls_datum_t* d) { - uint32_t len; - int looks_negative = (d->data[0] & 0x80); - unsigned char zero = 0; - - /* if the first bit is 1, then the datum will appear negative in the - MPI encoding style used by OpenSSH. In that case, we'll increase - the length by one, and dump out one more byte */ - - if (looks_negative) { - len = htonl(d->size + 1); - } else { - len = htonl(d->size); - } - if (write(fd, &len, sizeof(len)) != sizeof(len)) { - err("failed to write size of datum.\n"); - return -2; - } - if (looks_negative) { - if (write(fd, &zero, 1) != 1) { - err("failed to write padding byte for MPI.\n"); - return -2; - } - } - return write_datum_fd(fd, d); -} - -int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num) { - unsigned int i; - int ret; - - for (i = 0; i < num; i++) - if (ret = write_datum_fd_with_length(fd, d[i]), ret != 0) - return ret; - - return 0; -} - - -int datum_from_string(gnutls_datum_t* d, const char* str) { - d->size = strlen(str); - d->data = gnutls_realloc(d->data, d->size); - if (d->data == 0) - return ENOMEM; - memcpy(d->data, str, d->size); - return 0; -} - - -int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]) { - int p[2]; - int ret; - - if (pid == NULL) { - err("bad pointer passed to create_writing_pipe()\n"); - return -1; - } - - if (ret = pipe(p), ret == -1) { - err("failed to create a pipe (error: %d \"%s\")\n", errno, strerror(errno)); - return -1; - } - - *pid = fork(); - if (*pid == -1) { - err("Failed to fork (error: %d \"%s\")\n", errno, strerror(errno)); - return -1; - } - if (*pid == 0) { /* this is the child */ - close(p[1]); /* close unused write end */ - - if (0 != dup2(p[0], 0)) { /* map the reading end into stdin */ - err("Failed to transfer reading file descriptor to stdin (error: %d \"%s\")\n", errno, strerror(errno)); - exit(1); - } - execv(path, argv); - err("exec %s failed (error: %d \"%s\")\n", path, errno, strerror(errno)); - /* close the open file descriptors */ - close(p[0]); - close(0); - - exit(1); - } else { /* this is the parent */ - close(p[0]); /* close unused read end */ - return p[1]; - } -} - -int validate_ssh_host_userid(const char* userid) { - char* oldlocale = setlocale(LC_ALL, "C"); - - /* choke if userid does not match the expected format - ("ssh://fully.qualified.domain.name") */ - if (strncmp("ssh://", userid, strlen("ssh://")) != 0) { - err("The user ID should start with ssh:// for a host key\n"); - goto fail; - } - /* so that isalnum will work properly */ - userid += strlen("ssh://"); - while (0 != (*userid)) { - if (!isalnum(*userid)) { - err("label did not start with a letter or a digit! (%s)\n", userid); - goto fail; - } - userid++; - while (isalnum(*userid) || ('-' == (*userid))) - userid++; - if (('.' == (*userid)) || (0 == (*userid))) { /* clean end of label: - check last char - isalnum */ - if (!isalnum(*(userid - 1))) { - err("label did not end with a letter or a digit!\n"); - goto fail; - } - if ('.' == (*userid)) /* advance to the start of the next label */ - userid++; - } else { - err("invalid character in domain name: %c\n", *userid); - goto fail; - } - } - /* ensure that the last character is valid: */ - if (!isalnum(*(userid - 1))) { - err("hostname did not end with a letter or a digit!\n"); - goto fail; - } - /* FIXME: fqdn's can be unicode now, thanks to RFC 3490 -- how do we - make sure that we've got an OK string? */ - - return 0; - - fail: - setlocale(LC_ALL, oldlocale); - return 1; -} - -/* http://tools.ietf.org/html/rfc4880#section-5.5.2 */ -size_t get_openpgp_mpi_size(gnutls_datum_t* d) { - return 2 + d->size; -} - -int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d) { - uint16_t x; - - x = d->size * 8; - x = htons(x); - - write(fd, &x, sizeof(x)); - write(fd, d->data, d->size); - - return 0; -} diff --git a/src/gpg2ssh/gnutls-helpers.h b/src/gpg2ssh/gnutls-helpers.h deleted file mode 100644 index 9ea22a3..0000000 --- a/src/gpg2ssh/gnutls-helpers.h +++ /dev/null @@ -1,72 +0,0 @@ -/* Author: Daniel Kahn Gillmor */ -/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ -/* License: GPL v3 or later */ - - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -/* Functions to help dealing with GnuTLS for monkeysphere key - translation projects: */ - -/* set everything up, including logging levels. Return 0 on - success */ -int init_gnutls(); - -/* logging and output functions: */ - -void err(const char* fmt, ...); -void logfunc(int level, const char* string); - -/* basic datum manipulations: */ - -void init_datum(gnutls_datum_t* d); -void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src); -int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b); -void free_datum(gnutls_datum_t* d); -int write_datum_fd(int fd, const gnutls_datum_t* d); -int write_datum_fd_with_length(int fd, const gnutls_datum_t* d); -int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num); - -/* set up a datum from a null-terminated string */ -int datum_from_string(gnutls_datum_t* d, const char* str); - -/* keyid manipulations: */ -typedef unsigned char printable_keyid[16]; - -void init_keyid(gnutls_openpgp_keyid_t keyid); -void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid); - -/* functions to get data into datum objects: */ - -/* read the passed-in string, store in a single datum */ -int set_datum_string(gnutls_datum_t* d, const char* s); - -/* read the passed-in file descriptor until EOF, store in a single - datum */ -int set_datum_fd(gnutls_datum_t* d, int fd); - -/* read the file indicated (by name) in the fname parameter. store - its entire contents in a single datum. */ -int set_datum_file(gnutls_datum_t* d, const char* fname); - -/* set up file descriptor pipe for writing (child process pid gets - stored in pid, fd is returned)*/ -int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]); - -/* return 0 if userid matches the monkeysphere spec for ssh host user IDs */ -int validate_ssh_host_userid(const char* userid); - -/* how many bytes will it take to write out this datum in OpenPGP MPI form? */ -size_t get_openpgp_mpi_size(gnutls_datum_t* d); - -/* write the MPI stored in gnutls_datum_t to file descriptor fd: */ -int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d); diff --git a/src/gpg2ssh/gpg2ssh.c b/src/gpg2ssh/gpg2ssh.c deleted file mode 100644 index c99f03f..0000000 --- a/src/gpg2ssh/gpg2ssh.c +++ /dev/null @@ -1,293 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* for waitpid() */ -#include -#include - -/* - Author: Daniel Kahn Gillmor - Date: Tue, 08 Apr 2008 - License: GPL v3 or later - - monkeysphere public key translator: execute this with an GPG - certificate (public key(s) + userid(s)) on stdin. It currently - only works with RSA keys. - - It will spit out a version of the first key capable of being used - for authentication on stdout. The output format should be suitable - for appending a known_hosts file. - - Requirements: I've only built this so far with GnuTLS v2.3.4 -- - version 2.2.0 does not contain the appropriate pieces. - - */ - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_openpgp_crt_t openpgp_crt; - gnutls_openpgp_keyid_t keyid; - printable_keyid p_keyid; - unsigned int keyidx; - unsigned int usage, bits; - gnutls_pk_algorithm_t algo; - - gnutls_datum_t m, e, p, q, g, y; - gnutls_datum_t algolabel; - - char output_data[10240]; - char userid[10240]; - size_t uidsz = sizeof(userid); - - const gnutls_datum_t* all[5]; - int pipefd; - pid_t child_pid; - char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; - const char* algoname; - int mpicount; - int pipestatus; - - init_gnutls(); - - init_datum(&data); - - init_datum(&m); - init_datum(&e); - init_datum(&p); - init_datum(&q); - init_datum(&g); - init_datum(&y); - - init_datum(&algolabel); - - init_keyid(keyid); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - if (ret = gnutls_openpgp_crt_init(&openpgp_crt), ret) { - err("Failed to initialize OpenPGP certificate (error: %d)\n", ret); - return 1; - } - - /* format could be either: GNUTLS_OPENPGP_FMT_RAW, - GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, - otherwise, use BASE64: */ - - /* FIXME: we should be auto-detecting the input format, and - translating it as needed. */ - - if (getenv("MONKEYSPHERE_RAW")) { - err("assuming RAW formatted certificate\n"); - if (ret = gnutls_openpgp_crt_import(openpgp_crt, &data, GNUTLS_OPENPGP_FMT_RAW), ret) { - err("failed to import the OpenPGP certificate in RAW format (error: %d)\n", ret); - return ret; - } - } else { - err("assuming BASE64 formatted certificate\n"); - if (ret = gnutls_openpgp_crt_import (openpgp_crt, &data, GNUTLS_OPENPGP_FMT_BASE64), ret) { - err("failed to import the OpenPGP certificate in BASE64 format (error: %d)\n", ret); - return ret; - } - } - - if (gnutls_openpgp_crt_get_revoked_status(openpgp_crt)) { - err("the primary key was revoked!\n"); - return 1; - } - - /* FIXME: We're currently looking at the primary key or maybe the - first authentication-capable subkey. - - Instead, we should be iterating through the primary key and all - subkeys: for each one with the authentication usage flag set of a - algorithm we can handle, we should output matching UserIDs and - the SSH version of the key. */ - - - if (ret = gnutls_openpgp_crt_get_key_usage(openpgp_crt, &usage), ret) { - err("failed to get the usage flags for the primary key (error: %d)\n", ret); - return ret; - } - if (usage & GNUTLS_KEY_KEY_AGREEMENT && - usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { - err("the primary key can be used for authentication and communication encryption!\n"); - - algo = gnutls_openpgp_crt_get_pk_algorithm(openpgp_crt, &bits); - if (algo < 0) { - err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - - err("OpenPGP RSA certificate, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_pk_rsa_raw(openpgp_crt, &m, &e); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_pk_dsa_raw(openpgp_crt, &p, &q, &g, &y); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - - } else { - err("primary key is not good for authentication and communication encryption. Trying subkeys...\n"); - - if (ret = gnutls_openpgp_crt_get_auth_subkey(openpgp_crt, keyid, 0), ret) { - err("failed to find a subkey capable of authentication and communication encryption (error: %d)\n", ret); - return ret; - } - make_keyid_printable(p_keyid, keyid); - err("found authentication subkey %.16s\n", p_keyid); - - ret = gnutls_openpgp_crt_get_subkey_idx(openpgp_crt, keyid); - if (ret < 0) { - err("could not get the index of subkey %.16s (error: %d)\n", ret); - return ret; - } - keyidx = ret; - - if (gnutls_openpgp_crt_get_subkey_revoked_status(openpgp_crt, keyidx)) { - err("The authentication subkey was revoked!\n"); - return 1; - } - - if (ret = gnutls_openpgp_crt_get_subkey_usage(openpgp_crt, keyidx, &usage), ret) { - err("could not figure out usage of subkey %.16s (error: %d)\n", p_keyid, ret); - return ret; - } - if ((usage & GNUTLS_KEY_KEY_AGREEMENT) == 0 && - usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { - err("could not find a subkey with authentication and communication encryption.\n"); - return 1; - } - - /* switch, based on the algorithm in question, to extract the MPI - components: */ - - algo = gnutls_openpgp_crt_get_subkey_pk_algorithm(openpgp_crt, keyidx, &bits); - if (algo < 0) { - err("failed to get the algorithm of the authentication subkey (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - - err("OpenPGP RSA subkey, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(openpgp_crt, keyidx, &m, &e); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA subkey parameters (error: %d)\n", ret); - return 1; - } - } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA subkey, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(openpgp_crt, keyidx, &p, &q, &g, &y); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA subkey parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP subkey was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - } - - /* make sure userid is NULL-terminated */ - userid[sizeof(userid) - 1] = 0; - uidsz--; - - /* FIXME: we're just choosing the first UserID from the certificate: - instead, we should be selecting every User ID that is adequately - signed and matches the spec, and aggregating them with commas for - known_hosts output */ - - if (ret = gnutls_openpgp_crt_get_name(openpgp_crt, 0, userid, &uidsz), ret) { - err("Failed to fetch the first UserID (error: %d)\n", ret); - return ret; - } - - if (ret = validate_ssh_host_userid(userid), ret) { - err("bad userid: not a valid ssh host.\n"); - return ret; - } - - /* remove ssh:// from the beginning of userid */ - memmove(userid, userid + strlen("ssh://"), 1 + strlen(userid) - strlen("ssh://")); - - - /* now we have algo, and the various MPI data are set. Can we - export them cleanly? */ - - /* for the moment, we'll just dump the info raw, and pipe it - externally through coreutils' /usr/bin/base64 */ - - if (algo == GNUTLS_PK_RSA) { - algoname = "ssh-rsa"; - mpicount = 3; - - all[0] = &algolabel; - all[1] = &e; - all[2] = &m; - } else if (algo == GNUTLS_PK_DSA) { - algoname = "ssh-dss"; - mpicount = 5; - - all[0] = &algolabel; - all[1] = &p; - all[2] = &q; - all[3] = &g; - all[4] = &y; - } else { - err("no idea what this algorithm is: %d\n", algo); - return 1; - } - - if (ret = datum_from_string(&algolabel, algoname), ret) { - err("couldn't label string (error: %d)\n", ret); - return ret; - } - - snprintf(output_data, sizeof(output_data), "%s %s ", userid, algoname); - - pipefd = create_writing_pipe(&child_pid, args[0], args); - if (pipefd < 0) { - err("failed to create a writing pipe (returned %d)\n", pipefd); - return pipefd; - } - - write(1, output_data, strlen(output_data)); - - if (0 != write_data_fd_with_length(pipefd, all, mpicount)) { - err("was not able to write out RSA key data\n"); - return 1; - } - close(pipefd); - if (child_pid != waitpid(child_pid, &pipestatus, 0)) { - err("could not wait for child process to return for some reason.\n"); - return 1; - } - if (pipestatus != 0) { - err("base64 pipe died with return code %d\n", pipestatus); - return pipestatus; - } - - write(1, "\n", 1); - - - - gnutls_openpgp_crt_deinit(openpgp_crt); - gnutls_global_deinit(); - return 0; -} diff --git a/src/gpg2ssh/main.c b/src/gpg2ssh/main.c deleted file mode 100644 index d6bac68..0000000 --- a/src/gpg2ssh/main.c +++ /dev/null @@ -1,271 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* - Author: Daniel Kahn Gillmor - Date: Tue, 01 Apr 2008 - License: GPL v3 or later - - monkeysphere private key translator: execute this with an GPG - secret key on stdin (at the moment, only passphraseless RSA keys - work). - - It will spit out a PEM-encoded version of the key on stdout, which - can be fed into ssh-add like this: - - gpg --export-secret-keys $KEYID | monkeysphere | ssh-add -c /dev/stdin - - Requirements: I've only built this so far with GnuTLS v2.3.4 -- - version 2.2.0 does not contain the appropriate pieces. - - Notes: gpgkey2ssh doesn't seem to provide the same public - keys. Mighty weird! - -0 wt215@squeak:~/monkeysphere$ gpg --export-secret-keys 1DCDF89F | ~dkg/src/monkeysphere/monkeysphere | ssh-add -c /dev/stdin -gnutls version: 2.3.4 -OpenPGP RSA Key, with 1024 bits -Identity added: /dev/stdin (/dev/stdin) -The user has to confirm each use of the key -0 wt215@squeak:~/monkeysphere$ ssh-add -L -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC9gWQqfrnhQKDQnND/3eOexpddE64J+1zp9fcyCje7H5LKclb6DBV2HS6WgW32PJhIzvP+fYZM3dzXea3fpv14y1SicXiRBDgF9SnsNA1qWn2RyzkLcKy7PmM0PDYtU1oiLTcQj/xkWcqW2sLKHT/WW+vZP5XP7RMGN/yWNMfE2Q== /dev/stdin -0 wt215@squeak:~/monkeysphere$ gpgkey2ssh 1DCDF89F -ssh-rsa AAAAB3NzaC1yc2EAAACBAL2BZCp+ueFAoNCc0P/d457Gl10Trgn7XOn19zIKN7sfkspyVvoMFXYdLpaBbfY8mEjO8/59hkzd3Nd5rd+m/XjLVKJxeJEEOAX1Kew0DWpafZHLOQtwrLs+YzQ8Ni1TWiItNxCP/GRZypbawsodP9Zb69k/lc/tEwY3/JY0x8TZAAAAAwEAAQ== COMMENT -0 wt215@squeak:~/monkeysphere$ - - */ - - -int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { - gnutls_openpgp_privkey_t pgp_privkey; - gnutls_datum_t m, e, d, p, q, u, g, y, x; - gnutls_pk_algorithm_t pgp_algo; - unsigned int pgp_bits; - int ret; - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - init_datum(&x); - - if (ret = gnutls_openpgp_privkey_init(&pgp_privkey), ret) { - err("Failed to initialized OpenPGP private key (error: %d)\n", ret); - return 1; - } - - - /* format could be either: GNUTLS_OPENPGP_FMT_RAW, - GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, - otherwise, use BASE64: */ - - if (getenv("MONKEYSPHERE_RAW")) { - err("assuming RAW formatted private keys\n"); - if (ret = gnutls_openpgp_privkey_import(pgp_privkey, input, GNUTLS_OPENPGP_FMT_RAW, NULL, 0), ret) - err("failed to import the OpenPGP private key in RAW format (error: %d)\n", ret); - } else { - err("assuming BASE64 formatted private keys\n"); - if (ret = gnutls_openpgp_privkey_import (pgp_privkey, input, GNUTLS_OPENPGP_FMT_BASE64, NULL, 0), ret) - err("failed to import the OpenPGP private key in BASE64 format (error: %d)\n", ret); - } - - pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(pgp_privkey, &pgp_bits); - if (pgp_algo < 0) { - err("failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); - return 1; - } - if (pgp_algo == GNUTLS_PK_RSA) { - err("OpenPGP RSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_rsa_raw(pgp_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - - ret = gnutls_x509_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (pgp_algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_dsa_raw(pgp_privkey, &p, &q, &g, &y, &x); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - - ret = gnutls_x509_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", pgp_algo); - return 1; - } - - ret = gnutls_x509_privkey_fix(*output); - if (ret != 0) { - err("failed to fix up the private key in X.509 format (error: %d)\n", ret); - return 1; - } - - gnutls_openpgp_privkey_deinit(pgp_privkey); - return 0; -} - -int convert_x509_to_pgp(gnutls_openpgp_privkey_t* output, gnutls_datum_t* input) { - gnutls_x509_privkey_t x509_privkey; - gnutls_datum_t m, e, d, p, q, u, g, y, x; - gnutls_pk_algorithm_t x509_algo; - int ret; - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - init_datum(&x); - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialized X.509 private key (error: %d)\n", ret); - return 1; - } - - - /* format could be either: GNUTLS_X509_FMT_DER, - GNUTLS_X509_FMT_PEM; if MONKEYSPHERE_DER is set, use DER, - otherwise, use PEM: */ - - if (getenv("MONKEYSPHERE_DER")) { - err("assuming DER formatted private keys\n"); - if (ret = gnutls_x509_privkey_import(x509_privkey, input, GNUTLS_X509_FMT_DER), ret) - err("failed to import the X.509 private key in DER format (error: %d)\n", ret); - } else { - err("assuming PEM formatted private keys\n"); - if (ret = gnutls_x509_privkey_import (x509_privkey, input, GNUTLS_X509_FMT_PEM), ret) - err("failed to import the X.509 private key in PEM format (error: %d)\n", ret); - } - - x509_algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); - if (x509_algo < 0) { - err("failed to get X.509 key algorithm (error: %d)\n", x509_algo); - return 1; - } - if (x509_algo == GNUTLS_PK_RSA) { - err("X.509 RSA Key\n"); - ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - - /* ret = gnutls_openpgp_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); */ - ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (x509_algo == GNUTLS_PK_DSA) { - err("X.509 DSA Key\n"); - ret = gnutls_x509_privkey_export_dsa_raw(x509_privkey, &p, &q, &g, &y, &x); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - - /* ret = gnutls_openpgp_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); */ - ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", x509_algo); - return 1; - } - - gnutls_x509_privkey_deinit(x509_privkey); - return 0; -} - - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_x509_privkey_t x509_privkey; - - char output_data[10240]; - size_t ods = sizeof(output_data); - - init_gnutls(); - - init_datum(&data); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - - /* Or, instead, read in key from a file name: - if (ret = set_datum_file(&data, argv[1]), ret) { - err("didn't read file '%s'\n", argv[1]); - return 1; - } -*/ - - /* treat the passed file as an X.509 private key, and extract its - component values: */ - -/* if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { */ -/* err("Failed to import the X.509 key (error: %d)\n", ret); */ -/* return 1; */ -/* } */ -/* gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); */ - - /* try to print the PEM-encoded private key: */ -/* ret = gnutls_x509_privkey_export (x509_privkey, */ -/* GNUTLS_X509_FMT_PEM, */ -/* output_data, */ -/* &ods); */ -/* printf("ret: %u; ods: %u;\n", ret, ods); */ -/* if (ret == 0) { */ -/* write(0, output_data, ods); */ -/* } */ - - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialize X.509 private key (error: %d)\n", ret); - return 1; - } - - if (ret = convert_pgp_to_x509(&x509_privkey, &data), ret) { - return ret; - } - - ret = gnutls_x509_privkey_export (x509_privkey, - GNUTLS_X509_FMT_PEM, - output_data, - &ods); - printf("ret: %u; ods: %u;\n", ret, ods); - if (ret == 0) { - write(1, output_data, ods); - } - - - gnutls_x509_privkey_deinit(x509_privkey); - gnutls_global_deinit(); - return 0; -} diff --git a/src/gpg2ssh/ssh2gpg.c b/src/gpg2ssh/ssh2gpg.c deleted file mode 100644 index b14a540..0000000 --- a/src/gpg2ssh/ssh2gpg.c +++ /dev/null @@ -1,171 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* for waitpid() */ -#include -#include - -/* for time() */ -#include - -/* for htons() */ -#include - - -/* - Author: Daniel Kahn Gillmor - Date: Sun, 2008-04-20 - License: GPL v3 or later - - monkeysphere public key translator: execute this with an ssh - private key on stdin. It currently only works with RSA keys. - - it should eventually work with OpenSSH-style public keys instead of - the full private key, but it was easier to do this way. - - It shoud spit out a version of the public key suitable for acting - as an OpenPGP public sub key packet. - - */ - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_x509_privkey_t x509_privkey; - gnutls_openpgp_crt_t openpgp_crt; - gnutls_openpgp_keyid_t keyid; - printable_keyid p_keyid; - unsigned int keyidx; - unsigned int usage, bits; - gnutls_pk_algorithm_t algo; - - unsigned char packettag; - unsigned char openpgpversion; - time_t timestamp; - uint32_t clunkytime; - unsigned char openpgpalgo; - unsigned int packetlen; - uint16_t plen; - - gnutls_datum_t m, e, d, p, q, u, g, y; - gnutls_datum_t algolabel; - - char output_data[10240]; - char userid[10240]; - size_t uidsz = sizeof(userid); - - const gnutls_datum_t* all[5]; - int pipefd; - pid_t child_pid; - char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; - const char* algoname; - int mpicount; - int pipestatus; - - init_gnutls(); - - init_datum(&data); - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - - init_datum(&algolabel); - - init_keyid(keyid); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialize private key structure (error: %d)\n", ret); - return 1; - } - - err("assuming PEM formatted private key\n"); - if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { - err("failed to import the PEM-encoded private key (error: %d)\n", ret); - return ret; - } - - algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); - if (algo < 0) { - err("failed to get the algorithm of the PEM-encoded public key (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - err("RSA private key\n"); - ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - err("Modulus size %d, exponent size %d\n", m.size, e.size); - } else if (algo == GNUTLS_PK_DSA) { - err("DSA Key, not implemented!!\n", bits); - return 1; - } else { - err("Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - - /* now we have algo, and the various MPI data are set. Can we - export them as a public subkey packet? */ - - /* this packet should be tagged 14, and should contain: - - 1 octet: version (4) - 4 octets: time of generation (seconds since 1970) - 1 octet: algo (http://tools.ietf.org/html/rfc4880#section-5.5.2 implies 1 for RSA) - - MPI: modulus - MPI: exponent - */ - - packetlen = 1 + 4 + 1; - /* FIXME: this is RSA only. for DSA, there'll be more: */ - packetlen += get_openpgp_mpi_size(&m) + get_openpgp_mpi_size(&e); - - /* FIXME: we should generate this bound more cleanly -- i just - happen to know that 65535 is 2^16-1: */ - if (packetlen > 65535) { - err("packet length is too long (%d)\n", packetlen); - return 1; - } - - /* we're going to emit an old-style packet, with tag 14 (public - subkey), with a two-octet packet length */ - packettag = 0x80 | (14 << 2) | 1; - - write(1, &packettag, sizeof(packettag)); - plen = htons(packetlen); - write(1, &plen, sizeof(plen)); - - openpgpversion = 4; - write(1, &openpgpversion, 1); - - timestamp = time(NULL); - clunkytime = htonl(timestamp); - write(1, &clunkytime, 4); - - /* FIXME: handle things other than RSA */ - openpgpalgo = 1; - write(1, &openpgpalgo, 1); - - write_openpgp_mpi_to_fd(1, &m); - write_openpgp_mpi_to_fd(1, &e); - - gnutls_x509_privkey_deinit(x509_privkey); - gnutls_global_deinit(); - return 0; -} diff --git a/src/keytrans/Makefile b/src/keytrans/Makefile new file mode 100644 index 0000000..fdd4ccd --- /dev/null +++ b/src/keytrans/Makefile @@ -0,0 +1,19 @@ +all: openpgp2ssh + +openpgp2ssh: openpgp2ssh.c gnutls-helpers.o + gcc -g -Wall --pedantic -o openpgp2ssh openpgp2ssh.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + +%.o: %.c + gcc -g -Wall --pedantic -o $@ -c $< + +clean: + rm -f openpgp2ssh gpg2ssh ssh2gpg *.o + +# deprecated: +gpg2ssh: gpg2ssh.c gnutls-helpers.o + gcc -g -Wall --pedantic -o gpg2ssh gpg2ssh.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + +ssh2gpg: ssh2gpg.c gnutls-helpers.o + gcc -g -Wall --pedantic -o ssh2gpg ssh2gpg.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + +.PHONY: clean all diff --git a/src/keytrans/gnutls-helpers.c b/src/keytrans/gnutls-helpers.c new file mode 100644 index 0000000..6eae29e --- /dev/null +++ b/src/keytrans/gnutls-helpers.c @@ -0,0 +1,364 @@ +/* Author: Daniel Kahn Gillmor */ +/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ +/* License: GPL v3 or later */ + +#include "gnutls-helpers.h" +/* for htonl() */ +#include + +/* for setlocale() */ +#include + +/* for isalnum() */ +#include + +int loglevel = 0; + + +void err(const char* fmt, ...) { + va_list ap; + va_start(ap, fmt); + vfprintf(stderr, fmt, ap); + va_end(ap); + fflush(stderr); +} + +void logfunc(int level, const char* string) { + fprintf(stderr, "GnuTLS Logging (%d): %s\n", level, string); +} + +void init_keyid(gnutls_openpgp_keyid_t keyid) { + memset(keyid, 'x', sizeof(gnutls_openpgp_keyid_t)); +} + + + +void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid) +{ + static const char hex[16] = "0123456789ABCDEF"; + unsigned int kix = 0, outix = 0; + + while (kix < sizeof(gnutls_openpgp_keyid_t)) { + out[outix] = hex[(keyid[kix] >> 4) & 0x0f]; + out[outix + 1] = hex[keyid[kix] & 0x0f]; + kix++; + outix += 2; + } +} + + +int init_gnutls() { + const char* version = NULL; + const char* debug_string = NULL; + int ret; + + if (ret = gnutls_global_init(), ret) { + err("Failed to do gnutls_global_init() (error: %d)\n", ret); + return 1; + } + + version = gnutls_check_version(NULL); + + if (version) + err("gnutls version: %s\n", version); + else { + err("no version found!\n"); + return 1; + } + + if (debug_string = getenv("MONKEYSPHERE_DEBUG"), debug_string) { + loglevel = atoi(debug_string); + gnutls_global_set_log_function(logfunc); + + gnutls_global_set_log_level(loglevel); + err("set log level to %d\n", loglevel); + } + return 0; +} + +void init_datum(gnutls_datum_t* d) { + d->data = NULL; + d->size = 0; +} +void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src) { + dest->data = gnutls_realloc(dest->data, src->size); + dest->size = src->size; + memcpy(dest->data, src->data, src->size); +} +int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b) { + if (a->size > b->size) { + err("a is larger\n"); + return 1; + } + if (a->size < b->size) { + err("b is larger\n"); + return -1; + } + return memcmp(a->data, b->data, a->size); +} +void free_datum(gnutls_datum_t* d) { + gnutls_free(d->data); + d->data = NULL; + d->size = 0; +} + +/* read the passed-in string, store in a single datum */ +int set_datum_string(gnutls_datum_t* d, const char* s) { + unsigned int x = strlen(s)+1; + unsigned char* c = NULL; + + c = gnutls_realloc(d->data, x); + if (NULL == c) + return -1; + d->data = c; + d->size = x; + memcpy(d->data, s, x); + return 0; +} + +/* read the passed-in file descriptor until EOF, store in a single + datum */ +int set_datum_fd(gnutls_datum_t* d, int fd) { + unsigned int bufsize = 1024; + unsigned int len = 0; + + FILE* f = fdopen(fd, "r"); + if (bufsize > d->size) { + bufsize = 1024; + d->data = gnutls_realloc(d->data, bufsize); + if (d->data == NULL) { + err("out of memory!\n"); + return -1; + } + d->size = bufsize; + } else { + bufsize = d->size; + } + f = fdopen(fd, "r"); + if (NULL == f) { + err("could not fdopen FD %d\n", fd); + } + clearerr(f); + while (!feof(f) && !ferror(f)) { + if (len == bufsize) { + /* allocate more space by doubling: */ + bufsize *= 2; + d->data = gnutls_realloc(d->data, bufsize); + if (d->data == NULL) { + err("out of memory!\n"); + return -1; + }; + d->size = bufsize; + } + len += fread(d->data + len, 1, bufsize - len, f); + /* err("read %d bytes\n", len); */ + } + if (ferror(f)) { + err("Error reading from fd %d (error: %d) (error: %d '%s')\n", fd, ferror(f), errno, strerror(errno)); + return -1; + } + + /* touch up buffer size to match reality: */ + d->data = gnutls_realloc(d->data, len); + d->size = len; + return 0; +} + +/* read the file indicated (by name) in the fname parameter. store + its entire contents in a single datum. */ +int set_datum_file(gnutls_datum_t* d, const char* fname) { + struct stat sbuf; + unsigned char* c = NULL; + FILE* file = NULL; + size_t x = 0; + + if (0 != stat(fname, &sbuf)) { + err("failed to stat '%s'\n", fname); + return -1; + } + + c = gnutls_realloc(d->data, sbuf.st_size); + if (NULL == c) { + err("failed to allocate %d bytes for '%s'\n", sbuf.st_size, fname); + return -1; + } + + d->data = c; + d->size = sbuf.st_size; + file = fopen(fname, "r"); + if (NULL == file) { + err("failed to open '%s' for reading\n", fname); + return -1; + } + + x = fread(d->data, d->size, 1, file); + if (x != 1) { + err("tried to read %d bytes, read %d instead from '%s'\n", d->size, x, fname); + fclose(file); + return -1; + } + fclose(file); + return 0; +} + +int write_datum_fd(int fd, const gnutls_datum_t* d) { + if (d->size != write(fd, d->data, d->size)) { + err("failed to write body of datum.\n"); + return -1; + } + return 0; +} + + +int write_datum_fd_with_length(int fd, const gnutls_datum_t* d) { + uint32_t len; + int looks_negative = (d->data[0] & 0x80); + unsigned char zero = 0; + + /* if the first bit is 1, then the datum will appear negative in the + MPI encoding style used by OpenSSH. In that case, we'll increase + the length by one, and dump out one more byte */ + + if (looks_negative) { + len = htonl(d->size + 1); + } else { + len = htonl(d->size); + } + if (write(fd, &len, sizeof(len)) != sizeof(len)) { + err("failed to write size of datum.\n"); + return -2; + } + if (looks_negative) { + if (write(fd, &zero, 1) != 1) { + err("failed to write padding byte for MPI.\n"); + return -2; + } + } + return write_datum_fd(fd, d); +} + +int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num) { + unsigned int i; + int ret; + + for (i = 0; i < num; i++) + if (ret = write_datum_fd_with_length(fd, d[i]), ret != 0) + return ret; + + return 0; +} + + +int datum_from_string(gnutls_datum_t* d, const char* str) { + d->size = strlen(str); + d->data = gnutls_realloc(d->data, d->size); + if (d->data == 0) + return ENOMEM; + memcpy(d->data, str, d->size); + return 0; +} + + +int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]) { + int p[2]; + int ret; + + if (pid == NULL) { + err("bad pointer passed to create_writing_pipe()\n"); + return -1; + } + + if (ret = pipe(p), ret == -1) { + err("failed to create a pipe (error: %d \"%s\")\n", errno, strerror(errno)); + return -1; + } + + *pid = fork(); + if (*pid == -1) { + err("Failed to fork (error: %d \"%s\")\n", errno, strerror(errno)); + return -1; + } + if (*pid == 0) { /* this is the child */ + close(p[1]); /* close unused write end */ + + if (0 != dup2(p[0], 0)) { /* map the reading end into stdin */ + err("Failed to transfer reading file descriptor to stdin (error: %d \"%s\")\n", errno, strerror(errno)); + exit(1); + } + execv(path, argv); + err("exec %s failed (error: %d \"%s\")\n", path, errno, strerror(errno)); + /* close the open file descriptors */ + close(p[0]); + close(0); + + exit(1); + } else { /* this is the parent */ + close(p[0]); /* close unused read end */ + return p[1]; + } +} + +int validate_ssh_host_userid(const char* userid) { + char* oldlocale = setlocale(LC_ALL, "C"); + + /* choke if userid does not match the expected format + ("ssh://fully.qualified.domain.name") */ + if (strncmp("ssh://", userid, strlen("ssh://")) != 0) { + err("The user ID should start with ssh:// for a host key\n"); + goto fail; + } + /* so that isalnum will work properly */ + userid += strlen("ssh://"); + while (0 != (*userid)) { + if (!isalnum(*userid)) { + err("label did not start with a letter or a digit! (%s)\n", userid); + goto fail; + } + userid++; + while (isalnum(*userid) || ('-' == (*userid))) + userid++; + if (('.' == (*userid)) || (0 == (*userid))) { /* clean end of label: + check last char + isalnum */ + if (!isalnum(*(userid - 1))) { + err("label did not end with a letter or a digit!\n"); + goto fail; + } + if ('.' == (*userid)) /* advance to the start of the next label */ + userid++; + } else { + err("invalid character in domain name: %c\n", *userid); + goto fail; + } + } + /* ensure that the last character is valid: */ + if (!isalnum(*(userid - 1))) { + err("hostname did not end with a letter or a digit!\n"); + goto fail; + } + /* FIXME: fqdn's can be unicode now, thanks to RFC 3490 -- how do we + make sure that we've got an OK string? */ + + return 0; + + fail: + setlocale(LC_ALL, oldlocale); + return 1; +} + +/* http://tools.ietf.org/html/rfc4880#section-5.5.2 */ +size_t get_openpgp_mpi_size(gnutls_datum_t* d) { + return 2 + d->size; +} + +int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d) { + uint16_t x; + + x = d->size * 8; + x = htons(x); + + write(fd, &x, sizeof(x)); + write(fd, d->data, d->size); + + return 0; +} diff --git a/src/keytrans/gnutls-helpers.h b/src/keytrans/gnutls-helpers.h new file mode 100644 index 0000000..9ea22a3 --- /dev/null +++ b/src/keytrans/gnutls-helpers.h @@ -0,0 +1,72 @@ +/* Author: Daniel Kahn Gillmor */ +/* Date: Fri, 04 Apr 2008 19:31:16 -0400 */ +/* License: GPL v3 or later */ + + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* Functions to help dealing with GnuTLS for monkeysphere key + translation projects: */ + +/* set everything up, including logging levels. Return 0 on + success */ +int init_gnutls(); + +/* logging and output functions: */ + +void err(const char* fmt, ...); +void logfunc(int level, const char* string); + +/* basic datum manipulations: */ + +void init_datum(gnutls_datum_t* d); +void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src); +int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b); +void free_datum(gnutls_datum_t* d); +int write_datum_fd(int fd, const gnutls_datum_t* d); +int write_datum_fd_with_length(int fd, const gnutls_datum_t* d); +int write_data_fd_with_length(int fd, const gnutls_datum_t** d, unsigned int num); + +/* set up a datum from a null-terminated string */ +int datum_from_string(gnutls_datum_t* d, const char* str); + +/* keyid manipulations: */ +typedef unsigned char printable_keyid[16]; + +void init_keyid(gnutls_openpgp_keyid_t keyid); +void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid); + +/* functions to get data into datum objects: */ + +/* read the passed-in string, store in a single datum */ +int set_datum_string(gnutls_datum_t* d, const char* s); + +/* read the passed-in file descriptor until EOF, store in a single + datum */ +int set_datum_fd(gnutls_datum_t* d, int fd); + +/* read the file indicated (by name) in the fname parameter. store + its entire contents in a single datum. */ +int set_datum_file(gnutls_datum_t* d, const char* fname); + +/* set up file descriptor pipe for writing (child process pid gets + stored in pid, fd is returned)*/ +int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]); + +/* return 0 if userid matches the monkeysphere spec for ssh host user IDs */ +int validate_ssh_host_userid(const char* userid); + +/* how many bytes will it take to write out this datum in OpenPGP MPI form? */ +size_t get_openpgp_mpi_size(gnutls_datum_t* d); + +/* write the MPI stored in gnutls_datum_t to file descriptor fd: */ +int write_openpgp_mpi_to_fd(int fd, gnutls_datum_t* d); diff --git a/src/keytrans/gpg2ssh.c b/src/keytrans/gpg2ssh.c new file mode 100644 index 0000000..c99f03f --- /dev/null +++ b/src/keytrans/gpg2ssh.c @@ -0,0 +1,293 @@ +#include "gnutls-helpers.h" + +#include +#include + +/* for waitpid() */ +#include +#include + +/* + Author: Daniel Kahn Gillmor + Date: Tue, 08 Apr 2008 + License: GPL v3 or later + + monkeysphere public key translator: execute this with an GPG + certificate (public key(s) + userid(s)) on stdin. It currently + only works with RSA keys. + + It will spit out a version of the first key capable of being used + for authentication on stdout. The output format should be suitable + for appending a known_hosts file. + + Requirements: I've only built this so far with GnuTLS v2.3.4 -- + version 2.2.0 does not contain the appropriate pieces. + + */ + +int main(int argc, char* argv[]) { + gnutls_datum_t data; + int ret; + gnutls_openpgp_crt_t openpgp_crt; + gnutls_openpgp_keyid_t keyid; + printable_keyid p_keyid; + unsigned int keyidx; + unsigned int usage, bits; + gnutls_pk_algorithm_t algo; + + gnutls_datum_t m, e, p, q, g, y; + gnutls_datum_t algolabel; + + char output_data[10240]; + char userid[10240]; + size_t uidsz = sizeof(userid); + + const gnutls_datum_t* all[5]; + int pipefd; + pid_t child_pid; + char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; + const char* algoname; + int mpicount; + int pipestatus; + + init_gnutls(); + + init_datum(&data); + + init_datum(&m); + init_datum(&e); + init_datum(&p); + init_datum(&q); + init_datum(&g); + init_datum(&y); + + init_datum(&algolabel); + + init_keyid(keyid); + + /* slurp in the private key from stdin */ + if (ret = set_datum_fd(&data, 0), ret) { + err("didn't read file descriptor 0\n"); + return 1; + } + + + if (ret = gnutls_openpgp_crt_init(&openpgp_crt), ret) { + err("Failed to initialize OpenPGP certificate (error: %d)\n", ret); + return 1; + } + + /* format could be either: GNUTLS_OPENPGP_FMT_RAW, + GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, + otherwise, use BASE64: */ + + /* FIXME: we should be auto-detecting the input format, and + translating it as needed. */ + + if (getenv("MONKEYSPHERE_RAW")) { + err("assuming RAW formatted certificate\n"); + if (ret = gnutls_openpgp_crt_import(openpgp_crt, &data, GNUTLS_OPENPGP_FMT_RAW), ret) { + err("failed to import the OpenPGP certificate in RAW format (error: %d)\n", ret); + return ret; + } + } else { + err("assuming BASE64 formatted certificate\n"); + if (ret = gnutls_openpgp_crt_import (openpgp_crt, &data, GNUTLS_OPENPGP_FMT_BASE64), ret) { + err("failed to import the OpenPGP certificate in BASE64 format (error: %d)\n", ret); + return ret; + } + } + + if (gnutls_openpgp_crt_get_revoked_status(openpgp_crt)) { + err("the primary key was revoked!\n"); + return 1; + } + + /* FIXME: We're currently looking at the primary key or maybe the + first authentication-capable subkey. + + Instead, we should be iterating through the primary key and all + subkeys: for each one with the authentication usage flag set of a + algorithm we can handle, we should output matching UserIDs and + the SSH version of the key. */ + + + if (ret = gnutls_openpgp_crt_get_key_usage(openpgp_crt, &usage), ret) { + err("failed to get the usage flags for the primary key (error: %d)\n", ret); + return ret; + } + if (usage & GNUTLS_KEY_KEY_AGREEMENT && + usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { + err("the primary key can be used for authentication and communication encryption!\n"); + + algo = gnutls_openpgp_crt_get_pk_algorithm(openpgp_crt, &bits); + if (algo < 0) { + err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + + err("OpenPGP RSA certificate, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_pk_rsa_raw(openpgp_crt, &m, &e); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA Key, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_pk_dsa_raw(openpgp_crt, &p, &q, &g, &y); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); + return 1; + } + + } else { + err("primary key is not good for authentication and communication encryption. Trying subkeys...\n"); + + if (ret = gnutls_openpgp_crt_get_auth_subkey(openpgp_crt, keyid, 0), ret) { + err("failed to find a subkey capable of authentication and communication encryption (error: %d)\n", ret); + return ret; + } + make_keyid_printable(p_keyid, keyid); + err("found authentication subkey %.16s\n", p_keyid); + + ret = gnutls_openpgp_crt_get_subkey_idx(openpgp_crt, keyid); + if (ret < 0) { + err("could not get the index of subkey %.16s (error: %d)\n", ret); + return ret; + } + keyidx = ret; + + if (gnutls_openpgp_crt_get_subkey_revoked_status(openpgp_crt, keyidx)) { + err("The authentication subkey was revoked!\n"); + return 1; + } + + if (ret = gnutls_openpgp_crt_get_subkey_usage(openpgp_crt, keyidx, &usage), ret) { + err("could not figure out usage of subkey %.16s (error: %d)\n", p_keyid, ret); + return ret; + } + if ((usage & GNUTLS_KEY_KEY_AGREEMENT) == 0 && + usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { + err("could not find a subkey with authentication and communication encryption.\n"); + return 1; + } + + /* switch, based on the algorithm in question, to extract the MPI + components: */ + + algo = gnutls_openpgp_crt_get_subkey_pk_algorithm(openpgp_crt, keyidx, &bits); + if (algo < 0) { + err("failed to get the algorithm of the authentication subkey (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + + err("OpenPGP RSA subkey, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(openpgp_crt, keyidx, &m, &e); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA subkey parameters (error: %d)\n", ret); + return 1; + } + } else if (algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA subkey, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(openpgp_crt, keyidx, &p, &q, &g, &y); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA subkey parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP subkey was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); + return 1; + } + } + + /* make sure userid is NULL-terminated */ + userid[sizeof(userid) - 1] = 0; + uidsz--; + + /* FIXME: we're just choosing the first UserID from the certificate: + instead, we should be selecting every User ID that is adequately + signed and matches the spec, and aggregating them with commas for + known_hosts output */ + + if (ret = gnutls_openpgp_crt_get_name(openpgp_crt, 0, userid, &uidsz), ret) { + err("Failed to fetch the first UserID (error: %d)\n", ret); + return ret; + } + + if (ret = validate_ssh_host_userid(userid), ret) { + err("bad userid: not a valid ssh host.\n"); + return ret; + } + + /* remove ssh:// from the beginning of userid */ + memmove(userid, userid + strlen("ssh://"), 1 + strlen(userid) - strlen("ssh://")); + + + /* now we have algo, and the various MPI data are set. Can we + export them cleanly? */ + + /* for the moment, we'll just dump the info raw, and pipe it + externally through coreutils' /usr/bin/base64 */ + + if (algo == GNUTLS_PK_RSA) { + algoname = "ssh-rsa"; + mpicount = 3; + + all[0] = &algolabel; + all[1] = &e; + all[2] = &m; + } else if (algo == GNUTLS_PK_DSA) { + algoname = "ssh-dss"; + mpicount = 5; + + all[0] = &algolabel; + all[1] = &p; + all[2] = &q; + all[3] = &g; + all[4] = &y; + } else { + err("no idea what this algorithm is: %d\n", algo); + return 1; + } + + if (ret = datum_from_string(&algolabel, algoname), ret) { + err("couldn't label string (error: %d)\n", ret); + return ret; + } + + snprintf(output_data, sizeof(output_data), "%s %s ", userid, algoname); + + pipefd = create_writing_pipe(&child_pid, args[0], args); + if (pipefd < 0) { + err("failed to create a writing pipe (returned %d)\n", pipefd); + return pipefd; + } + + write(1, output_data, strlen(output_data)); + + if (0 != write_data_fd_with_length(pipefd, all, mpicount)) { + err("was not able to write out RSA key data\n"); + return 1; + } + close(pipefd); + if (child_pid != waitpid(child_pid, &pipestatus, 0)) { + err("could not wait for child process to return for some reason.\n"); + return 1; + } + if (pipestatus != 0) { + err("base64 pipe died with return code %d\n", pipestatus); + return pipestatus; + } + + write(1, "\n", 1); + + + + gnutls_openpgp_crt_deinit(openpgp_crt); + gnutls_global_deinit(); + return 0; +} diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c new file mode 100644 index 0000000..d6bac68 --- /dev/null +++ b/src/keytrans/openpgp2ssh.c @@ -0,0 +1,271 @@ +#include "gnutls-helpers.h" + +#include +#include + +/* + Author: Daniel Kahn Gillmor + Date: Tue, 01 Apr 2008 + License: GPL v3 or later + + monkeysphere private key translator: execute this with an GPG + secret key on stdin (at the moment, only passphraseless RSA keys + work). + + It will spit out a PEM-encoded version of the key on stdout, which + can be fed into ssh-add like this: + + gpg --export-secret-keys $KEYID | monkeysphere | ssh-add -c /dev/stdin + + Requirements: I've only built this so far with GnuTLS v2.3.4 -- + version 2.2.0 does not contain the appropriate pieces. + + Notes: gpgkey2ssh doesn't seem to provide the same public + keys. Mighty weird! + +0 wt215@squeak:~/monkeysphere$ gpg --export-secret-keys 1DCDF89F | ~dkg/src/monkeysphere/monkeysphere | ssh-add -c /dev/stdin +gnutls version: 2.3.4 +OpenPGP RSA Key, with 1024 bits +Identity added: /dev/stdin (/dev/stdin) +The user has to confirm each use of the key +0 wt215@squeak:~/monkeysphere$ ssh-add -L +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC9gWQqfrnhQKDQnND/3eOexpddE64J+1zp9fcyCje7H5LKclb6DBV2HS6WgW32PJhIzvP+fYZM3dzXea3fpv14y1SicXiRBDgF9SnsNA1qWn2RyzkLcKy7PmM0PDYtU1oiLTcQj/xkWcqW2sLKHT/WW+vZP5XP7RMGN/yWNMfE2Q== /dev/stdin +0 wt215@squeak:~/monkeysphere$ gpgkey2ssh 1DCDF89F +ssh-rsa AAAAB3NzaC1yc2EAAACBAL2BZCp+ueFAoNCc0P/d457Gl10Trgn7XOn19zIKN7sfkspyVvoMFXYdLpaBbfY8mEjO8/59hkzd3Nd5rd+m/XjLVKJxeJEEOAX1Kew0DWpafZHLOQtwrLs+YzQ8Ni1TWiItNxCP/GRZypbawsodP9Zb69k/lc/tEwY3/JY0x8TZAAAAAwEAAQ== COMMENT +0 wt215@squeak:~/monkeysphere$ + + */ + + +int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { + gnutls_openpgp_privkey_t pgp_privkey; + gnutls_datum_t m, e, d, p, q, u, g, y, x; + gnutls_pk_algorithm_t pgp_algo; + unsigned int pgp_bits; + int ret; + + init_datum(&m); + init_datum(&e); + init_datum(&d); + init_datum(&p); + init_datum(&q); + init_datum(&u); + init_datum(&g); + init_datum(&y); + init_datum(&x); + + if (ret = gnutls_openpgp_privkey_init(&pgp_privkey), ret) { + err("Failed to initialized OpenPGP private key (error: %d)\n", ret); + return 1; + } + + + /* format could be either: GNUTLS_OPENPGP_FMT_RAW, + GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, + otherwise, use BASE64: */ + + if (getenv("MONKEYSPHERE_RAW")) { + err("assuming RAW formatted private keys\n"); + if (ret = gnutls_openpgp_privkey_import(pgp_privkey, input, GNUTLS_OPENPGP_FMT_RAW, NULL, 0), ret) + err("failed to import the OpenPGP private key in RAW format (error: %d)\n", ret); + } else { + err("assuming BASE64 formatted private keys\n"); + if (ret = gnutls_openpgp_privkey_import (pgp_privkey, input, GNUTLS_OPENPGP_FMT_BASE64, NULL, 0), ret) + err("failed to import the OpenPGP private key in BASE64 format (error: %d)\n", ret); + } + + pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(pgp_privkey, &pgp_bits); + if (pgp_algo < 0) { + err("failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); + return 1; + } + if (pgp_algo == GNUTLS_PK_RSA) { + err("OpenPGP RSA Key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_rsa_raw(pgp_privkey, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + + ret = gnutls_x509_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (pgp_algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA Key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_dsa_raw(pgp_privkey, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + + ret = gnutls_x509_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import DSA key parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", pgp_algo); + return 1; + } + + ret = gnutls_x509_privkey_fix(*output); + if (ret != 0) { + err("failed to fix up the private key in X.509 format (error: %d)\n", ret); + return 1; + } + + gnutls_openpgp_privkey_deinit(pgp_privkey); + return 0; +} + +int convert_x509_to_pgp(gnutls_openpgp_privkey_t* output, gnutls_datum_t* input) { + gnutls_x509_privkey_t x509_privkey; + gnutls_datum_t m, e, d, p, q, u, g, y, x; + gnutls_pk_algorithm_t x509_algo; + int ret; + + init_datum(&m); + init_datum(&e); + init_datum(&d); + init_datum(&p); + init_datum(&q); + init_datum(&u); + init_datum(&g); + init_datum(&y); + init_datum(&x); + + if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { + err("Failed to initialized X.509 private key (error: %d)\n", ret); + return 1; + } + + + /* format could be either: GNUTLS_X509_FMT_DER, + GNUTLS_X509_FMT_PEM; if MONKEYSPHERE_DER is set, use DER, + otherwise, use PEM: */ + + if (getenv("MONKEYSPHERE_DER")) { + err("assuming DER formatted private keys\n"); + if (ret = gnutls_x509_privkey_import(x509_privkey, input, GNUTLS_X509_FMT_DER), ret) + err("failed to import the X.509 private key in DER format (error: %d)\n", ret); + } else { + err("assuming PEM formatted private keys\n"); + if (ret = gnutls_x509_privkey_import (x509_privkey, input, GNUTLS_X509_FMT_PEM), ret) + err("failed to import the X.509 private key in PEM format (error: %d)\n", ret); + } + + x509_algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); + if (x509_algo < 0) { + err("failed to get X.509 key algorithm (error: %d)\n", x509_algo); + return 1; + } + if (x509_algo == GNUTLS_PK_RSA) { + err("X.509 RSA Key\n"); + ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + + /* ret = gnutls_openpgp_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); */ + ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (x509_algo == GNUTLS_PK_DSA) { + err("X.509 DSA Key\n"); + ret = gnutls_x509_privkey_export_dsa_raw(x509_privkey, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + + /* ret = gnutls_openpgp_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); */ + ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to import DSA key parameters (error: %d)\n", ret); + return 1; + } + } else { + err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", x509_algo); + return 1; + } + + gnutls_x509_privkey_deinit(x509_privkey); + return 0; +} + + +int main(int argc, char* argv[]) { + gnutls_datum_t data; + int ret; + gnutls_x509_privkey_t x509_privkey; + + char output_data[10240]; + size_t ods = sizeof(output_data); + + init_gnutls(); + + init_datum(&data); + + /* slurp in the private key from stdin */ + if (ret = set_datum_fd(&data, 0), ret) { + err("didn't read file descriptor 0\n"); + return 1; + } + + + + /* Or, instead, read in key from a file name: + if (ret = set_datum_file(&data, argv[1]), ret) { + err("didn't read file '%s'\n", argv[1]); + return 1; + } +*/ + + /* treat the passed file as an X.509 private key, and extract its + component values: */ + +/* if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { */ +/* err("Failed to import the X.509 key (error: %d)\n", ret); */ +/* return 1; */ +/* } */ +/* gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); */ + + /* try to print the PEM-encoded private key: */ +/* ret = gnutls_x509_privkey_export (x509_privkey, */ +/* GNUTLS_X509_FMT_PEM, */ +/* output_data, */ +/* &ods); */ +/* printf("ret: %u; ods: %u;\n", ret, ods); */ +/* if (ret == 0) { */ +/* write(0, output_data, ods); */ +/* } */ + + + if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { + err("Failed to initialize X.509 private key (error: %d)\n", ret); + return 1; + } + + if (ret = convert_pgp_to_x509(&x509_privkey, &data), ret) { + return ret; + } + + ret = gnutls_x509_privkey_export (x509_privkey, + GNUTLS_X509_FMT_PEM, + output_data, + &ods); + printf("ret: %u; ods: %u;\n", ret, ods); + if (ret == 0) { + write(1, output_data, ods); + } + + + gnutls_x509_privkey_deinit(x509_privkey); + gnutls_global_deinit(); + return 0; +} diff --git a/src/keytrans/ssh2gpg.c b/src/keytrans/ssh2gpg.c new file mode 100644 index 0000000..b14a540 --- /dev/null +++ b/src/keytrans/ssh2gpg.c @@ -0,0 +1,171 @@ +#include "gnutls-helpers.h" + +#include +#include + +/* for waitpid() */ +#include +#include + +/* for time() */ +#include + +/* for htons() */ +#include + + +/* + Author: Daniel Kahn Gillmor + Date: Sun, 2008-04-20 + License: GPL v3 or later + + monkeysphere public key translator: execute this with an ssh + private key on stdin. It currently only works with RSA keys. + + it should eventually work with OpenSSH-style public keys instead of + the full private key, but it was easier to do this way. + + It shoud spit out a version of the public key suitable for acting + as an OpenPGP public sub key packet. + + */ + +int main(int argc, char* argv[]) { + gnutls_datum_t data; + int ret; + gnutls_x509_privkey_t x509_privkey; + gnutls_openpgp_crt_t openpgp_crt; + gnutls_openpgp_keyid_t keyid; + printable_keyid p_keyid; + unsigned int keyidx; + unsigned int usage, bits; + gnutls_pk_algorithm_t algo; + + unsigned char packettag; + unsigned char openpgpversion; + time_t timestamp; + uint32_t clunkytime; + unsigned char openpgpalgo; + unsigned int packetlen; + uint16_t plen; + + gnutls_datum_t m, e, d, p, q, u, g, y; + gnutls_datum_t algolabel; + + char output_data[10240]; + char userid[10240]; + size_t uidsz = sizeof(userid); + + const gnutls_datum_t* all[5]; + int pipefd; + pid_t child_pid; + char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; + const char* algoname; + int mpicount; + int pipestatus; + + init_gnutls(); + + init_datum(&data); + + init_datum(&m); + init_datum(&e); + init_datum(&d); + init_datum(&p); + init_datum(&q); + init_datum(&u); + init_datum(&g); + init_datum(&y); + + init_datum(&algolabel); + + init_keyid(keyid); + + /* slurp in the private key from stdin */ + if (ret = set_datum_fd(&data, 0), ret) { + err("didn't read file descriptor 0\n"); + return 1; + } + + + if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { + err("Failed to initialize private key structure (error: %d)\n", ret); + return 1; + } + + err("assuming PEM formatted private key\n"); + if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { + err("failed to import the PEM-encoded private key (error: %d)\n", ret); + return ret; + } + + algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); + if (algo < 0) { + err("failed to get the algorithm of the PEM-encoded public key (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + err("RSA private key\n"); + ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + err("Modulus size %d, exponent size %d\n", m.size, e.size); + } else if (algo == GNUTLS_PK_DSA) { + err("DSA Key, not implemented!!\n", bits); + return 1; + } else { + err("Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); + return 1; + } + + /* now we have algo, and the various MPI data are set. Can we + export them as a public subkey packet? */ + + /* this packet should be tagged 14, and should contain: + + 1 octet: version (4) + 4 octets: time of generation (seconds since 1970) + 1 octet: algo (http://tools.ietf.org/html/rfc4880#section-5.5.2 implies 1 for RSA) + + MPI: modulus + MPI: exponent + */ + + packetlen = 1 + 4 + 1; + /* FIXME: this is RSA only. for DSA, there'll be more: */ + packetlen += get_openpgp_mpi_size(&m) + get_openpgp_mpi_size(&e); + + /* FIXME: we should generate this bound more cleanly -- i just + happen to know that 65535 is 2^16-1: */ + if (packetlen > 65535) { + err("packet length is too long (%d)\n", packetlen); + return 1; + } + + /* we're going to emit an old-style packet, with tag 14 (public + subkey), with a two-octet packet length */ + packettag = 0x80 | (14 << 2) | 1; + + write(1, &packettag, sizeof(packettag)); + plen = htons(packetlen); + write(1, &plen, sizeof(plen)); + + openpgpversion = 4; + write(1, &openpgpversion, 1); + + timestamp = time(NULL); + clunkytime = htonl(timestamp); + write(1, &clunkytime, 4); + + /* FIXME: handle things other than RSA */ + openpgpalgo = 1; + write(1, &openpgpalgo, 1); + + write_openpgp_mpi_to_fd(1, &m); + write_openpgp_mpi_to_fd(1, &e); + + gnutls_x509_privkey_deinit(x509_privkey); + gnutls_global_deinit(); + return 0; +} -- cgit v1.2.3 From 6f2d6f78cd11231d6f7ffd6361812b1bd49a4c34 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 12 Jun 2008 17:25:55 -0400 Subject: Major openpgp2ssh overhaul. It's an unforgiving and brittle tool, but it should do what we expect it to do, and its major limitations should be documented in the man page. --- man/man1/openpgp2ssh.1 | 47 ++++-- src/keytrans/gnutls-helpers.c | 68 ++++++++ src/keytrans/gnutls-helpers.h | 4 + src/keytrans/openpgp2ssh.c | 357 +++++++++++++++++++++++++++++++----------- 4 files changed, 371 insertions(+), 105 deletions(-) diff --git a/man/man1/openpgp2ssh.1 b/man/man1/openpgp2ssh.1 index 6267141..1a02b38 100644 --- a/man/man1/openpgp2ssh.1 +++ b/man/man1/openpgp2ssh.1 @@ -12,16 +12,16 @@ openpgp2ssh .Nm gpg --export-secret-key $KEYID | openpgp2ssh $KEYID .Sh DESCRIPTION -openpgp2ssh takes OpenPGP-formatted RSA and DSA keys on standard -input, and spits out the requested equivalent SSH-style key on -standard output. +openpgp2ssh takes an OpenPGP-formatted primary key and associated +subkeys on standard input, and spits out the requested equivalent +SSH-style key on standard output. -If the data on standard input contains only a single key, you can -invoke openpgp2ssh without arguments. If the data on standard input -contains multiple keys (e.g. a primary key and associated subkeys), -you must specify a specific OpenPGP keyid (e.g. CCD2ED94D21739E9) or +If the data on standard input contains no subkeys, you can invoke +openpgp2ssh without arguments. If the data on standard input contains +multiple keys (e.g. a primary key and associated subkeys), you must +specify a specific OpenPGP keyid (e.g. CCD2ED94D21739E9) or fingerprint as the first argument to indicate which key to export. -The keyid must be at least 8 hex characters. +The keyid must be exactly 16 hex characters. If the input contains an OpenPGP RSA or DSA public key, it will be converted to the OpenSSH-style single-line keystring, prefixed with @@ -31,20 +31,29 @@ insertion into known_hosts files and authorized_keys files. If the input contains an OpenPGP RSA or DSA secret key, it will be converted to the equivalent PEM-encoded private key. -Note that the keys produced by this process are stripped of all -identifying information, including certifications, self-signatures, -etc. - openpgp2ssh is part of the .Xr monkeysphere 1 framework for providing a PKI for SSH. +.Sh CAVEATS +The keys produced by this process are stripped of all identifying +information, including certifications, self-signatures, etc. This is +intentional, since ssh attaches no inherent significance to these +features. + +openpgp2ssh only works with RSA or DSA keys, because those are the +only ones which work with ssh. + +Assuming a valid key type, though, openpgp2ssh will produce output for +any requested key. This means, among other things, that it will +happily export revoked keys, unverifiable keys, expired keys, etc. +Make sure you do your own key validation before using this tool! .Sh EXAMPLES .Nm gpg --export-secret-key $KEYID | openpgp2ssh $KEYID | ssh-add -c /dev/stdin This pushes the secret key into the active .Xr ssh-agent 1 . -Tools (such as -.Xr ssh 1 ) +Tools such as +.Xr ssh 1 which know how to talk to the .Xr ssh-agent 1 can now rely on the key. @@ -58,8 +67,14 @@ lsh(1) and putty(1). Secret key output is currently not passphrase-protected. -This program is not yet implemented, and this man page currently only -describes expected functionality. +openpgp2ssh currently cannot handle passphrase-protected secret keys on input. + +It would be nice to be able to use keyids shorter or longer than 16 +hex characters. + +openpgp2ssh only acts on keys associated with the first primary key +passed in. If you send it more than one primary key, it will silently +ignore later ones. .Sh SEE ALSO .Xr monkeysphere 1 , .Xr ssh 1 , diff --git a/src/keytrans/gnutls-helpers.c b/src/keytrans/gnutls-helpers.c index 6eae29e..7c342bb 100644 --- a/src/keytrans/gnutls-helpers.c +++ b/src/keytrans/gnutls-helpers.c @@ -12,6 +12,9 @@ /* for isalnum() */ #include +/* for exit() */ +#include + int loglevel = 0; @@ -46,6 +49,71 @@ void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid) } } +unsigned char hex2bin(unsigned char x) { + if ((x >= '0') && (x <= '9')) + return x - '0'; + if ((x >= 'A') && (x <= 'F')) + return 10 + x - 'A'; + if ((x >= 'a') && (x <= 'f')) + return 10 + x - 'a'; + return 0xff; +} + +void collapse_printable_keyid(gnutls_openpgp_keyid_t out, printable_keyid in) { + unsigned int pkix = 0, outkix = 0; + + while (pkix < sizeof(printable_keyid)) { + unsigned hi = hex2bin(in[pkix]); + unsigned lo = hex2bin(in[pkix + 1]); + if (hi == 0xff) { + err("character '%c' is not a hex char\n", in[pkix]); + exit(1); + } + if (lo == 0xff) { + err("character '%c' is not a hex char\n", in[pkix + 1]); + exit(1); + } + out[outkix] = lo | (hi << 4); + + pkix += 2; + outkix++; + } +} + +int convert_string_to_keyid(gnutls_openpgp_keyid_t out, const char* str) { + printable_keyid p; + int ret; + + ret = convert_string_to_printable_keyid(p, str); + if (ret == 0) + collapse_printable_keyid(out, p); + return ret; +} +int convert_string_to_printable_keyid(printable_keyid pkeyid, const char* str) { + int arglen, x; + arglen = 0; + x = 0; + while ((arglen <= sizeof(printable_keyid)) && + (str[x] != '\0')) { + if (isxdigit(str[x])) { + if (arglen == sizeof(printable_keyid)) { + err("There are more than %d hex digits in the keyid '%s'\n", sizeof(printable_keyid), str); + return 1; + } + pkeyid[arglen] = str[x]; + arglen++; + } + x++; + } + + if (arglen != sizeof(printable_keyid)) { + err("keyid '%s' is not %d hex digits in length\n", str, sizeof(printable_keyid)); + return 1; + } + return 0; +} + + int init_gnutls() { const char* version = NULL; diff --git a/src/keytrans/gnutls-helpers.h b/src/keytrans/gnutls-helpers.h index 9ea22a3..00cdec7 100644 --- a/src/keytrans/gnutls-helpers.h +++ b/src/keytrans/gnutls-helpers.h @@ -44,6 +44,10 @@ typedef unsigned char printable_keyid[16]; void init_keyid(gnutls_openpgp_keyid_t keyid); void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid); +void collapse_printable_keyid(gnutls_openpgp_keyid_t out, printable_keyid in); +int convert_string_to_keyid(gnutls_openpgp_keyid_t out, const char* str); +int convert_string_to_printable_keyid(printable_keyid out, const char* str); + /* functions to get data into datum objects: */ diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c index d6bac68..30e19d5 100644 --- a/src/keytrans/openpgp2ssh.c +++ b/src/keytrans/openpgp2ssh.c @@ -3,47 +3,47 @@ #include #include +/* for waitpid() */ +#include +#include + /* Author: Daniel Kahn Gillmor - Date: Tue, 01 Apr 2008 + Date: 2008-06-12 13:47:41-0400 License: GPL v3 or later - monkeysphere private key translator: execute this with an GPG - secret key on stdin (at the moment, only passphraseless RSA keys - work). + monkeysphere key translator: execute this with an OpenPGP key on + stdin, (please indicate the specific keyid that you want as the + first argument if there are subkeys). At the moment, only public + keys and passphraseless secret keys work. - It will spit out a PEM-encoded version of the key on stdout, which - can be fed into ssh-add like this: + For secret keys, it will spit out a PEM-encoded version of the key + on stdout, which can be fed into ssh-add like this: - gpg --export-secret-keys $KEYID | monkeysphere | ssh-add -c /dev/stdin + gpg --export-secret-keys $KEYID | openpgp2ssh $KEYID | ssh-add -c /dev/stdin - Requirements: I've only built this so far with GnuTLS v2.3.4 -- - version 2.2.0 does not contain the appropriate pieces. + For public keys, it will spit out a single line of text that can + (with some massaging) be used in an openssh known_hosts or + authorized_keys file. For example: - Notes: gpgkey2ssh doesn't seem to provide the same public - keys. Mighty weird! + echo server.example.org $(gpg --export $KEYID | openpgp2ssh $KEYID) >> ~/.ssh/known_hosts -0 wt215@squeak:~/monkeysphere$ gpg --export-secret-keys 1DCDF89F | ~dkg/src/monkeysphere/monkeysphere | ssh-add -c /dev/stdin -gnutls version: 2.3.4 -OpenPGP RSA Key, with 1024 bits -Identity added: /dev/stdin (/dev/stdin) -The user has to confirm each use of the key -0 wt215@squeak:~/monkeysphere$ ssh-add -L -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC9gWQqfrnhQKDQnND/3eOexpddE64J+1zp9fcyCje7H5LKclb6DBV2HS6WgW32PJhIzvP+fYZM3dzXea3fpv14y1SicXiRBDgF9SnsNA1qWn2RyzkLcKy7PmM0PDYtU1oiLTcQj/xkWcqW2sLKHT/WW+vZP5XP7RMGN/yWNMfE2Q== /dev/stdin -0 wt215@squeak:~/monkeysphere$ gpgkey2ssh 1DCDF89F -ssh-rsa AAAAB3NzaC1yc2EAAACBAL2BZCp+ueFAoNCc0P/d457Gl10Trgn7XOn19zIKN7sfkspyVvoMFXYdLpaBbfY8mEjO8/59hkzd3Nd5rd+m/XjLVKJxeJEEOAX1Kew0DWpafZHLOQtwrLs+YzQ8Ni1TWiItNxCP/GRZypbawsodP9Zb69k/lc/tEwY3/JY0x8TZAAAAAwEAAQ== COMMENT -0 wt215@squeak:~/monkeysphere$ + Requirements: I've only built this so far with GnuTLS v2.3.x. + GnuTLS 2.2.x does not contain the appropriate functionality. */ -int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { - gnutls_openpgp_privkey_t pgp_privkey; +/* FIXME: keyid should be const as well */ +int convert_private_pgp_to_x509(gnutls_x509_privkey_t* output, const gnutls_openpgp_privkey_t* pgp_privkey, gnutls_openpgp_keyid_t* keyid) { gnutls_datum_t m, e, d, p, q, u, g, y, x; gnutls_pk_algorithm_t pgp_algo; unsigned int pgp_bits; int ret; +/* FIXME: actually respect keyid argument. At the moment, we just + emit the primary key. */ + init_datum(&m); init_datum(&e); init_datum(&d); @@ -54,34 +54,14 @@ int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { init_datum(&y); init_datum(&x); - if (ret = gnutls_openpgp_privkey_init(&pgp_privkey), ret) { - err("Failed to initialized OpenPGP private key (error: %d)\n", ret); - return 1; - } - - - /* format could be either: GNUTLS_OPENPGP_FMT_RAW, - GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, - otherwise, use BASE64: */ - - if (getenv("MONKEYSPHERE_RAW")) { - err("assuming RAW formatted private keys\n"); - if (ret = gnutls_openpgp_privkey_import(pgp_privkey, input, GNUTLS_OPENPGP_FMT_RAW, NULL, 0), ret) - err("failed to import the OpenPGP private key in RAW format (error: %d)\n", ret); - } else { - err("assuming BASE64 formatted private keys\n"); - if (ret = gnutls_openpgp_privkey_import (pgp_privkey, input, GNUTLS_OPENPGP_FMT_BASE64, NULL, 0), ret) - err("failed to import the OpenPGP private key in BASE64 format (error: %d)\n", ret); - } - - pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(pgp_privkey, &pgp_bits); + pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(*pgp_privkey, &pgp_bits); if (pgp_algo < 0) { err("failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); return 1; } if (pgp_algo == GNUTLS_PK_RSA) { err("OpenPGP RSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_rsa_raw(pgp_privkey, &m, &e, &d, &p, &q, &u); + ret = gnutls_openpgp_privkey_export_rsa_raw(*pgp_privkey, &m, &e, &d, &p, &q, &u); if (GNUTLS_E_SUCCESS != ret) { err ("failed to export RSA key parameters (error: %d)\n", ret); return 1; @@ -94,7 +74,7 @@ int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { } } else if (pgp_algo == GNUTLS_PK_DSA) { err("OpenPGP DSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_dsa_raw(pgp_privkey, &p, &q, &g, &y, &x); + ret = gnutls_openpgp_privkey_export_dsa_raw(*pgp_privkey, &p, &q, &g, &y, &x); if (GNUTLS_E_SUCCESS != ret) { err ("failed to export DSA key parameters (error: %d)\n", ret); return 1; @@ -116,10 +96,190 @@ int convert_pgp_to_x509(gnutls_x509_privkey_t* output, gnutls_datum_t* input) { return 1; } - gnutls_openpgp_privkey_deinit(pgp_privkey); return 0; } +/* FIXME: keyid should be const also */ +int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_openpgp_keyid_t* keyid) { + gnutls_openpgp_keyid_t curkeyid; + int ret; + int subkeyidx; + int subkeycount; + int found = 0; + gnutls_datum_t m, e, p, q, g, y, algolabel; + unsigned int bits; + gnutls_pk_algorithm_t algo; + const gnutls_datum_t* all[5]; + const char* algoname; + int mpicount; + /* output_data must be at least 2 chars longer than the maximum possible + algorithm name: */ + char output_data[20]; + + /* variables for the output conversion: */ + int pipestatus; + int pipefd, child_pid; + char* const b64args[] = {"/usr/bin/base64", "--wrap=0", NULL}; + + init_datum(&m); + init_datum(&e); + init_datum(&p); + init_datum(&q); + init_datum(&g); + init_datum(&algolabel); + + + /* figure out if we've got the right thing: */ + subkeycount = gnutls_openpgp_crt_get_subkey_count(*pgp_crt); + if (subkeycount < 0) { + err("Could not determine subkey count (got value %d)\n", subkeycount); + return 1; + } + + if ((keyid == NULL) && + (subkeycount > 0)) { + err("No keyid passed in, but there were %d keys to choose from\n", subkeycount + 1); + return 1; + } + + if (keyid != NULL) { + ret = gnutls_openpgp_crt_get_key_id(*pgp_crt, curkeyid); + if (ret) { + err("Could not get keyid (error: %d)\n", ret); + return 1; + } + } + if ((keyid == NULL) || (memcmp(*keyid, curkeyid, sizeof(gnutls_openpgp_keyid_t)) == 0)) { + /* we want to export the primary key: */ + err("exporting primary key\n"); + + /* FIXME: this is almost identical to the block below for subkeys. + This clumsiness seems inherent in the gnutls OpenPGP API, + though. ugh. */ + algo = gnutls_openpgp_crt_get_pk_algorithm(*pgp_crt, &bits); + if (algo < 0) { + err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + err("OpenPGP RSA certificate, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_pk_rsa_raw(*pgp_crt, &m, &e); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA Key, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_pk_dsa_raw(*pgp_crt, &p, &q, &g, &y); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + } + found = 1; + + } else { + /* lets trawl through the subkeys until we find the one we want: */ + for (subkeyidx = 0; (subkeyidx < subkeycount) && !found; subkeyidx++) { + ret = gnutls_openpgp_crt_get_subkey_id(*pgp_crt, subkeyidx, curkeyid); + if (ret) { + err("Could not get keyid of subkey with index %d (error: %d)\n", subkeyidx, ret); + return 1; + } + if (memcmp(*keyid, curkeyid, sizeof(gnutls_openpgp_keyid_t)) == 0) { + err("exporting subkey index %d\n", subkeyidx); + + /* FIXME: this is almost identical to the block above for the + primary key. */ + algo = gnutls_openpgp_crt_get_subkey_pk_algorithm(*pgp_crt, subkeyidx, &bits); + if (algo < 0) { + err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); + return algo; + } else if (algo == GNUTLS_PK_RSA) { + err("OpenPGP RSA certificate, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(*pgp_crt, subkeyidx, &m, &e); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (algo == GNUTLS_PK_DSA) { + err("OpenPGP DSA Key, with %d bits\n", bits); + ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(*pgp_crt, subkeyidx, &p, &q, &g, &y); + if (GNUTLS_E_SUCCESS != ret) { + err ("failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + } + found = 1; + + } + } + } + + if (!found) { + err("Could not find key in input\n"); + return 1; + } + + /* if we made it this far, we've got MPIs, and we've got the + algorithm, so we just need to emit the info */ + if (algo == GNUTLS_PK_RSA) { + algoname = "ssh-rsa"; + mpicount = 3; + + all[0] = &algolabel; + all[1] = &e; + all[2] = &m; + } else if (algo == GNUTLS_PK_DSA) { + algoname = "ssh-dss"; + mpicount = 5; + + all[0] = &algolabel; + all[1] = &p; + all[2] = &q; + all[3] = &g; + all[4] = &y; + } else { + err("Key algorithm was neither DSA nor RSA (it was %d). Can't deal. Sorry!\n", algo); + return 1; + } + + if (ret = datum_from_string(&algolabel, algoname), ret) { + err("couldn't label string (error: %d)\n", ret); + return ret; + } + + snprintf(output_data, sizeof(output_data), "%s ", algoname); + + pipefd = create_writing_pipe(&child_pid, b64args[0], b64args); + if (pipefd < 0) { + err("failed to create a writing pipe (returned %d)\n", pipefd); + return pipefd; + } + + write(1, output_data, strlen(output_data)); + + if (0 != write_data_fd_with_length(pipefd, all, mpicount)) { + err("was not able to write out RSA key data\n"); + return 1; + } + close(pipefd); + if (child_pid != waitpid(child_pid, &pipestatus, 0)) { + err("could not wait for child process to return for some reason.\n"); + return 1; + } + if (pipestatus != 0) { + err("base64 pipe died with return code %d\n", pipestatus); + return pipestatus; + } + + write(1, "\n", 1); + + + return 0; +} + + + int convert_x509_to_pgp(gnutls_openpgp_privkey_t* output, gnutls_datum_t* input) { gnutls_x509_privkey_t x509_privkey; gnutls_datum_t m, e, d, p, q, u, g, y, x; @@ -203,69 +363,88 @@ int main(int argc, char* argv[]) { gnutls_datum_t data; int ret; gnutls_x509_privkey_t x509_privkey; + gnutls_openpgp_privkey_t pgp_privkey; + gnutls_openpgp_crt_t pgp_crt; char output_data[10240]; size_t ods = sizeof(output_data); + + gnutls_openpgp_keyid_t keyid; + gnutls_openpgp_keyid_t* use_keyid; init_gnutls(); + + /* figure out what keyid we should be looking for: */ + use_keyid = NULL; + if (argv[1] != NULL) { + ret = convert_string_to_keyid(keyid, argv[1]); + if (ret != 0) + return ret; + use_keyid = &keyid; + } + init_datum(&data); - /* slurp in the private key from stdin */ + /* slurp in the key from stdin */ if (ret = set_datum_fd(&data, 0), ret) { err("didn't read file descriptor 0\n"); return 1; } - - /* Or, instead, read in key from a file name: - if (ret = set_datum_file(&data, argv[1]), ret) { - err("didn't read file '%s'\n", argv[1]); + if (ret = gnutls_openpgp_privkey_init(&pgp_privkey), ret) { + err("Failed to initialized OpenPGP private key (error: %d)\n", ret); return 1; } -*/ - - /* treat the passed file as an X.509 private key, and extract its - component values: */ - -/* if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { */ -/* err("Failed to import the X.509 key (error: %d)\n", ret); */ -/* return 1; */ -/* } */ -/* gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); */ - - /* try to print the PEM-encoded private key: */ -/* ret = gnutls_x509_privkey_export (x509_privkey, */ -/* GNUTLS_X509_FMT_PEM, */ -/* output_data, */ -/* &ods); */ -/* printf("ret: %u; ods: %u;\n", ret, ods); */ -/* if (ret == 0) { */ -/* write(0, output_data, ods); */ -/* } */ - - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialize X.509 private key (error: %d)\n", ret); - return 1; + /* check whether it's a private key or a public key, by trying them: */ + if ((gnutls_openpgp_privkey_import(pgp_privkey, &data, GNUTLS_OPENPGP_FMT_RAW, NULL, 0) == 0) || + (gnutls_openpgp_privkey_import(pgp_privkey, &data, GNUTLS_OPENPGP_FMT_BASE64, NULL, 0) == 0)) { + /* we're dealing with a private key */ + err("Translating private key\n"); + if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { + err("Failed to initialize X.509 private key for output (error: %d)\n", ret); + return 1; + } + + ret = convert_private_pgp_to_x509(&x509_privkey, &pgp_privkey, use_keyid); + + gnutls_openpgp_privkey_deinit(pgp_privkey); + if (ret) + return ret; + + ret = gnutls_x509_privkey_export (x509_privkey, + GNUTLS_X509_FMT_PEM, + output_data, + &ods); + if (ret == 0) { + write(1, output_data, ods); + } + gnutls_x509_privkey_deinit(x509_privkey); + + } else { + if (ret = gnutls_openpgp_crt_init(&pgp_crt), ret) { + err("Failed to initialized OpenPGP certificate (error: %d)\n", ret); + return 1; + } + + if ((gnutls_openpgp_crt_import(pgp_crt, &data, GNUTLS_OPENPGP_FMT_RAW) == 0) || + (gnutls_openpgp_crt_import(pgp_crt, &data, GNUTLS_OPENPGP_FMT_BASE64) == 0)) { + /* we're dealing with a public key */ + err("Translating public key\n"); + + ret = emit_public_openssh_from_pgp(&pgp_crt, use_keyid); + + } else { + /* we have no idea what kind of key this is at all anyway! */ + err("Input does contain any form of OpenPGP key I recognize."); + return 1; + } } - if (ret = convert_pgp_to_x509(&x509_privkey, &data), ret) { - return ret; - } - ret = gnutls_x509_privkey_export (x509_privkey, - GNUTLS_X509_FMT_PEM, - output_data, - &ods); - printf("ret: %u; ods: %u;\n", ret, ods); - if (ret == 0) { - write(1, output_data, ods); - } - gnutls_x509_privkey_deinit(x509_privkey); gnutls_global_deinit(); return 0; } -- cgit v1.2.3 From aab44f1575a6aff0417403160a83ec57930fa094 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 12 Jun 2008 17:32:53 -0400 Subject: tweaking debian packaging instructions. Still far from done --- debian/compat | 2 +- debian/control | 12 +++++++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/debian/compat b/debian/compat index 7ed6ff8..7f8f011 100644 --- a/debian/compat +++ b/debian/compat @@ -1 +1 @@ -5 +7 diff --git a/debian/control b/debian/control index bd53601..00c6aeb 100644 --- a/debian/control +++ b/debian/control @@ -3,11 +3,13 @@ Section: net Priority: extra Maintainer: Daniel Kahn Gillmor Uploaders: Jameson Rollins -Build-Depends: debhelper (>= 5.0) -Standards-Version: 3.7.3 -XS-Dm-Upload-Allowed: yes +Build-Depends: debhelper (>= 7.0), libgnutls-dev (>= 2.3.14) +Standards-Version: 3.8.0.1 +Homepage: http://cmrg.fifthhorseman.net/wiki/OpenPGPandSSH +Enhances: openssh-client, openssh-server +Dm-Upload-Allowed: yes Package: monkeysphere Architecture: all -Depends: ssh, gnupg, gnupg2 -Description: use GNUPG for ssh connections +Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6) +Description: use the OpenPGP web of trust to verify ssh connections -- cgit v1.2.3 From 8042f93c695f373542356739b0812e628f7b8b1d Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 09:34:16 -0400 Subject: keytrans cleanup: getting rid of unimplemented/useless code. --- src/keytrans/Makefile | 9 +- src/keytrans/gpg2ssh.c | 293 --------------------------------------------- src/keytrans/openpgp2ssh.c | 81 ------------- src/keytrans/ssh2gpg.c | 171 -------------------------- 4 files changed, 1 insertion(+), 553 deletions(-) delete mode 100644 src/keytrans/gpg2ssh.c delete mode 100644 src/keytrans/ssh2gpg.c diff --git a/src/keytrans/Makefile b/src/keytrans/Makefile index fdd4ccd..53fa5dc 100644 --- a/src/keytrans/Makefile +++ b/src/keytrans/Makefile @@ -7,13 +7,6 @@ openpgp2ssh: openpgp2ssh.c gnutls-helpers.o gcc -g -Wall --pedantic -o $@ -c $< clean: - rm -f openpgp2ssh gpg2ssh ssh2gpg *.o - -# deprecated: -gpg2ssh: gpg2ssh.c gnutls-helpers.o - gcc -g -Wall --pedantic -o gpg2ssh gpg2ssh.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o - -ssh2gpg: ssh2gpg.c gnutls-helpers.o - gcc -g -Wall --pedantic -o ssh2gpg ssh2gpg.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + rm -f openpgp2ssh *.o .PHONY: clean all diff --git a/src/keytrans/gpg2ssh.c b/src/keytrans/gpg2ssh.c deleted file mode 100644 index c99f03f..0000000 --- a/src/keytrans/gpg2ssh.c +++ /dev/null @@ -1,293 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* for waitpid() */ -#include -#include - -/* - Author: Daniel Kahn Gillmor - Date: Tue, 08 Apr 2008 - License: GPL v3 or later - - monkeysphere public key translator: execute this with an GPG - certificate (public key(s) + userid(s)) on stdin. It currently - only works with RSA keys. - - It will spit out a version of the first key capable of being used - for authentication on stdout. The output format should be suitable - for appending a known_hosts file. - - Requirements: I've only built this so far with GnuTLS v2.3.4 -- - version 2.2.0 does not contain the appropriate pieces. - - */ - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_openpgp_crt_t openpgp_crt; - gnutls_openpgp_keyid_t keyid; - printable_keyid p_keyid; - unsigned int keyidx; - unsigned int usage, bits; - gnutls_pk_algorithm_t algo; - - gnutls_datum_t m, e, p, q, g, y; - gnutls_datum_t algolabel; - - char output_data[10240]; - char userid[10240]; - size_t uidsz = sizeof(userid); - - const gnutls_datum_t* all[5]; - int pipefd; - pid_t child_pid; - char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; - const char* algoname; - int mpicount; - int pipestatus; - - init_gnutls(); - - init_datum(&data); - - init_datum(&m); - init_datum(&e); - init_datum(&p); - init_datum(&q); - init_datum(&g); - init_datum(&y); - - init_datum(&algolabel); - - init_keyid(keyid); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - if (ret = gnutls_openpgp_crt_init(&openpgp_crt), ret) { - err("Failed to initialize OpenPGP certificate (error: %d)\n", ret); - return 1; - } - - /* format could be either: GNUTLS_OPENPGP_FMT_RAW, - GNUTLS_OPENPGP_FMT_BASE64; if MONKEYSPHERE_RAW is set, use RAW, - otherwise, use BASE64: */ - - /* FIXME: we should be auto-detecting the input format, and - translating it as needed. */ - - if (getenv("MONKEYSPHERE_RAW")) { - err("assuming RAW formatted certificate\n"); - if (ret = gnutls_openpgp_crt_import(openpgp_crt, &data, GNUTLS_OPENPGP_FMT_RAW), ret) { - err("failed to import the OpenPGP certificate in RAW format (error: %d)\n", ret); - return ret; - } - } else { - err("assuming BASE64 formatted certificate\n"); - if (ret = gnutls_openpgp_crt_import (openpgp_crt, &data, GNUTLS_OPENPGP_FMT_BASE64), ret) { - err("failed to import the OpenPGP certificate in BASE64 format (error: %d)\n", ret); - return ret; - } - } - - if (gnutls_openpgp_crt_get_revoked_status(openpgp_crt)) { - err("the primary key was revoked!\n"); - return 1; - } - - /* FIXME: We're currently looking at the primary key or maybe the - first authentication-capable subkey. - - Instead, we should be iterating through the primary key and all - subkeys: for each one with the authentication usage flag set of a - algorithm we can handle, we should output matching UserIDs and - the SSH version of the key. */ - - - if (ret = gnutls_openpgp_crt_get_key_usage(openpgp_crt, &usage), ret) { - err("failed to get the usage flags for the primary key (error: %d)\n", ret); - return ret; - } - if (usage & GNUTLS_KEY_KEY_AGREEMENT && - usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { - err("the primary key can be used for authentication and communication encryption!\n"); - - algo = gnutls_openpgp_crt_get_pk_algorithm(openpgp_crt, &bits); - if (algo < 0) { - err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - - err("OpenPGP RSA certificate, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_pk_rsa_raw(openpgp_crt, &m, &e); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_pk_dsa_raw(openpgp_crt, &p, &q, &g, &y); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - - } else { - err("primary key is not good for authentication and communication encryption. Trying subkeys...\n"); - - if (ret = gnutls_openpgp_crt_get_auth_subkey(openpgp_crt, keyid, 0), ret) { - err("failed to find a subkey capable of authentication and communication encryption (error: %d)\n", ret); - return ret; - } - make_keyid_printable(p_keyid, keyid); - err("found authentication subkey %.16s\n", p_keyid); - - ret = gnutls_openpgp_crt_get_subkey_idx(openpgp_crt, keyid); - if (ret < 0) { - err("could not get the index of subkey %.16s (error: %d)\n", ret); - return ret; - } - keyidx = ret; - - if (gnutls_openpgp_crt_get_subkey_revoked_status(openpgp_crt, keyidx)) { - err("The authentication subkey was revoked!\n"); - return 1; - } - - if (ret = gnutls_openpgp_crt_get_subkey_usage(openpgp_crt, keyidx, &usage), ret) { - err("could not figure out usage of subkey %.16s (error: %d)\n", p_keyid, ret); - return ret; - } - if ((usage & GNUTLS_KEY_KEY_AGREEMENT) == 0 && - usage & GNUTLS_KEY_KEY_ENCIPHERMENT) { - err("could not find a subkey with authentication and communication encryption.\n"); - return 1; - } - - /* switch, based on the algorithm in question, to extract the MPI - components: */ - - algo = gnutls_openpgp_crt_get_subkey_pk_algorithm(openpgp_crt, keyidx, &bits); - if (algo < 0) { - err("failed to get the algorithm of the authentication subkey (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - - err("OpenPGP RSA subkey, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(openpgp_crt, keyidx, &m, &e); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA subkey parameters (error: %d)\n", ret); - return 1; - } - } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA subkey, with %d bits\n", bits); - ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(openpgp_crt, keyidx, &p, &q, &g, &y); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA subkey parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP subkey was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - } - - /* make sure userid is NULL-terminated */ - userid[sizeof(userid) - 1] = 0; - uidsz--; - - /* FIXME: we're just choosing the first UserID from the certificate: - instead, we should be selecting every User ID that is adequately - signed and matches the spec, and aggregating them with commas for - known_hosts output */ - - if (ret = gnutls_openpgp_crt_get_name(openpgp_crt, 0, userid, &uidsz), ret) { - err("Failed to fetch the first UserID (error: %d)\n", ret); - return ret; - } - - if (ret = validate_ssh_host_userid(userid), ret) { - err("bad userid: not a valid ssh host.\n"); - return ret; - } - - /* remove ssh:// from the beginning of userid */ - memmove(userid, userid + strlen("ssh://"), 1 + strlen(userid) - strlen("ssh://")); - - - /* now we have algo, and the various MPI data are set. Can we - export them cleanly? */ - - /* for the moment, we'll just dump the info raw, and pipe it - externally through coreutils' /usr/bin/base64 */ - - if (algo == GNUTLS_PK_RSA) { - algoname = "ssh-rsa"; - mpicount = 3; - - all[0] = &algolabel; - all[1] = &e; - all[2] = &m; - } else if (algo == GNUTLS_PK_DSA) { - algoname = "ssh-dss"; - mpicount = 5; - - all[0] = &algolabel; - all[1] = &p; - all[2] = &q; - all[3] = &g; - all[4] = &y; - } else { - err("no idea what this algorithm is: %d\n", algo); - return 1; - } - - if (ret = datum_from_string(&algolabel, algoname), ret) { - err("couldn't label string (error: %d)\n", ret); - return ret; - } - - snprintf(output_data, sizeof(output_data), "%s %s ", userid, algoname); - - pipefd = create_writing_pipe(&child_pid, args[0], args); - if (pipefd < 0) { - err("failed to create a writing pipe (returned %d)\n", pipefd); - return pipefd; - } - - write(1, output_data, strlen(output_data)); - - if (0 != write_data_fd_with_length(pipefd, all, mpicount)) { - err("was not able to write out RSA key data\n"); - return 1; - } - close(pipefd); - if (child_pid != waitpid(child_pid, &pipestatus, 0)) { - err("could not wait for child process to return for some reason.\n"); - return 1; - } - if (pipestatus != 0) { - err("base64 pipe died with return code %d\n", pipestatus); - return pipestatus; - } - - write(1, "\n", 1); - - - - gnutls_openpgp_crt_deinit(openpgp_crt); - gnutls_global_deinit(); - return 0; -} diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c index 30e19d5..10351e6 100644 --- a/src/keytrans/openpgp2ssh.c +++ b/src/keytrans/openpgp2ssh.c @@ -278,87 +278,6 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope return 0; } - - -int convert_x509_to_pgp(gnutls_openpgp_privkey_t* output, gnutls_datum_t* input) { - gnutls_x509_privkey_t x509_privkey; - gnutls_datum_t m, e, d, p, q, u, g, y, x; - gnutls_pk_algorithm_t x509_algo; - int ret; - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - init_datum(&x); - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialized X.509 private key (error: %d)\n", ret); - return 1; - } - - - /* format could be either: GNUTLS_X509_FMT_DER, - GNUTLS_X509_FMT_PEM; if MONKEYSPHERE_DER is set, use DER, - otherwise, use PEM: */ - - if (getenv("MONKEYSPHERE_DER")) { - err("assuming DER formatted private keys\n"); - if (ret = gnutls_x509_privkey_import(x509_privkey, input, GNUTLS_X509_FMT_DER), ret) - err("failed to import the X.509 private key in DER format (error: %d)\n", ret); - } else { - err("assuming PEM formatted private keys\n"); - if (ret = gnutls_x509_privkey_import (x509_privkey, input, GNUTLS_X509_FMT_PEM), ret) - err("failed to import the X.509 private key in PEM format (error: %d)\n", ret); - } - - x509_algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); - if (x509_algo < 0) { - err("failed to get X.509 key algorithm (error: %d)\n", x509_algo); - return 1; - } - if (x509_algo == GNUTLS_PK_RSA) { - err("X.509 RSA Key\n"); - ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - - /* ret = gnutls_openpgp_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); */ - ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import RSA key parameters (error: %d)\n", ret); - return 1; - } - } else if (x509_algo == GNUTLS_PK_DSA) { - err("X.509 DSA Key\n"); - ret = gnutls_x509_privkey_export_dsa_raw(x509_privkey, &p, &q, &g, &y, &x); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); - return 1; - } - - /* ret = gnutls_openpgp_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); */ - ret = GNUTLS_E_UNIMPLEMENTED_FEATURE; - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import DSA key parameters (error: %d)\n", ret); - return 1; - } - } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", x509_algo); - return 1; - } - - gnutls_x509_privkey_deinit(x509_privkey); - return 0; -} - - int main(int argc, char* argv[]) { gnutls_datum_t data; int ret; diff --git a/src/keytrans/ssh2gpg.c b/src/keytrans/ssh2gpg.c deleted file mode 100644 index b14a540..0000000 --- a/src/keytrans/ssh2gpg.c +++ /dev/null @@ -1,171 +0,0 @@ -#include "gnutls-helpers.h" - -#include -#include - -/* for waitpid() */ -#include -#include - -/* for time() */ -#include - -/* for htons() */ -#include - - -/* - Author: Daniel Kahn Gillmor - Date: Sun, 2008-04-20 - License: GPL v3 or later - - monkeysphere public key translator: execute this with an ssh - private key on stdin. It currently only works with RSA keys. - - it should eventually work with OpenSSH-style public keys instead of - the full private key, but it was easier to do this way. - - It shoud spit out a version of the public key suitable for acting - as an OpenPGP public sub key packet. - - */ - -int main(int argc, char* argv[]) { - gnutls_datum_t data; - int ret; - gnutls_x509_privkey_t x509_privkey; - gnutls_openpgp_crt_t openpgp_crt; - gnutls_openpgp_keyid_t keyid; - printable_keyid p_keyid; - unsigned int keyidx; - unsigned int usage, bits; - gnutls_pk_algorithm_t algo; - - unsigned char packettag; - unsigned char openpgpversion; - time_t timestamp; - uint32_t clunkytime; - unsigned char openpgpalgo; - unsigned int packetlen; - uint16_t plen; - - gnutls_datum_t m, e, d, p, q, u, g, y; - gnutls_datum_t algolabel; - - char output_data[10240]; - char userid[10240]; - size_t uidsz = sizeof(userid); - - const gnutls_datum_t* all[5]; - int pipefd; - pid_t child_pid; - char* const args[] = {"/usr/bin/base64", "--wrap=0", NULL}; - const char* algoname; - int mpicount; - int pipestatus; - - init_gnutls(); - - init_datum(&data); - - init_datum(&m); - init_datum(&e); - init_datum(&d); - init_datum(&p); - init_datum(&q); - init_datum(&u); - init_datum(&g); - init_datum(&y); - - init_datum(&algolabel); - - init_keyid(keyid); - - /* slurp in the private key from stdin */ - if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); - return 1; - } - - - if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialize private key structure (error: %d)\n", ret); - return 1; - } - - err("assuming PEM formatted private key\n"); - if (ret = gnutls_x509_privkey_import(x509_privkey, &data, GNUTLS_X509_FMT_PEM), ret) { - err("failed to import the PEM-encoded private key (error: %d)\n", ret); - return ret; - } - - algo = gnutls_x509_privkey_get_pk_algorithm(x509_privkey); - if (algo < 0) { - err("failed to get the algorithm of the PEM-encoded public key (error: %d)\n", algo); - return algo; - } else if (algo == GNUTLS_PK_RSA) { - err("RSA private key\n"); - ret = gnutls_x509_privkey_export_rsa_raw(x509_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); - return 1; - } - err("Modulus size %d, exponent size %d\n", m.size, e.size); - } else if (algo == GNUTLS_PK_DSA) { - err("DSA Key, not implemented!!\n", bits); - return 1; - } else { - err("Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", algo); - return 1; - } - - /* now we have algo, and the various MPI data are set. Can we - export them as a public subkey packet? */ - - /* this packet should be tagged 14, and should contain: - - 1 octet: version (4) - 4 octets: time of generation (seconds since 1970) - 1 octet: algo (http://tools.ietf.org/html/rfc4880#section-5.5.2 implies 1 for RSA) - - MPI: modulus - MPI: exponent - */ - - packetlen = 1 + 4 + 1; - /* FIXME: this is RSA only. for DSA, there'll be more: */ - packetlen += get_openpgp_mpi_size(&m) + get_openpgp_mpi_size(&e); - - /* FIXME: we should generate this bound more cleanly -- i just - happen to know that 65535 is 2^16-1: */ - if (packetlen > 65535) { - err("packet length is too long (%d)\n", packetlen); - return 1; - } - - /* we're going to emit an old-style packet, with tag 14 (public - subkey), with a two-octet packet length */ - packettag = 0x80 | (14 << 2) | 1; - - write(1, &packettag, sizeof(packettag)); - plen = htons(packetlen); - write(1, &plen, sizeof(plen)); - - openpgpversion = 4; - write(1, &openpgpversion, 1); - - timestamp = time(NULL); - clunkytime = htonl(timestamp); - write(1, &clunkytime, 4); - - /* FIXME: handle things other than RSA */ - openpgpalgo = 1; - write(1, &openpgpalgo, 1); - - write_openpgp_mpi_to_fd(1, &m); - write_openpgp_mpi_to_fd(1, &e); - - gnutls_x509_privkey_deinit(x509_privkey); - gnutls_global_deinit(); - return 0; -} -- cgit v1.2.3 From e983d61545f58db81429d82a356dfadafd491dd0 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 09:41:16 -0400 Subject: added top-level Makefile for ease of building with debhelper. stupid whitespace cleanup in openpgp2ssh.c --- Makefile | 9 +++++++++ src/keytrans/openpgp2ssh.c | 1 - 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 Makefile diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..b28e54e --- /dev/null +++ b/Makefile @@ -0,0 +1,9 @@ +all: keytrans + +keytrans: + $(MAKE) -C src/keytrans + +clean: + $(MAKE) -C src/keytrans clean + +.PHONY: all clean diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c index 10351e6..4593b33 100644 --- a/src/keytrans/openpgp2ssh.c +++ b/src/keytrans/openpgp2ssh.c @@ -273,7 +273,6 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope } write(1, "\n", 1); - return 0; } -- cgit v1.2.3 From c998145c57c19e026e5f6c8f400fb66a3f52e8d4 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 10:32:09 -0400 Subject: further debianization work. (also, made src/common non-executable, since it is sourced, not executed). --- debian/control | 11 +++++++++-- debian/copyright | 16 ++++++++++++++++ debian/monkeysphere.dirs | 1 + debian/monkeysphere.docs | 2 ++ debian/monkeysphere.install | 5 +++++ debian/monkeysphere.manpages | 3 +++ debian/rules | 3 +++ src/common | 0 8 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 debian/copyright create mode 100644 debian/monkeysphere.dirs create mode 100644 debian/monkeysphere.docs create mode 100644 debian/monkeysphere.install create mode 100644 debian/monkeysphere.manpages create mode 100755 debian/rules mode change 100755 => 100644 src/common diff --git a/debian/control b/debian/control index 00c6aeb..e190ae0 100644 --- a/debian/control +++ b/debian/control @@ -1,7 +1,7 @@ Source: monkeysphere Section: net Priority: extra -Maintainer: Daniel Kahn Gillmor +Maintainer: Daniel Kahn Gillmor Uploaders: Jameson Rollins Build-Depends: debhelper (>= 7.0), libgnutls-dev (>= 2.3.14) Standards-Version: 3.8.0.1 @@ -10,6 +10,13 @@ Enhances: openssh-client, openssh-server Dm-Upload-Allowed: yes Package: monkeysphere -Architecture: all +Architecture: any Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6) +Recommends: netcat Description: use the OpenPGP web of trust to verify ssh connections + SSH key-based authentication is tried-and-true, but it lacks a true + Public Key Infrastructure for key certification, revocation and + expiration. MonkeySphere is a framework that uses the OpenPGP web of + trust for these PKI functions. It can be used in both directions: + for users to get validated host keys, and for hosts to manage user + permissions. diff --git a/debian/copyright b/debian/copyright new file mode 100644 index 0000000..413f60f --- /dev/null +++ b/debian/copyright @@ -0,0 +1,16 @@ +Format-Specification: http://wiki.debian.org/Proposals/CopyrightFormat +Debianized-By: Daniel Kahn Gillmor +Debianized-Date: Fri Jun 13 10:19:16 EDT 2008 +Original-Source: http://lair.fifthhorseman.net/~dkg/git/monkeysphere.git/ + +Files: * +Copyright: Jameson Rollins , + Daniel Kahn Gillmor +License: GPL-3+ + This package is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + . + On Debian systems, the complete text of the GNU General Public License + can be found in file "/usr/share/common-licenses/GPL". diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs new file mode 100644 index 0000000..5089e73 --- /dev/null +++ b/debian/monkeysphere.dirs @@ -0,0 +1 @@ +usr/share/monkeysphere diff --git a/debian/monkeysphere.docs b/debian/monkeysphere.docs new file mode 100644 index 0000000..4b8144e --- /dev/null +++ b/debian/monkeysphere.docs @@ -0,0 +1,2 @@ +doc/README +doc/MonkeySpec diff --git a/debian/monkeysphere.install b/debian/monkeysphere.install new file mode 100644 index 0000000..a614937 --- /dev/null +++ b/debian/monkeysphere.install @@ -0,0 +1,5 @@ +src/keytrans/openpgp2ssh usr/bin +src/monkeysphere usr/bin +src/monkeysphere-server usr/sbin +src/monkeysphere-ssh-proxycommand usr/bin +src/common usr/share/monkeysphere diff --git a/debian/monkeysphere.manpages b/debian/monkeysphere.manpages new file mode 100644 index 0000000..6e2cb92 --- /dev/null +++ b/debian/monkeysphere.manpages @@ -0,0 +1,3 @@ +man/man1/monkeysphere.1 +man/man1/openpgp2ssh.1 +man/man8/monkeysphere-server.8 diff --git a/debian/rules b/debian/rules new file mode 100755 index 0000000..cbe925d --- /dev/null +++ b/debian/rules @@ -0,0 +1,3 @@ +#!/usr/bin/make -f +%: + dh $@ diff --git a/src/common b/src/common old mode 100755 new mode 100644 -- cgit v1.2.3 From 03cc847e6fc901ab4c1920324910126158655e37 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 11:18:00 -0400 Subject: monkeysphere debianization. Package can now be cleanly built with minimal lintian warnings. --- COPYING | 6 +++--- Makefile | 5 ++++- debian/changelog | 5 +++-- debian/control | 6 +++--- debian/copyright | 9 +++++++-- man/man1/openpgp2ssh.1 | 54 ++++++++++++++++++++++++++++++-------------------- src/keytrans/Makefile | 2 +- test.key | 27 ------------------------- 8 files changed, 53 insertions(+), 61 deletions(-) delete mode 100644 test.key diff --git a/COPYING b/COPYING index ab8788d..c920a0e 100644 --- a/COPYING +++ b/COPYING @@ -1,13 +1,13 @@ MonkeySphere is a system to use the OpenPGP web-of-trust to authenticate and encrypt ssh connections. -It is free software, written by: +It is free software, developed by: Jameson Rollins - Daniel Kahn Gillmor -with much help from: + Daniel Kahn Gillmor Jamie McClelland Micah Anderson Matthew Goins + Mike Castleman MonkeySphere is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of diff --git a/Makefile b/Makefile index b28e54e..64e6cbe 100644 --- a/Makefile +++ b/Makefile @@ -3,7 +3,10 @@ all: keytrans keytrans: $(MAKE) -C src/keytrans +release: clean + tar c COPYING doc etc Makefile man src | gzip -n > ../monkeysphere_`head -n1 debian/changelog | sed 's/.*(\([^-]*\)-.*/\1/'`.orig.tar.gz + clean: $(MAKE) -C src/keytrans clean -.PHONY: all clean +.PHONY: all clean release diff --git a/debian/changelog b/debian/changelog index 2b68de6..ec744e1 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,7 @@ monkeysphere (0.1-1) unstable; urgency=low - * to be first release... + * First release of debian package for monkeysphere. + * This is experimental -- please report bugs! - -- Jameson Graef Rollins Tue, 10 Jun 2008 17:20:16 -0400 + -- Daniel Kahn Gillmor Fri, 13 Jun 2008 10:53:43 -0400 diff --git a/debian/control b/debian/control index e190ae0..afd5bfa 100644 --- a/debian/control +++ b/debian/control @@ -1,18 +1,18 @@ Source: monkeysphere Section: net Priority: extra -Maintainer: Daniel Kahn Gillmor +Maintainer: Daniel Kahn Gillmor Uploaders: Jameson Rollins Build-Depends: debhelper (>= 7.0), libgnutls-dev (>= 2.3.14) Standards-Version: 3.8.0.1 Homepage: http://cmrg.fifthhorseman.net/wiki/OpenPGPandSSH -Enhances: openssh-client, openssh-server Dm-Upload-Allowed: yes Package: monkeysphere Architecture: any -Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6) +Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), ${shlibs:Depends} Recommends: netcat +Enhances: openssh-client, openssh-server Description: use the OpenPGP web of trust to verify ssh connections SSH key-based authentication is tried-and-true, but it lacks a true Public Key Infrastructure for key certification, revocation and diff --git a/debian/copyright b/debian/copyright index 413f60f..11abe8b 100644 --- a/debian/copyright +++ b/debian/copyright @@ -4,8 +4,13 @@ Debianized-Date: Fri Jun 13 10:19:16 EDT 2008 Original-Source: http://lair.fifthhorseman.net/~dkg/git/monkeysphere.git/ Files: * -Copyright: Jameson Rollins , - Daniel Kahn Gillmor +Copyright: 2008 Jameson Rollins , + Daniel Kahn Gillmor , + Jamie McClelland , + Micah Anderson , + Matthew Goins , + Mike Castleman + License: GPL-3+ This package is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/man/man1/openpgp2ssh.1 b/man/man1/openpgp2ssh.1 index 1a02b38..83b6154 100644 --- a/man/man1/openpgp2ssh.1 +++ b/man/man1/openpgp2ssh.1 @@ -7,31 +7,34 @@ openpgp2ssh .Nd translate OpenPGP keys to SSH keys .Sh SYNOPSIS .Nm openpgp2ssh < mykey.gpg - +.Pp .Nm gpg --export $KEYID | openpgp2ssh $KEYID - +.Pp .Nm gpg --export-secret-key $KEYID | openpgp2ssh $KEYID .Sh DESCRIPTION -openpgp2ssh takes an OpenPGP-formatted primary key and associated +.Nm +takes an OpenPGP-formatted primary key and associated subkeys on standard input, and spits out the requested equivalent SSH-style key on standard output. - +.Pp If the data on standard input contains no subkeys, you can invoke -openpgp2ssh without arguments. If the data on standard input contains +.Nm +without arguments. If the data on standard input contains multiple keys (e.g. a primary key and associated subkeys), you must specify a specific OpenPGP keyid (e.g. CCD2ED94D21739E9) or fingerprint as the first argument to indicate which key to export. The keyid must be exactly 16 hex characters. - +.Pp If the input contains an OpenPGP RSA or DSA public key, it will be converted to the OpenSSH-style single-line keystring, prefixed with the key type. This format is suitable (with minor alterations) for insertion into known_hosts files and authorized_keys files. - +.Pp If the input contains an OpenPGP RSA or DSA secret key, it will be converted to the equivalent PEM-encoded private key. - -openpgp2ssh is part of the +.Pp +.Nm +is part of the .Xr monkeysphere 1 framework for providing a PKI for SSH. .Sh CAVEATS @@ -39,17 +42,20 @@ The keys produced by this process are stripped of all identifying information, including certifications, self-signatures, etc. This is intentional, since ssh attaches no inherent significance to these features. - -openpgp2ssh only works with RSA or DSA keys, because those are the +.Pp +.Nm +only works with RSA or DSA keys, because those are the only ones which work with ssh. - -Assuming a valid key type, though, openpgp2ssh will produce output for +.Pp +Assuming a valid key type, though, +.Nm +will produce output for any requested key. This means, among other things, that it will happily export revoked keys, unverifiable keys, expired keys, etc. Make sure you do your own key validation before using this tool! .Sh EXAMPLES .Nm gpg --export-secret-key $KEYID | openpgp2ssh $KEYID | ssh-add -c /dev/stdin - +.Pp This pushes the secret key into the active .Xr ssh-agent 1 . Tools such as @@ -58,21 +64,25 @@ which know how to talk to the .Xr ssh-agent 1 can now rely on the key. .Sh AUTHOR -openpgp2ssh and this man page were written by Daniel Kahn Gillmor +.Nm +and this man page were written by Daniel Kahn Gillmor . .Sh BUGS -openpgp2ssh currently only exports into formats used by the OpenSSH. +.Nm +currently only exports into formats used by the OpenSSH. It should support other key output formats, such as those used by lsh(1) and putty(1). - +.Pp Secret key output is currently not passphrase-protected. - -openpgp2ssh currently cannot handle passphrase-protected secret keys on input. - +.Pp +.Nm +currently cannot handle passphrase-protected secret keys on input. +.Pp It would be nice to be able to use keyids shorter or longer than 16 hex characters. - -openpgp2ssh only acts on keys associated with the first primary key +.Pp +.Nm +only acts on keys associated with the first primary key passed in. If you send it more than one primary key, it will silently ignore later ones. .Sh SEE ALSO diff --git a/src/keytrans/Makefile b/src/keytrans/Makefile index 53fa5dc..79602ef 100644 --- a/src/keytrans/Makefile +++ b/src/keytrans/Makefile @@ -1,7 +1,7 @@ all: openpgp2ssh openpgp2ssh: openpgp2ssh.c gnutls-helpers.o - gcc -g -Wall --pedantic -o openpgp2ssh openpgp2ssh.c `libgnutls-config --libs --cflags` -lgnutls-extra gnutls-helpers.o + gcc -g -Wall --pedantic -o openpgp2ssh openpgp2ssh.c `libgnutls-config --libs --cflags` gnutls-helpers.o %.o: %.c gcc -g -Wall --pedantic -o $@ -c $< diff --git a/test.key b/test.key deleted file mode 100644 index 4e05880..0000000 --- a/test.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEogIBAAKCAQEAxMv33LvWBZnKtahorHGYdBZqVxrNUQcVNrgxp4bf/FvgvSLG -kBrw6wHFdVYvWWViD5efrJugqA4+pKp16LEWlc7JZICrou4vEJGkvoqBIJC/4cVN -xcwV1a8jo9ZOYjt0JIyuHrEDGW/edQYWI41XO/H+QdMDsdI+oOmfPV/V4eMyjGKH -vRJ+xDae5izhUb3Lb00YnxpP2n/zhvHpn7weu+bzvwb3pMMo9336Ft7m5ulGPJzN -+3l595LW+lUSDUlUJbACp4Nyn+i9ODPV6xzghzirsh7rnD8jD2kaqIVkcvEhusoB -JN3daPXt9t6m5cfsCWu31BXdbpTWiLIZRUxDzQIBIwKCAQEAl9CMAg0+s90KFxuD -8r4H5IZSCK5GnZe/6GI07vMEj3oTxRrTsP7XG7DoyDsr1z+UyjMjZ+XFE+27S9P0 -ju8Cy1Zg2ICEZ78OXT0nUSkEhtYQXbV2gqTAYwNzQ9/WEUPOn9o9LZ5+u9n0wKzs -gdNvLj5WbUsC2aIwUD8xswDJkP5cA4RfKo8Mz40aXbK6b+S/bOKEkXRFvOor46pl -A8GHxUVcUPUG7LAXCm1FWrDob6FTlv3yW8DeVTCYwt6HdrTmc9b+yOinwMR6ZvUz -R6AESGG7czCvA6rpkCcprfCPx0gfntuzLiGRtl54GvbYWWtPDlxnPwcw1zcSALvM -pJNpawKBgQD/zze04kYZBNDTxolBrZltpPXtPpOrG2Otp8CHreOKn0TifCFPDnCb -ewUhxuDRA+L9KPLT311DtHfIzXJ8/RD6K/QE72ny39h2X2Pn2hWSgb9+iysHBDNc -jb136QFoKQcpqUpLEfTvA71Yqvuk6gsYiuWnIN5KJwy/AhwFQnK/WQKBgQDE8X87 -C+0JSg2ybUopOQVSrvildJEa8CWbM1SAL1j3E24U2fPh+zVmIxqa2m4X/PxFBBTv -WVGayzFkmJK2Dgt7F7hBqi5HelP0B38dXtkPlK6idTALNHoS/7HCDXISgHmDOhcQ -LHGQUuQMkTq6H4cOMwTNO5aM2zc5E9uF/hptlQKBgEHHkftQIKdZAn+Zc8Bud+j+ -iGGTv5JmIPIj0mwIJJFcJ6f0CJCr8RIJsNzMvXeTSP9FCz3LuOWGLW4mM2H37mw3 -MB6GtNgNrLC5cXYiIs3m2XhPq/p9bEr/4ENnzSlposGR7ohVExjjtFig/uFDfzIy -WE+MG+cunOCoxWBwLCKTAoGBALQP/0vtpYTV/eT2NS0A7uyCt3Kzt94dZDYgTUH/ -Z0hMR2OFcUOj2Qzs5R/dpnxVA+dUMGXOAXeVNHk7CcsFhtbxHX3dbCQYEj4yvVyu -fVAS6M8MDqsoqh//uHbnuMB1dmlZrq+zmwecPjdgNbF76TGNuz9MbGOGmOO6Yk6f -LhsLAoGAJoK+yRDaEFDwrjdvGazEy/d1CtknkGY2r4vb8giEodFJcQQhtVtjnYPl -gDIpbcpeT0GDiZd0pxAxpibbKM63pYz8PKtlq0B/qXgArRgJnbku01Jc4iLVWPqK -qitRgsz1HdN2tIqa8oQE0iuvyoq+r6+pqcQJd7sc6lKlk0gO0Mo= ------END RSA PRIVATE KEY----- -- cgit v1.2.3 From 19efa03fdeda1017c876066936b6b8bf4e9ba912 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 11:23:19 -0400 Subject: including cache and config files in debian package. --- debian/monkeysphere.dirs | 2 ++ debian/monkeysphere.install | 2 ++ 2 files changed, 4 insertions(+) diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs index 5089e73..fa2bf5f 100644 --- a/debian/monkeysphere.dirs +++ b/debian/monkeysphere.dirs @@ -1 +1,3 @@ usr/share/monkeysphere +var/cache/monkeysphere +etc/monkeysphere diff --git a/debian/monkeysphere.install b/debian/monkeysphere.install index a614937..6dd3dda 100644 --- a/debian/monkeysphere.install +++ b/debian/monkeysphere.install @@ -3,3 +3,5 @@ src/monkeysphere usr/bin src/monkeysphere-server usr/sbin src/monkeysphere-ssh-proxycommand usr/bin src/common usr/share/monkeysphere +etc/monkeysphere.conf etc/monkeysphere +etc/monkeysphere-server.conf etc/monkeysphere -- cgit v1.2.3 From a8372a5e6f55e6d830c6aba09a92673b49110a22 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 11:57:50 -0400 Subject: add man page for the ssh proxy command script. needs to be filled in. --- man/man1/monkeysphere-ssh-proxycommand.1 | 25 +++++++++++++++++++++++++ man/man1/monkeysphere.1 | 3 +++ 2 files changed, 28 insertions(+) create mode 100644 man/man1/monkeysphere-ssh-proxycommand.1 diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1 new file mode 100644 index 0000000..41a95aa --- /dev/null +++ b/man/man1/monkeysphere-ssh-proxycommand.1 @@ -0,0 +1,25 @@ +.TH MONKEYSPHERE-SSH-PROXYCOMMAND "1" "June 2008" "monkeysphere 0.1" "User Commands" +.SH NAME +monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script +.PD +.SH SYNOPSIS +.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ... +.PD +.SH DESCRIPTION +.PP +MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh +authentication and encryption. OpenPGP keys are tracked via GnuPG, +and added to the ssh authorized_keys and known_hosts files to be used +for authentication and encryption of ssh connection. + +\fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used +to trigger a monkeysphere update of the known_hosts file for the hosts +that are being connected to. +.PD +.SH AUTHOR +Written by Jameson Rollins +.PD +.SH SEE ALSO +.BR monkeypshere (1), +.BR ssh (1), +.BR gpg (1) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index 410a5d7..636adcb 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -1,8 +1,10 @@ .TH MONKEYSPHERE "1" "June 2008" "monkeysphere 0.1" "User Commands" .SH NAME monkeysphere \- MonkeySphere client user interface +.PD .SH SYNOPSIS .B monkeysphere \fIcommand\fP [\fIargs\fP] +.PD .SH DESCRIPTION .PP MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh @@ -102,6 +104,7 @@ Host keys cache directory. .PD .SH AUTHOR Written by Jameson Rollins +.PD .SH SEE ALSO .BR ssh (1), .BR gpg (1), -- cgit v1.2.3 From 455b0264180abd0fde9d4129696ec0e4753418d7 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 12:07:59 -0400 Subject: fix bug if user monkeysphere home directory didn't exist. --- src/monkeysphere | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/monkeysphere b/src/monkeysphere index 5d865c9..6e71765 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -132,6 +132,11 @@ msAuthorizedKeys="$MS_HOME"/authorized_keys # make sure gpg home exists with proper permissions mkdir -p -m 0700 "$GNUPGHOME" +# make sure the user monkeysphere home directory exists +mkdir -p -m 0700 "$MS_HOME" +mkdir -p "$hostKeysCacheDir" +mkdir -p "$userKeysCacheDir" + case $COMMAND in 'update-known_hosts'|'update-known-hosts'|'k') MODE='known_hosts' -- cgit v1.2.3 From 3caa700a0443ab2499da42d32b3ffcd7039fc591 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 12:11:52 -0400 Subject: add debian manpages for proxycommand --- debian/monkeysphere.manpages | 1 + 1 file changed, 1 insertion(+) diff --git a/debian/monkeysphere.manpages b/debian/monkeysphere.manpages index 6e2cb92..a8f6c16 100644 --- a/debian/monkeysphere.manpages +++ b/debian/monkeysphere.manpages @@ -1,3 +1,4 @@ man/man1/monkeysphere.1 man/man1/openpgp2ssh.1 +man/man1/monkeysphere-ssh-proxycommand.1 man/man8/monkeysphere-server.8 -- cgit v1.2.3 From ca5d2766c5c143a34b095c5dcb3c829285b2c28e Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 12:16:13 -0400 Subject: Added Greg to author list. --- COPYING | 1 + debian/copyright | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/COPYING b/COPYING index c920a0e..14d0ee0 100644 --- a/COPYING +++ b/COPYING @@ -8,6 +8,7 @@ It is free software, developed by: Micah Anderson Matthew Goins Mike Castleman + Greg Lyle MonkeySphere is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of diff --git a/debian/copyright b/debian/copyright index 11abe8b..b7e823b 100644 --- a/debian/copyright +++ b/debian/copyright @@ -9,7 +9,8 @@ Copyright: 2008 Jameson Rollins , Jamie McClelland , Micah Anderson , Matthew Goins , - Mike Castleman + Mike Castleman , + Greg Lyle License: GPL-3+ This package is free software; you can redistribute it and/or modify -- cgit v1.2.3 From 220a0fb50691a6cf3db9624275d46a6f730f55c6 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 12:37:08 -0400 Subject: fix bugs in ssh key export functions --- man/man1/monkeysphere.1 | 1 + src/common | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index 636adcb..d00a9db 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -107,5 +107,6 @@ Written by Jameson Rollins .PD .SH SEE ALSO .BR ssh (1), +.BR monkeysphere-ssh-proxycommand (1), .BR gpg (1), .BR monkeysphere-server (8) diff --git a/src/common b/src/common index 914c800..8b0f41a 100644 --- a/src/common +++ b/src/common @@ -98,7 +98,7 @@ gpg2known_hosts() { echo -n "$host " gpg --export "$keyID" | \ openpgp2ssh "$keyID" | tr -d '\n' - echo "MonkeySphere${DATE}" + echo " MonkeySphere${DATE}" } # convert key from gpg to ssh authorized_keys format @@ -109,9 +109,9 @@ gpg2authorized_keys() { keyID="$1" userID="$2" - echo -n "MonkeySphere${DATE}:${userID}" gpg --export "$keyID" | \ - openpgp2ssh "$keyID" + openpgp2ssh "$keyID" | tr -d '\n' + echo " MonkeySphere${DATE}:${userID}" } # userid and key policy checking -- cgit v1.2.3 From 1fe3ced39fb67b32b1cce11cd692e492221da930 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 13:05:42 -0400 Subject: making openpgp2ssh less verbose. --- src/keytrans/gnutls-helpers.c | 85 ++++++++++++++++++++++--------------------- src/keytrans/gnutls-helpers.h | 2 +- src/keytrans/openpgp2ssh.c | 78 +++++++++++++++++++-------------------- 3 files changed, 84 insertions(+), 81 deletions(-) diff --git a/src/keytrans/gnutls-helpers.c b/src/keytrans/gnutls-helpers.c index 7c342bb..c6e4979 100644 --- a/src/keytrans/gnutls-helpers.c +++ b/src/keytrans/gnutls-helpers.c @@ -15,11 +15,12 @@ /* for exit() */ #include -int loglevel = 0; +static int loglevel = 0; - -void err(const char* fmt, ...) { +void err(int level, const char* fmt, ...) { va_list ap; + if (level < loglevel) + return; va_start(ap, fmt); vfprintf(stderr, fmt, ap); va_end(ap); @@ -66,11 +67,11 @@ void collapse_printable_keyid(gnutls_openpgp_keyid_t out, printable_keyid in) { unsigned hi = hex2bin(in[pkix]); unsigned lo = hex2bin(in[pkix + 1]); if (hi == 0xff) { - err("character '%c' is not a hex char\n", in[pkix]); + err(0, "character '%c' is not a hex char\n", in[pkix]); exit(1); } if (lo == 0xff) { - err("character '%c' is not a hex char\n", in[pkix + 1]); + err(0, "character '%c' is not a hex char\n", in[pkix + 1]); exit(1); } out[outkix] = lo | (hi << 4); @@ -97,7 +98,7 @@ int convert_string_to_printable_keyid(printable_keyid pkeyid, const char* str) { (str[x] != '\0')) { if (isxdigit(str[x])) { if (arglen == sizeof(printable_keyid)) { - err("There are more than %d hex digits in the keyid '%s'\n", sizeof(printable_keyid), str); + err(0, "There are more than %d hex digits in the keyid '%s'\n", sizeof(printable_keyid), str); return 1; } pkeyid[arglen] = str[x]; @@ -107,7 +108,7 @@ int convert_string_to_printable_keyid(printable_keyid pkeyid, const char* str) { } if (arglen != sizeof(printable_keyid)) { - err("keyid '%s' is not %d hex digits in length\n", str, sizeof(printable_keyid)); + err(0, "Keyid '%s' is not %d hex digits in length\n", str, sizeof(printable_keyid)); return 1; } return 0; @@ -120,27 +121,29 @@ int init_gnutls() { const char* debug_string = NULL; int ret; + if (debug_string = getenv("MONKEYSPHERE_DEBUG"), debug_string) { + loglevel = atoi(debug_string); + } + if (ret = gnutls_global_init(), ret) { - err("Failed to do gnutls_global_init() (error: %d)\n", ret); + err(0, "Failed to do gnutls_global_init() (error: %d)\n", ret); return 1; } version = gnutls_check_version(NULL); if (version) - err("gnutls version: %s\n", version); + err(1, "gnutls version: %s\n", version); else { - err("no version found!\n"); + err(0, "no gnutls version found!\n"); return 1; } - if (debug_string = getenv("MONKEYSPHERE_DEBUG"), debug_string) { - loglevel = atoi(debug_string); - gnutls_global_set_log_function(logfunc); - - gnutls_global_set_log_level(loglevel); - err("set log level to %d\n", loglevel); - } + gnutls_global_set_log_function(logfunc); + + gnutls_global_set_log_level(loglevel); + err(1, "set log level to %d\n", loglevel); + return 0; } @@ -155,11 +158,11 @@ void copy_datum(gnutls_datum_t* dest, const gnutls_datum_t* src) { } int compare_data(const gnutls_datum_t* a, const gnutls_datum_t* b) { if (a->size > b->size) { - err("a is larger\n"); + err(0,"a is larger\n"); return 1; } if (a->size < b->size) { - err("b is larger\n"); + err(0,"b is larger\n"); return -1; } return memcmp(a->data, b->data, a->size); @@ -195,7 +198,7 @@ int set_datum_fd(gnutls_datum_t* d, int fd) { bufsize = 1024; d->data = gnutls_realloc(d->data, bufsize); if (d->data == NULL) { - err("out of memory!\n"); + err(0,"out of memory!\n"); return -1; } d->size = bufsize; @@ -204,7 +207,7 @@ int set_datum_fd(gnutls_datum_t* d, int fd) { } f = fdopen(fd, "r"); if (NULL == f) { - err("could not fdopen FD %d\n", fd); + err(0,"could not fdopen FD %d\n", fd); } clearerr(f); while (!feof(f) && !ferror(f)) { @@ -213,16 +216,16 @@ int set_datum_fd(gnutls_datum_t* d, int fd) { bufsize *= 2; d->data = gnutls_realloc(d->data, bufsize); if (d->data == NULL) { - err("out of memory!\n"); + err(0,"out of memory!\n"); return -1; }; d->size = bufsize; } len += fread(d->data + len, 1, bufsize - len, f); - /* err("read %d bytes\n", len); */ + /* err(0,"read %d bytes\n", len); */ } if (ferror(f)) { - err("Error reading from fd %d (error: %d) (error: %d '%s')\n", fd, ferror(f), errno, strerror(errno)); + err(0,"Error reading from fd %d (error: %d) (error: %d '%s')\n", fd, ferror(f), errno, strerror(errno)); return -1; } @@ -241,13 +244,13 @@ int set_datum_file(gnutls_datum_t* d, const char* fname) { size_t x = 0; if (0 != stat(fname, &sbuf)) { - err("failed to stat '%s'\n", fname); + err(0,"failed to stat '%s'\n", fname); return -1; } c = gnutls_realloc(d->data, sbuf.st_size); if (NULL == c) { - err("failed to allocate %d bytes for '%s'\n", sbuf.st_size, fname); + err(0,"failed to allocate %d bytes for '%s'\n", sbuf.st_size, fname); return -1; } @@ -255,13 +258,13 @@ int set_datum_file(gnutls_datum_t* d, const char* fname) { d->size = sbuf.st_size; file = fopen(fname, "r"); if (NULL == file) { - err("failed to open '%s' for reading\n", fname); + err(0,"failed to open '%s' for reading\n", fname); return -1; } x = fread(d->data, d->size, 1, file); if (x != 1) { - err("tried to read %d bytes, read %d instead from '%s'\n", d->size, x, fname); + err(0,"tried to read %d bytes, read %d instead from '%s'\n", d->size, x, fname); fclose(file); return -1; } @@ -271,7 +274,7 @@ int set_datum_file(gnutls_datum_t* d, const char* fname) { int write_datum_fd(int fd, const gnutls_datum_t* d) { if (d->size != write(fd, d->data, d->size)) { - err("failed to write body of datum.\n"); + err(0,"failed to write body of datum.\n"); return -1; } return 0; @@ -293,12 +296,12 @@ int write_datum_fd_with_length(int fd, const gnutls_datum_t* d) { len = htonl(d->size); } if (write(fd, &len, sizeof(len)) != sizeof(len)) { - err("failed to write size of datum.\n"); + err(0,"failed to write size of datum.\n"); return -2; } if (looks_negative) { if (write(fd, &zero, 1) != 1) { - err("failed to write padding byte for MPI.\n"); + err(0,"failed to write padding byte for MPI.\n"); return -2; } } @@ -332,29 +335,29 @@ int create_writing_pipe(pid_t* pid, const char* path, char* const argv[]) { int ret; if (pid == NULL) { - err("bad pointer passed to create_writing_pipe()\n"); + err(0,"bad pointer passed to create_writing_pipe()\n"); return -1; } if (ret = pipe(p), ret == -1) { - err("failed to create a pipe (error: %d \"%s\")\n", errno, strerror(errno)); + err(0,"failed to create a pipe (error: %d \"%s\")\n", errno, strerror(errno)); return -1; } *pid = fork(); if (*pid == -1) { - err("Failed to fork (error: %d \"%s\")\n", errno, strerror(errno)); + err(0,"Failed to fork (error: %d \"%s\")\n", errno, strerror(errno)); return -1; } if (*pid == 0) { /* this is the child */ close(p[1]); /* close unused write end */ if (0 != dup2(p[0], 0)) { /* map the reading end into stdin */ - err("Failed to transfer reading file descriptor to stdin (error: %d \"%s\")\n", errno, strerror(errno)); + err(0,"Failed to transfer reading file descriptor to stdin (error: %d \"%s\")\n", errno, strerror(errno)); exit(1); } execv(path, argv); - err("exec %s failed (error: %d \"%s\")\n", path, errno, strerror(errno)); + err(0,"exec %s failed (error: %d \"%s\")\n", path, errno, strerror(errno)); /* close the open file descriptors */ close(p[0]); close(0); @@ -372,14 +375,14 @@ int validate_ssh_host_userid(const char* userid) { /* choke if userid does not match the expected format ("ssh://fully.qualified.domain.name") */ if (strncmp("ssh://", userid, strlen("ssh://")) != 0) { - err("The user ID should start with ssh:// for a host key\n"); + err(0,"The user ID should start with ssh:// for a host key\n"); goto fail; } /* so that isalnum will work properly */ userid += strlen("ssh://"); while (0 != (*userid)) { if (!isalnum(*userid)) { - err("label did not start with a letter or a digit! (%s)\n", userid); + err(0,"label did not start with a letter or a digit! (%s)\n", userid); goto fail; } userid++; @@ -389,19 +392,19 @@ int validate_ssh_host_userid(const char* userid) { check last char isalnum */ if (!isalnum(*(userid - 1))) { - err("label did not end with a letter or a digit!\n"); + err(0,"label did not end with a letter or a digit!\n"); goto fail; } if ('.' == (*userid)) /* advance to the start of the next label */ userid++; } else { - err("invalid character in domain name: %c\n", *userid); + err(0,"invalid character in domain name: %c\n", *userid); goto fail; } } /* ensure that the last character is valid: */ if (!isalnum(*(userid - 1))) { - err("hostname did not end with a letter or a digit!\n"); + err(0,"hostname did not end with a letter or a digit!\n"); goto fail; } /* FIXME: fqdn's can be unicode now, thanks to RFC 3490 -- how do we diff --git a/src/keytrans/gnutls-helpers.h b/src/keytrans/gnutls-helpers.h index 00cdec7..670d5ff 100644 --- a/src/keytrans/gnutls-helpers.h +++ b/src/keytrans/gnutls-helpers.h @@ -23,7 +23,7 @@ int init_gnutls(); /* logging and output functions: */ -void err(const char* fmt, ...); +void err(int level, const char* fmt, ...); void logfunc(int level, const char* string); /* basic datum manipulations: */ diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c index 4593b33..9e356e7 100644 --- a/src/keytrans/openpgp2ssh.c +++ b/src/keytrans/openpgp2ssh.c @@ -56,43 +56,43 @@ int convert_private_pgp_to_x509(gnutls_x509_privkey_t* output, const gnutls_open pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(*pgp_privkey, &pgp_bits); if (pgp_algo < 0) { - err("failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); + err(0, "failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); return 1; } if (pgp_algo == GNUTLS_PK_RSA) { - err("OpenPGP RSA Key, with %d bits\n", pgp_bits); + err(0,"OpenPGP RSA Key, with %d bits\n", pgp_bits); ret = gnutls_openpgp_privkey_export_rsa_raw(*pgp_privkey, &m, &e, &d, &p, &q, &u); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); + err(1, "failed to export RSA key parameters (error: %d)\n", ret); return 1; } ret = gnutls_x509_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import RSA key parameters (error: %d)\n", ret); + err(1, "failed to import RSA key parameters (error: %d)\n", ret); return 1; } } else if (pgp_algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", pgp_bits); + err(0,"OpenPGP DSA Key, with %d bits\n", pgp_bits); ret = gnutls_openpgp_privkey_export_dsa_raw(*pgp_privkey, &p, &q, &g, &y, &x); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); + err(0,"failed to export DSA key parameters (error: %d)\n", ret); return 1; } ret = gnutls_x509_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to import DSA key parameters (error: %d)\n", ret); + err(0,"failed to import DSA key parameters (error: %d)\n", ret); return 1; } } else { - err("OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", pgp_algo); + err(0,"OpenPGP Key was not RSA or DSA -- can't deal! (actual algorithm was: %d)\n", pgp_algo); return 1; } ret = gnutls_x509_privkey_fix(*output); if (ret != 0) { - err("failed to fix up the private key in X.509 format (error: %d)\n", ret); + err(0,"failed to fix up the private key in X.509 format (error: %d)\n", ret); return 1; } @@ -132,46 +132,46 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope /* figure out if we've got the right thing: */ subkeycount = gnutls_openpgp_crt_get_subkey_count(*pgp_crt); if (subkeycount < 0) { - err("Could not determine subkey count (got value %d)\n", subkeycount); + err(0,"Could not determine subkey count (got value %d)\n", subkeycount); return 1; } if ((keyid == NULL) && (subkeycount > 0)) { - err("No keyid passed in, but there were %d keys to choose from\n", subkeycount + 1); + err(0,"No keyid passed in, but there were %d keys to choose from\n", subkeycount + 1); return 1; } if (keyid != NULL) { ret = gnutls_openpgp_crt_get_key_id(*pgp_crt, curkeyid); if (ret) { - err("Could not get keyid (error: %d)\n", ret); + err(0,"Could not get keyid (error: %d)\n", ret); return 1; } } if ((keyid == NULL) || (memcmp(*keyid, curkeyid, sizeof(gnutls_openpgp_keyid_t)) == 0)) { /* we want to export the primary key: */ - err("exporting primary key\n"); + err(0,"exporting primary key\n"); /* FIXME: this is almost identical to the block below for subkeys. This clumsiness seems inherent in the gnutls OpenPGP API, though. ugh. */ algo = gnutls_openpgp_crt_get_pk_algorithm(*pgp_crt, &bits); if (algo < 0) { - err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); + err(0,"failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); return algo; } else if (algo == GNUTLS_PK_RSA) { - err("OpenPGP RSA certificate, with %d bits\n", bits); + err(0,"OpenPGP RSA certificate, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_pk_rsa_raw(*pgp_crt, &m, &e); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); + err(0,"failed to export RSA key parameters (error: %d)\n", ret); return 1; } } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", bits); + err(0,"OpenPGP DSA Key, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_pk_dsa_raw(*pgp_crt, &p, &q, &g, &y); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); + err(0,"failed to export DSA key parameters (error: %d)\n", ret); return 1; } } @@ -182,30 +182,30 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope for (subkeyidx = 0; (subkeyidx < subkeycount) && !found; subkeyidx++) { ret = gnutls_openpgp_crt_get_subkey_id(*pgp_crt, subkeyidx, curkeyid); if (ret) { - err("Could not get keyid of subkey with index %d (error: %d)\n", subkeyidx, ret); + err(0,"Could not get keyid of subkey with index %d (error: %d)\n", subkeyidx, ret); return 1; } if (memcmp(*keyid, curkeyid, sizeof(gnutls_openpgp_keyid_t)) == 0) { - err("exporting subkey index %d\n", subkeyidx); + err(0,"exporting subkey index %d\n", subkeyidx); /* FIXME: this is almost identical to the block above for the primary key. */ algo = gnutls_openpgp_crt_get_subkey_pk_algorithm(*pgp_crt, subkeyidx, &bits); if (algo < 0) { - err("failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); + err(0,"failed to get the algorithm of the OpenPGP public key (error: %d)\n", algo); return algo; } else if (algo == GNUTLS_PK_RSA) { - err("OpenPGP RSA certificate, with %d bits\n", bits); + err(0,"OpenPGP RSA certificate, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(*pgp_crt, subkeyidx, &m, &e); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export RSA key parameters (error: %d)\n", ret); + err(0,"failed to export RSA key parameters (error: %d)\n", ret); return 1; } } else if (algo == GNUTLS_PK_DSA) { - err("OpenPGP DSA Key, with %d bits\n", bits); + err(0,"OpenPGP DSA Key, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(*pgp_crt, subkeyidx, &p, &q, &g, &y); if (GNUTLS_E_SUCCESS != ret) { - err ("failed to export DSA key parameters (error: %d)\n", ret); + err(0,"failed to export DSA key parameters (error: %d)\n", ret); return 1; } } @@ -216,7 +216,7 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope } if (!found) { - err("Could not find key in input\n"); + err(0,"Could not find key in input\n"); return 1; } @@ -239,12 +239,12 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope all[3] = &g; all[4] = &y; } else { - err("Key algorithm was neither DSA nor RSA (it was %d). Can't deal. Sorry!\n", algo); + err(0,"Key algorithm was neither DSA nor RSA (it was %d). Can't deal. Sorry!\n", algo); return 1; } if (ret = datum_from_string(&algolabel, algoname), ret) { - err("couldn't label string (error: %d)\n", ret); + err(0,"couldn't label string (error: %d)\n", ret); return ret; } @@ -252,23 +252,23 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope pipefd = create_writing_pipe(&child_pid, b64args[0], b64args); if (pipefd < 0) { - err("failed to create a writing pipe (returned %d)\n", pipefd); + err(0,"failed to create a writing pipe (returned %d)\n", pipefd); return pipefd; } write(1, output_data, strlen(output_data)); if (0 != write_data_fd_with_length(pipefd, all, mpicount)) { - err("was not able to write out RSA key data\n"); + err(0,"was not able to write out RSA key data\n"); return 1; } close(pipefd); if (child_pid != waitpid(child_pid, &pipestatus, 0)) { - err("could not wait for child process to return for some reason.\n"); + err(0,"could not wait for child process to return for some reason.\n"); return 1; } if (pipestatus != 0) { - err("base64 pipe died with return code %d\n", pipestatus); + err(0,"base64 pipe died with return code %d\n", pipestatus); return pipestatus; } @@ -306,22 +306,22 @@ int main(int argc, char* argv[]) { /* slurp in the key from stdin */ if (ret = set_datum_fd(&data, 0), ret) { - err("didn't read file descriptor 0\n"); + err(0,"didn't read file descriptor 0\n"); return 1; } if (ret = gnutls_openpgp_privkey_init(&pgp_privkey), ret) { - err("Failed to initialized OpenPGP private key (error: %d)\n", ret); + err(0,"Failed to initialized OpenPGP private key (error: %d)\n", ret); return 1; } /* check whether it's a private key or a public key, by trying them: */ if ((gnutls_openpgp_privkey_import(pgp_privkey, &data, GNUTLS_OPENPGP_FMT_RAW, NULL, 0) == 0) || (gnutls_openpgp_privkey_import(pgp_privkey, &data, GNUTLS_OPENPGP_FMT_BASE64, NULL, 0) == 0)) { /* we're dealing with a private key */ - err("Translating private key\n"); + err(0,"Translating private key\n"); if (ret = gnutls_x509_privkey_init(&x509_privkey), ret) { - err("Failed to initialize X.509 private key for output (error: %d)\n", ret); + err(0,"Failed to initialize X.509 private key for output (error: %d)\n", ret); return 1; } @@ -342,20 +342,20 @@ int main(int argc, char* argv[]) { } else { if (ret = gnutls_openpgp_crt_init(&pgp_crt), ret) { - err("Failed to initialized OpenPGP certificate (error: %d)\n", ret); + err(0,"Failed to initialized OpenPGP certificate (error: %d)\n", ret); return 1; } if ((gnutls_openpgp_crt_import(pgp_crt, &data, GNUTLS_OPENPGP_FMT_RAW) == 0) || (gnutls_openpgp_crt_import(pgp_crt, &data, GNUTLS_OPENPGP_FMT_BASE64) == 0)) { /* we're dealing with a public key */ - err("Translating public key\n"); + err(0,"Translating public key\n"); ret = emit_public_openssh_from_pgp(&pgp_crt, use_keyid); } else { /* we have no idea what kind of key this is at all anyway! */ - err("Input does contain any form of OpenPGP key I recognize."); + err(0,"Input does contain any form of OpenPGP key I recognize."); return 1; } } -- cgit v1.2.3 From 2fa88e2fde0f56774c76e5cbdc8ea2c67849f3c0 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 13:11:54 -0400 Subject: invert the sense of the loglevel test. duh. --- src/keytrans/gnutls-helpers.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/keytrans/gnutls-helpers.c b/src/keytrans/gnutls-helpers.c index c6e4979..d5f3719 100644 --- a/src/keytrans/gnutls-helpers.c +++ b/src/keytrans/gnutls-helpers.c @@ -15,11 +15,13 @@ /* for exit() */ #include +/* higher levels allow more frivolous error messages through. + this is set with the MONKEYSPHERE_DEBUG variable */ static int loglevel = 0; void err(int level, const char* fmt, ...) { va_list ap; - if (level < loglevel) + if (level > loglevel) return; va_start(ap, fmt); vfprintf(stderr, fmt, ap); -- cgit v1.2.3 From 3283d7979d05ff3bb83aff1944e78589ac63370d Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 14:05:50 -0400 Subject: added enw to developers. --- COPYING | 1 + debian/copyright | 1 + 2 files changed, 2 insertions(+) diff --git a/COPYING b/COPYING index 14d0ee0..36b1d08 100644 --- a/COPYING +++ b/COPYING @@ -8,6 +8,7 @@ It is free software, developed by: Micah Anderson Matthew Goins Mike Castleman + Elliot Winard Greg Lyle MonkeySphere is distributed in the hope that it will be useful, but diff --git a/debian/copyright b/debian/copyright index b7e823b..040e6c8 100644 --- a/debian/copyright +++ b/debian/copyright @@ -10,6 +10,7 @@ Copyright: 2008 Jameson Rollins , Micah Anderson , Matthew Goins , Mike Castleman , + Elliot Winard , Greg Lyle License: GPL-3+ -- cgit v1.2.3 From 0c2c01095b4e3e707a08e9ff6ebe61f18689bcaa Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 14:56:01 -0400 Subject: Modify how logging is handled. Now send most everything to stderr. Change to known_hosts hashing on by default. --- src/common | 22 ++++++++-------------- src/monkeysphere | 36 ++++++++++++++++++------------------ src/monkeysphere-server | 4 ++-- 3 files changed, 28 insertions(+), 34 deletions(-) diff --git a/src/common b/src/common index 8b0f41a..0f98923 100644 --- a/src/common +++ b/src/common @@ -23,14 +23,8 @@ failure() { exit ${2:-'1'} } -# write output to stdout -log() { - echo -n "ms: " - echo "$@" -} - # write output to stderr -loge() { +log() { echo -n "ms: " 1>&2 echo "$@" 1>&2 } @@ -153,7 +147,7 @@ process_user_id() { # return 1 if there only "tru" lines are output from gpg if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - loge " key not found." + log " key not found." return 1 fi @@ -182,18 +176,18 @@ process_user_id() { # check primary key validity if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then - loge " unacceptable primary key validity ($validity)." + log " unacceptable primary key validity ($validity)." continue fi # check capability is not Disabled... if check_capability "$capability" 'D' ; then - loge " key disabled." + log " key disabled." continue fi # check overall key capability # must be Encryption and Authentication if ! check_capability "$capability" $requiredPubCapability ; then - loge " unacceptable primary key capability ($capability)." + log " unacceptable primary key capability ($capability)." continue fi @@ -242,7 +236,7 @@ process_user_id() { # key cache file if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then for keyID in ${keyIDs[@]} ; do - loge " acceptable key/uid found." + log " acceptable key/uid found." if [ "$MODE" = 'known_hosts' ] ; then # export the key @@ -298,11 +292,11 @@ process_known_hosts() { cacheDir="$2" # take all the hosts from the known_hosts file (first field), - # grep out all the hashed hosts (lines starting with '|') + # grep out all the hashed hosts (lines starting with '|')... cut -d ' ' -f 1 "$knownHosts" | \ grep -v '^|.*$' | \ while IFS=, read -r -a hosts ; do - # process each host + # ...and process each host for host in ${hosts[*]} ; do process_host "$host" "$cacheDir" done diff --git a/src/monkeysphere b/src/monkeysphere index 6e71765..69741e1 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -15,7 +15,7 @@ SHAREDIR=${SHAREDIR:-"/usr/share/monkeysphere"} export SHAREDIR . "${SHAREDIR}/common" -GLOBAL_CONFIG=${GLOBAL_CONFIG:-"${ETC}"/monkeysphere.conf} +GLOBAL_CONFIG=${GLOBAL_CONFIG:-"${ETC}/monkeysphere.conf"} [ -r "$GLOBAL_CONFIG" ] && . "$GLOBAL_CONFIG" # date in UTF format if needed @@ -63,7 +63,7 @@ gen_ae_subkey(){ # return 1 if there only "tru" lines are output from gpg if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - loge " key not found." + log " key not found." return 1 fi @@ -78,7 +78,7 @@ Name-Real: $userID EOF ) - log "The following key parameters will be used:" + echo "The following key parameters will be used:" echo "$keyParameters" read -p "generate key? [Y|n]: " OK; OK=${OK:=Y} @@ -107,27 +107,27 @@ COMMAND="$1" shift # set ms home directory -MS_HOME=${MS_HOME:-"$HOME"/.config/monkeysphere} +MS_HOME=${MS_HOME:-"${HOME}/.config/monkeysphere"} # load configuration file -MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf} +MS_CONF=${MS_CONF:-"${MS_HOME}/monkeysphere.conf"} [ -e "$MS_CONF" ] && . "$MS_CONF" # set empty config variable with defaults -AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids} -GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg} -KEYSERVER=${KEYSERVER:-subkeys.pgp.net} +AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"} +GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"} +KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} -USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys} -USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts} -HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"} +USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"} +HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"} export GNUPGHOME # stagging locations -hostKeysCacheDir="$MS_HOME"/host_keys -userKeysCacheDir="$MS_HOME"/user_keys -msAuthorizedKeys="$MS_HOME"/authorized_keys +hostKeysCacheDir="${MS_HOME}/host_keys" +userKeysCacheDir="${MS_HOME}/user_keys" +msAuthorizedKeys="${MS_HOME}/authorized_keys" # make sure gpg home exists with proper permissions mkdir -p -m 0700 "$GNUPGHOME" @@ -142,6 +142,7 @@ case $COMMAND in MODE='known_hosts' # touch the known_hosts file to make sure it exists + # ssh-keygen complains if it doesn't exist touch "$USER_KNOWN_HOSTS" # if hosts are specified on the command line, process just @@ -151,8 +152,8 @@ case $COMMAND in process_host "$host" "$hostKeysCacheDir" done - # otherwise, if no hosts are specified, process the user - # known_hosts file + # otherwise, if no hosts are specified, process every user + # in the user's known_hosts file else if [ ! -s "$USER_KNOWN_HOSTS" ] ; then failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." @@ -167,8 +168,7 @@ case $COMMAND in # make sure authorized_user_ids file exists if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - log "authorized_user_ids file is empty or does not exist." - exit + failure "authorized_user_ids file is empty or does not exist." fi # set user-controlled authorized_keys file path diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 0ff06af..65a7dda 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -70,7 +70,7 @@ EOF ) fi - log "The following key parameters will be used:" + echo "The following key parameters will be used:" echo "$keyParameters" read -p "generate key? [Y|n]: " OK; OK=${OK:=Y} @@ -90,7 +90,7 @@ EOF EOF ) - echo "generating server key..." + log "generating server key..." echo "$keyParameters" | gpg --batch --gen-key } -- cgit v1.2.3 From a7275bfcb21bccff64ccc544676406cb6318a021 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 13 Jun 2008 15:12:07 -0400 Subject: added TODO documentation with additional projects. --- doc/TODO | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 doc/TODO diff --git a/doc/TODO b/doc/TODO new file mode 100644 index 0000000..6125fea --- /dev/null +++ b/doc/TODO @@ -0,0 +1,39 @@ +Next-Steps Monkeysphere Projects: +--------------------------------- + +Provide a friendly interactive UI for marginal or failing client-side + hostkey verifications. Handle the common cases smoothly, and + provide good debugging info for the unusual cases. + +Make sure onak properly escapes user IDs with colons in them. + +Build a decent, presentable web site for documentation, evangelism, + etc. Include a mention of how to report trouble or concerns. + +Create ssh2openpgp or convert to full-fledged keytrans. + +Resolve the bugs listed in openpgp2ssh(1):BUGS. + +Understand and document alternate trustdb models. + +Understand and document the output of gpg --check-trustdb: + gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model + gpg: depth: 0 valid: 2 signed: 20 trust: 0-, 0q, 0n, 0m, 0f, 2u + gpg: depth: 1 valid: 20 signed: 67 trust: 15-, 0q, 1n, 3m, 1f, 0u + gpg: next trustdb check due at 2008-10-09 + +Understand and document the numeric values between sig! and the keyid + in "gpg --check-sigs $KEYID" . Compare with the details found from + "gpg --with-colons --check-sigs $KEYID". This has to do with trust + signatures. + +Fix gpg's documentation to clarify the difference between validity and + ownertrust. Include better documentation for trust signatures. + +Make it easier to do domain-relative ssh host trust signatures with + gnupg. (e.g. "i trust Jamie McClelland (keyID 76CC057D) to properly + identify ssh servers in the mayfirst.org domain") See: + http://tools.ietf.org/html/rfc4880#section-5.2.3.21 and grep for + "tsign" in gpg(1). + +Fix the order of questions when user does a tsign in gpg or gpg2. -- cgit v1.2.3 From ad0a9cc0958b30f5be851453ea22c151097fad0c Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 15:36:11 -0400 Subject: More cleanup: - Batch mode for trust_key function. - fix some loggging. - Clean up publish_server_key function -> STILL NON-FUNCTIONING - more work on monkeysphere-ssh-proxycommand man page --- man/man1/monkeysphere-ssh-proxycommand.1 | 31 ++++++--- src/common | 108 +++++++++++++++++++++---------- src/monkeysphere | 23 +++---- src/monkeysphere-server | 19 +----- 4 files changed, 109 insertions(+), 72 deletions(-) diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1 index 41a95aa..63b5a5e 100644 --- a/man/man1/monkeysphere-ssh-proxycommand.1 +++ b/man/man1/monkeysphere-ssh-proxycommand.1 @@ -2,19 +2,32 @@ .SH NAME monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script .PD -.SH SYNOPSIS -.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ... -.PD .SH DESCRIPTION .PP -MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh -authentication and encryption. OpenPGP keys are tracked via GnuPG, -and added to the ssh authorized_keys and known_hosts files to be used -for authentication and encryption of ssh connection. - \fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used to trigger a monkeysphere update of the known_hosts file for the hosts -that are being connected to. +that are being connected to. It is meant to be run as an ssh +ProxyCommand. This can either be done by specifying the proxy command +on the command line: + +.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ... + +or by adding the following line to your ~/.ssh/config script: + +.B ProxyCommand monkeysphere-ssh-proxycommand %h %p + +The script is very simple, and can easily be incorporated into other +ProxyCommand scripts. All it does is first runs + +.B monkeysphere update-known-hosts HOST + +and then + +.B exec nc HOST PORT + +Run the following command for more info: + +.B less $(which monkeysphere-ssh-proxycommand) .PD .SH AUTHOR Written by Jameson Rollins diff --git a/src/common b/src/common index 0f98923..d56028f 100644 --- a/src/common +++ b/src/common @@ -42,7 +42,7 @@ cutline() { # retrieve all keys with given user id from keyserver # FIXME: need to figure out how to retrieve all matching keys # (not just first 5) -gpg_fetch_keys() { +gpg_fetch_userid() { local id id="$1" echo 1,2,3,4,5 | \ @@ -69,6 +69,18 @@ check_capability() { return 0 } +# get the full fingerprint of a key ID +get_key_fingerprint() { + local keyID + + keyID="$1" + + gpg --list-key --with-colons --fixed-list-mode \ + --with-fingerprint "$keyID" | grep "$keyID" | \ + grep '^fpr:' | cut -d: -f10 +} + + # convert escaped characters from gpg output back into original # character # FIXME: undo all escape character translation in with-colons gpg output @@ -139,7 +151,7 @@ process_user_id() { requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") # fetch keys from keyserver, return 1 if none found - gpg_fetch_keys "$userID" || return 1 + gpg_fetch_userid "$userID" || return 1 # output gpg info for (exact) userid and store gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ @@ -261,6 +273,36 @@ process_user_id() { echo "$cacheDir"/"$userIDHash"."$pubKeyID" } +# update the cache for userid, and prompt to add file to +# authorized_user_ids file if the userid is found in gpg +# and not already in file. +update_userid() { + local userID + local cacheDir + local userIDKeyCache + + userID="$1" + cacheDir="$2" + + log "processing userid: '$userID'" + userIDKeyCache=$(process_user_id "$userID" "$cacheDir") + if [ -z "$userIDKeyCache" ] ; then + return 1 + fi + if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + echo "the following userid is not in the authorized_user_ids file:" + echo " $userID" + read -p "would you like to add it? [Y|n]: " OK; OK=${OK:=Y} + if [ ${OK/y/Y} = 'Y' ] ; then + log -n "adding userid to authorized_user_ids file... " + echo "$userID" >> "$AUTHORIZED_USER_IDS" + echo "done." + else + log "authorized_user_ids file untouched." + fi + fi +} + # process a host for addition to a known_host file process_host() { local host @@ -392,42 +434,38 @@ process_userids_from_authorized_keys() { done } -# update the cache for userid, and prompt to add file to -# authorized_user_ids file if the userid is found in gpg -# and not already in file. -update_userid() { - local userID - local cacheDir - local userIDKeyCache - - userID="$1" - cacheDir="$2" - - log "processing userid: '$userID'" - userIDKeyCache=$(process_user_id "$userID" "$cacheDir") - if [ -z "$userIDKeyCache" ] ; then - return 1 - fi - if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then - echo "the following userid is not in the authorized_user_ids file:" - echo " $userID" - read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y} - if [ ${OK/y/Y} = 'Y' ] ; then - log -n " adding userid to authorized_user_ids file... " - echo "$userID" >> "$AUTHORIZED_USER_IDS" - echo "done." - fi - fi -} - # retrieve key from web of trust, and set owner trust to "full" # if key is found. trust_key() { # get the key from the key server - gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'" + if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then + log "could not retrieve key '$keyID'" + return 1 + fi + + # get key fingerprint + fingerprint=$(get_key_fingerprint "$keyID") + + # import "full" trust for fingerprint into gpg + echo ${fingerprint}:5: | gpg --import-ownertrust + if [ $? = 0 ] ; then + log "owner trust updated." + else + failure "there was a problem changing owner trust." + fi +} + +# publish server key to keyserver +publish_server_key() { + read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N} + if [ ${OK/y/Y} != 'Y' ] ; then + failure "aborting." + fi - # edit the key to change trust - # FIXME: need to figure out how to automate this, - # in a batch mode or something. - gpg --edit-key "$keyID" + # publish host key + # FIXME: need to figure out better way to identify host key + # dummy command so as not to publish fakes keys during testing + # eventually: + #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f) + echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)" } diff --git a/src/monkeysphere b/src/monkeysphere index 69741e1..782ba5e 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -136,6 +136,7 @@ mkdir -p -m 0700 "$GNUPGHOME" mkdir -p -m 0700 "$MS_HOME" mkdir -p "$hostKeysCacheDir" mkdir -p "$userKeysCacheDir" +touch "$AUTHORIZED_USER_IDS" case $COMMAND in 'update-known_hosts'|'update-known-hosts'|'k') @@ -163,12 +164,21 @@ case $COMMAND in fi ;; + 'update-userids'|'u') + if [ -z "$1" ] ; then + failure "you must specify at least one userid." + fi + for userID ; do + update_userid "$userID" "$userKeysCacheDir" + done + ;; + 'update-authorized_keys'|'update-authorized-keys'|'a') MODE='authorized_keys' # make sure authorized_user_ids file exists if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - failure "authorized_user_ids file is empty or does not exist." + failure "$AUTHORIZED_USER_IDS is empty." fi # set user-controlled authorized_keys file path @@ -178,15 +188,6 @@ case $COMMAND in update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir" ;; - 'update-userids'|'u') - if [ -z "$1" ] ; then - failure "you must specify at least one userid." - fi - for userID ; do - update_userid "$userID" "$userKeysCacheDir" - done - ;; - 'gen-ae-subkey'|'g') keyID="$1" if [ -z "$keyID" ] ; then @@ -201,6 +202,6 @@ case $COMMAND in *) failure "Unknown command: '$COMMAND' -Type 'cereal-admin help' for usage." +Type '$PGRM help' for usage." ;; esac diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 65a7dda..ffb3452 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -94,21 +94,6 @@ EOF echo "$keyParameters" | gpg --batch --gen-key } -# publish server key to keyserver -publish_key() { - read -p "publish key to $KEYSERVER? [Y|n]: " OK; OK=${OK:=Y} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "aborting." - fi - - keyID=$(gpg --list-key --with-colons ="$USERID" 2> /dev/null | grep '^pub:' | cut -d: -f5) - - # dummy command so as not to publish fakes keys during testing - # eventually: - #gpg --send-keys --keyserver "$KEYSERVER" "$keyID" - echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $keyID" -} - ######################################################################## # MAIN ######################################################################## @@ -176,7 +161,7 @@ case $COMMAND in ;; 'publish-key'|'p') - publish_key + publish_server_key ;; 'trust-keys'|'t') @@ -210,6 +195,6 @@ case $COMMAND in *) failure "Unknown command: '$COMMAND' -Type 'cereal-admin help' for usage." +Type '$PGRM help' for usage." ;; esac -- cgit v1.2.3 From 6075397cffdceaf72dd3b430c9124c2ebb59ac65 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 16:56:50 -0400 Subject: make sure the authorized_user_ids file exists for users processed by monkeysphere-server. --- debian/monkeysphere.dirs | 1 + src/monkeysphere | 4 ++-- src/monkeysphere-server | 23 ++++++++++++++++++----- 3 files changed, 21 insertions(+), 7 deletions(-) diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs index fa2bf5f..4604eee 100644 --- a/debian/monkeysphere.dirs +++ b/debian/monkeysphere.dirs @@ -1,3 +1,4 @@ usr/share/monkeysphere var/cache/monkeysphere etc/monkeysphere +etc/monkeysphere/authorized_user_ids diff --git a/src/monkeysphere b/src/monkeysphere index 782ba5e..997ca58 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -31,7 +31,7 @@ GREP_OPTIONS= usage() { cat < [args] -Monkeysphere client tool. +MonkeySphere client tool. subcommands: update-known_hosts (k) [HOST]... update known_hosts file @@ -176,7 +176,7 @@ case $COMMAND in 'update-authorized_keys'|'update-authorized-keys'|'a') MODE='authorized_keys' - # make sure authorized_user_ids file exists + # fail if the authorized_user_ids file is empty if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then failure "$AUTHORIZED_USER_IDS is empty." fi diff --git a/src/monkeysphere-server b/src/monkeysphere-server index ffb3452..922aad3 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -28,7 +28,7 @@ GREP_OPTIONS= usage() { cat < [args] -Monkeysphere server admin tool. +MonkeySphere server admin tool. subcommands: update-users (s) [USER]... update users authorized_keys files @@ -121,7 +121,7 @@ export GNUPGHOME mkdir -p -m 0700 "$GNUPGHOME" case $COMMAND in - 'update-users'|'s') + 'update-users'|'update-user'|'s') if [ "$1" ] ; then unames="$@" else @@ -133,13 +133,17 @@ case $COMMAND in log "----- user: $uname -----" + # set variables for the user AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" msAuthorizedKeys="$CACHE"/"$uname"/authorized_keys cacheDir="$CACHE"/"$uname"/user_keys - # make sure authorized_user_ids file exists + # make sure user's authorized_user_ids file exists + touch "$AUTHORIZED_USER_IDS" + + # skip if the user's authorized_user_ids file is empty if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - log "authorized_user_ids file for '$uname' is empty or does not exist." + log "authorized_user_ids file for '$uname' is empty." continue fi @@ -164,10 +168,12 @@ case $COMMAND in publish_server_key ;; - 'trust-keys'|'t') + 'trust-keys'|'trust-key'|'t') if [ -z "$1" ] ; then failure "you must specify at least one key to trust." fi + + # process key IDs for keyID ; do trust_key "$keyID" done @@ -182,8 +188,15 @@ case $COMMAND in if [ -z "$1" ] ; then failure "you must specify at least one userid." fi + + # set variables for the user AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" cacheDir="$CACHE"/"$uname"/user_keys + + # make sure user's authorized_user_ids file exists + touch "$AUTHORIZED_USER_IDS" + + # process the user IDs for userID ; do update_userid "$userID" "$cacheDir" done -- cgit v1.2.3 From 2ed952e2207d5278cfe96db2d7eeed40709f846b Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 13 Jun 2008 17:47:34 -0400 Subject: Add 'remove_userid' function, inverse of 'update_userids'. Also, tweaked some of the output and man pages. --- debian/control | 2 +- man/man1/monkeysphere.1 | 15 +++++++++++---- man/man8/monkeysphere-server.8 | 17 +++++++++++++---- src/common | 32 +++++++++++++++++++++++++++----- src/monkeysphere | 18 ++++++++++++++++-- src/monkeysphere-server | 33 +++++++++++++++++++++++++++++++-- 6 files changed, 99 insertions(+), 18 deletions(-) diff --git a/debian/control b/debian/control index afd5bfa..d4d25c6 100644 --- a/debian/control +++ b/debian/control @@ -10,7 +10,7 @@ Dm-Upload-Allowed: yes Package: monkeysphere Architecture: any -Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), ${shlibs:Depends} +Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), moreutils, ${shlibs:Depends} Recommends: netcat Enhances: openssh-client, openssh-server Description: use the OpenPGP web of trust to verify ssh connections diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index d00a9db..762f008 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -31,25 +31,32 @@ listed in the known_hosts file will be processed. `k' may be used in place of `update-known_hosts'. .TP .B update-userids [USERID]... -Add/update a userid in the authorized_user_ids file. The user IDs +Add/update a user ID to the authorized_user_ids file. The user IDs specified should be exact matches to OpenPGP user IDs. For each specified user ID, gpg will be queried for a key associated with that user ID, querying a keyserver if none is found in the user's keychain. If a key is found, it will be added to the user_keys cache (see KEY CACHES) and the user ID will be added to the user's -authorized_user_ids file (if it wasn't already present). +authorized_user_ids file (if it wasn't already present). `u' may be +used in place of `update-userids'. +.TP +.B remove-userids [USERID]... +Remove a user ID from the authorized_user_ids file. The user IDs +specified should be exact matches to OpenPGP user IDs. `r' may be +used in place of `remove-userids'. .TP .B update-authorized_keys Update the monkeysphere authorized_keys file. The monkeysphere authorized_keys file will be regenerated from the valid keys in the user_key cache, and the user's independently controlled -authorized_keys file (usually ~/.ssh/authorized_keys). +authorized_keys file (usually ~/.ssh/authorized_keys). `a' may be +used in place of `update-authorized_keys'. .TP .B gen-ae-subkey KEYID Generate an `ae` capable subkey. For the primary key with the specified key ID, generate a subkey with "authentication" and "encryption" capability that can be used for MonkeySphere -transactions. +transactions. `g' may be used in place of `gen-ae-subkey'. .TP .B help Output a brief usage summary. `h' or `?' may be used in place of diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index cc07077..8f62610 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -19,18 +19,27 @@ be used for authentication and encryption of ssh connection. Update the admin-controlled authorized_keys files for user. For each user specified, update the user's authorized_keys file in /var/cache/monkeysphere/USER. See `man monkeysphere' for more info. +`k' may be used in place of `update-known_hosts'. .TP .B gen-key -Generate a gpg key for the host. +Generate a gpg key for the host. `g' may be used in place of +`gen-key'. .TP .B publish-key -Publish the host's gpg key to a keyserver. +Publish the host's gpg key to a keyserver. `p' may be used in place +of `publish-key' .TP .B trust-keys KEYID... -Mark key specified with KEYID with full owner trust. +Mark key specified with KEYID with full owner trust. `t' may be used +in place of `trust-keys'. .TP .B update-user-userids USER USERID... -Add/update a userid in the authorized_user_ids file for USER. +Add/update a user ID to the authorized_user_ids file for USER. `u' may +be used in place of `update-user-userids'. +.TP +.B remove-user-userids USER USERID... +Remove a user ID from the authorized_user_ids file for USER. `r' may +be used in place of `remove-user-userids'. .TP .B help Output a brief usage summary. `h' or `?' may be used in place of diff --git a/src/common b/src/common index d56028f..01e6f32 100644 --- a/src/common +++ b/src/common @@ -240,6 +240,9 @@ process_user_id() { # hash userid for cache file name userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') + # make sure the cache directory exists + mkdir -p "$cacheDir" + # touch/clear key cache file # (will be left empty if there are noacceptable keys) > "$cacheDir"/"$userIDHash"."$pubKeyID" @@ -285,16 +288,16 @@ update_userid() { cacheDir="$2" log "processing userid: '$userID'" + userIDKeyCache=$(process_user_id "$userID" "$cacheDir") + if [ -z "$userIDKeyCache" ] ; then return 1 fi if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then - echo "the following userid is not in the authorized_user_ids file:" - echo " $userID" - read -p "would you like to add it? [Y|n]: " OK; OK=${OK:=Y} + read -p "user ID not currently authorized. authorize? [Y|n]: " OK; OK=${OK:=Y} if [ ${OK/y/Y} = 'Y' ] ; then - log -n "adding userid to authorized_user_ids file... " + log -n "adding user ID to authorized_user_ids file... " echo "$userID" >> "$AUTHORIZED_USER_IDS" echo "done." else @@ -303,6 +306,24 @@ update_userid() { fi } +# remove a userid from the authorized_user_ids file +remove_userid() { + local userID + + userID="$1" + + log "processing userid: '$userID'" + + if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + log "user ID not currently authorized." + return 1 + fi + + log -n "removing user ID '$userID'... " + grep -v "$userID" "$AUTHORIZED_USER_IDS" | sponge "$AUTHORIZED_USER_IDS" + echo "done." +} + # process a host for addition to a known_host file process_host() { local host @@ -373,7 +394,8 @@ update_authorized_keys() { cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" echo "done." fi - log "monkeysphere authorized_keys file generated: $msAuthorizedKeys" + log "monkeysphere authorized_keys file generated:" + log "$msAuthorizedKeys" } # process an authorized_*_ids file diff --git a/src/monkeysphere b/src/monkeysphere index 997ca58..1ba51d7 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -35,7 +35,8 @@ MonkeySphere client tool. subcommands: update-known_hosts (k) [HOST]... update known_hosts file - update-userids (u) [USERID]... add/update userid + update-userids (u) [USERID]... add/update user IDs + remove-userids (r) [USERID]... remove user IDs update-authorized_keys (a) update authorized_keys file gen-ae-subkey (g) KEYID generate an 'ae' capable subkey help (h,?) this help @@ -164,13 +165,26 @@ case $COMMAND in fi ;; - 'update-userids'|'u') + 'update-userids'|'update-userid'|'u') if [ -z "$1" ] ; then failure "you must specify at least one userid." fi for userID ; do update_userid "$userID" "$userKeysCacheDir" done + log "run the following to update your monkeysphere authorized_keys file:" + log "$PGRM update-authorized_keys" + ;; + + 'remove-userids'|'remove-userid'|'r') + if [ -z "$1" ] ; then + failure "you must specify at least one userid." + fi + for userID ; do + remove_userid "$userID" + done + log "run the following to update your monkeysphere authorized_keys file:" + log "$PGRM update-authorized_keys" ;; 'update-authorized_keys'|'update-authorized-keys'|'a') diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 922aad3..13221c5 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -35,7 +35,8 @@ subcommands: gen-key (g) generate gpg key for the server publish-key (p) publish server key to keyserver trust-keys (t) KEYID... mark keyids as trusted - update-user-userids (u) USER UID... add/update userids for a user + update-user-userids (u) USER UID... add/update user IDs for a user + remove-user-userids (r) USER UID... remove user IDs for a user help (h,?) this help EOF @@ -179,7 +180,7 @@ case $COMMAND in done ;; - 'update-user-userids'|'u') + 'update-user-userids'|'update-user-userid'|'u') uname="$1" shift if [ -z "$uname" ] ; then @@ -200,6 +201,34 @@ case $COMMAND in for userID ; do update_userid "$userID" "$cacheDir" done + + log "run the following to update user's authorized_keys file:" + log "$PGRM update-users $uname" + ;; + + 'remove-user-userids'|'remove-user-userid'|'r') + uname="$1" + shift + if [ -z "$uname" ] ; then + failure "you must specify user." + fi + if [ -z "$1" ] ; then + failure "you must specify at least one userid." + fi + + # set variables for the user + AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" + + # make sure user's authorized_user_ids file exists + touch "$AUTHORIZED_USER_IDS" + + # process the user IDs + for userID ; do + remove_userid "$userID" + done + + log "run the following to update user's authorized_keys file:" + log "$PGRM update-users $uname" ;; 'help'|'h'|'?') -- cgit v1.2.3 From 3141ed26d4d5af1886166f5d91a041dc60d381eb Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Sat, 14 Jun 2008 15:06:48 -0400 Subject: cleaning up error output. --- src/keytrans/openpgp2ssh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c index 9e356e7..58f569e 100644 --- a/src/keytrans/openpgp2ssh.c +++ b/src/keytrans/openpgp2ssh.c @@ -355,7 +355,7 @@ int main(int argc, char* argv[]) { } else { /* we have no idea what kind of key this is at all anyway! */ - err(0,"Input does contain any form of OpenPGP key I recognize."); + err(0,"Input does contain any form of OpenPGP key I recognize.\n"); return 1; } } -- cgit v1.2.3 From 31e072432f985e03cc27b101f3a150fb45204d4f Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Sat, 14 Jun 2008 15:58:19 -0400 Subject: Add lsign-key to the trust_keys function so that the trusted key actually ends up with full validity. --- src/common | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/common b/src/common index 01e6f32..19b5485 100644 --- a/src/common +++ b/src/common @@ -468,6 +468,11 @@ trust_key() { # get key fingerprint fingerprint=$(get_key_fingerprint "$keyID") + # attach a "non-exportable" signature to the key + # this is required for the key to have any validity at all + # the 'y's on stdin indicates "yes, i really want to sign" + echo -e 'y\ny' | gpg --lsign-key --command-fd 0 "$fingerprint" + # import "full" trust for fingerprint into gpg echo ${fingerprint}:5: | gpg --import-ownertrust if [ $? = 0 ] ; then -- cgit v1.2.3 From 28c7489bb830c8ef9bb7c6e40e3fc4d47a702614 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Sat, 14 Jun 2008 15:58:34 -0400 Subject: More work on the man pages. --- man/man1/monkeysphere-ssh-proxycommand.1 | 12 ++++++--- man/man1/monkeysphere.1 | 44 ++++++++++++++++++++------------ man/man1/openpgp2ssh.1 | 2 +- man/man8/monkeysphere-server.8 | 25 ++++++++++++------ src/monkeysphere-server | 2 +- 5 files changed, 55 insertions(+), 30 deletions(-) diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1 index 63b5a5e..8392ae8 100644 --- a/man/man1/monkeysphere-ssh-proxycommand.1 +++ b/man/man1/monkeysphere-ssh-proxycommand.1 @@ -1,9 +1,11 @@ .TH MONKEYSPHERE-SSH-PROXYCOMMAND "1" "June 2008" "monkeysphere 0.1" "User Commands" + .SH NAME + monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script -.PD + .SH DESCRIPTION -.PP + \fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used to trigger a monkeysphere update of the known_hosts file for the hosts that are being connected to. It is meant to be run as an ssh @@ -28,11 +30,13 @@ and then Run the following command for more info: .B less $(which monkeysphere-ssh-proxycommand) -.PD + .SH AUTHOR + Written by Jameson Rollins -.PD + .SH SEE ALSO + .BR monkeypshere (1), .BR ssh (1), .BR gpg (1) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index 762f008..526cad6 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -1,20 +1,24 @@ .TH MONKEYSPHERE "1" "June 2008" "monkeysphere 0.1" "User Commands" + .SH NAME + monkeysphere \- MonkeySphere client user interface -.PD + .SH SYNOPSIS + .B monkeysphere \fIcommand\fP [\fIargs\fP] -.PD + .SH DESCRIPTION -.PP + MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh authentication and encryption. OpenPGP keys are tracked via GnuPG, and added to the ssh authorized_keys and known_hosts files to be used for authentication and encryption of ssh connection. \fBmonkeysphere\fP is the MonkeySphere client utility. -.PD + .SH SUBCOMMANDS + \fBmonkeysphere\fP takes various subcommands: .TP .B update-known_hosts [HOST]... @@ -61,10 +65,15 @@ transactions. `g' may be used in place of `gen-ae-subkey'. .B help Output a brief usage summary. `h' or `?' may be used in place of `help'. -.PD + +.SH HOST URIs + +Host OpenPGP keys have associated user IDs that use the ssh URI +specification for the host, ie. "ssh://host.full.domain". + .SH KEY ACCEPTABILITY + GPG keys are considered acceptable if the following criteria are met: -.PD .TP .B capability The key must have both the "authentication" and "encrypt" capability @@ -72,8 +81,9 @@ flags. .TP .B validity The key must be "fully" valid, and must not be expired or revoked. -.PD + .SH KEY CACHES + Monkeysphere keeps track of keys in key cache directories. The files in the cache are named with the format "USERID_HASH.PUB_KEY_ID", where USERID_HASH is a hash of the exact OpenPGP user ID, and PUB_KEY_ID is @@ -86,9 +96,9 @@ will be stored in the host_keys cache files, and authorized_keys style key lines will be stored in the user_keys cache files. OpenPGP keys are converted to ssh-style keys with the openpgp2ssh utility (see `man openpgp2ssh'). -.PD + .SH FILES -.PD 1 + .TP ~/.config/monkeysphere/monkeysphere.conf User monkeysphere config file. @@ -97,8 +107,8 @@ User monkeysphere config file. System-wide monkeysphere config file. .TP ~/.config/monkeysphere/authorized_user_ids -GPG user IDs associated with keys that will be checked for addition to -the authorized_keys file. +OpenPGP user IDs associated with keys that will be checked for +addition to the authorized_keys file. .TP ~/.config/monkeysphere/authorized_keys Monkeysphere generated authorized_keys file. @@ -108,12 +118,14 @@ User keys cache directory. .TP ~/.config/monkeysphere/host_keys Host keys cache directory. -.PD + .SH AUTHOR + Written by Jameson Rollins -.PD + .SH SEE ALSO -.BR ssh (1), + .BR monkeysphere-ssh-proxycommand (1), -.BR gpg (1), -.BR monkeysphere-server (8) +.BR monkeysphere-server (8), +.BR ssh (1), +.BR gpg (1) diff --git a/man/man1/openpgp2ssh.1 b/man/man1/openpgp2ssh.1 index 83b6154..bea1da5 100644 --- a/man/man1/openpgp2ssh.1 +++ b/man/man1/openpgp2ssh.1 @@ -69,7 +69,7 @@ and this man page were written by Daniel Kahn Gillmor . .Sh BUGS .Nm -currently only exports into formats used by the OpenSSH. +Currently only exports into formats used by the OpenSSH. It should support other key output formats, such as those used by lsh(1) and putty(1). .Pp diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index 8f62610..eafd6a8 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -1,18 +1,24 @@ .TH MONKEYSPHERE-SERVER "1" "June 2008" "monkeysphere 0.1" "User Commands" + .SH NAME + monkeysphere-server \- monkeysphere server admin user interface + .SH SYNOPSIS + .B monkeysphere-server \fIcommand\fP [\fIargs\fP] + .SH DESCRIPTION -.PP + \fBMonkeySphere\fP is a system to leverage the OpenPGP Web of Trust for ssh authentication and encryption. OpenPGP keys are tracked via GnuPG, and added to the ssh authorized_keys and known_hosts files to be used for authentication and encryption of ssh connection. \fBmonkeysphere-server\fP is the MonkeySphere server admin utility. -.PD + .SH SUBCOMMANDS + \fBmonkeysphere-server\fP takes various subcommands: .TP .B update-users [USER]... @@ -26,11 +32,11 @@ Generate a gpg key for the host. `g' may be used in place of `gen-key'. .TP .B publish-key -Publish the host's gpg key to a keyserver. `p' may be used in place +Publish the host's gpg key to the keyserver. `p' may be used in place of `publish-key' .TP .B trust-keys KEYID... -Mark key specified with KEYID with full owner trust. `t' may be used +Mark key specified with key IDs with full owner trust. `t' may be used in place of `trust-keys'. .TP .B update-user-userids USER USERID... @@ -44,9 +50,9 @@ be used in place of `remove-user-userids'. .B help Output a brief usage summary. `h' or `?' may be used in place of `help'. -.PD + .SH FILES -.PD 1 + .TP /etc/monkeysphere/monkeysphere-server.conf System monkeysphere-server config file. @@ -60,12 +66,15 @@ Monkeysphere GNUPG home directory. /etc/monkeysphere/authorized_user_ids/USER Server maintained authorized_user_ids files for users. .TP -/var/cachemonkeysphere/USER +/var/cache/monkeysphere/USER User keys cache directories. -.PD + .SH AUTHOR + Written by Jameson Rollins + .SH SEE ALSO + .BR monkeysphere (1), .BR gpg (1), .BR ssh (1) diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 13221c5..e05b4b7 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -47,7 +47,7 @@ gen_key() { # set key defaults KEY_TYPE=${KEY_TYPE:-"RSA"} KEY_LENGTH=${KEY_LENGTH:-"2048"} - KEY_USAGE=${KEY_USAGE:-"encrypt,auth"} + KEY_USAGE=${KEY_USAGE:-"auth,encrypt"} SERVICE=${SERVICE:-"ssh"} HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} -- cgit v1.2.3 From 07cb14cdb80ef060e63ba2713ef70b67db9f5783 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Sun, 15 Jun 2008 11:46:07 -0400 Subject: Separate required key capability variables for users and hosts. Change default for user to be "a", and host to be "e a". --- etc/monkeysphere-server.conf | 9 ++++++--- etc/monkeysphere.conf | 6 +++++- src/common | 33 ++++++++++++++++++++------------- src/monkeysphere | 3 ++- src/monkeysphere-server | 2 +- 5 files changed, 34 insertions(+), 19 deletions(-) diff --git a/etc/monkeysphere-server.conf b/etc/monkeysphere-server.conf index 3c16c5f..82da497 100644 --- a/etc/monkeysphere-server.conf +++ b/etc/monkeysphere-server.conf @@ -1,20 +1,23 @@ # MonkeySphere server configuration file. +# This is an sh-style shell configuration file. Variable names should +# be separated from their assignements by a single '=' and no spaces. + # GPG home directory for server #GNUPGHOME=/etc/monkeysphere/gnupg # GPG keyserver to search for keys #KEYSERVER=subkeys.pgp.net -# Required key capabilities +# Required user key capabilities # Must be quoted, lowercase, space-seperated list of the following: # e = encrypt # s = sign # c = certify # a = authentication -#REQUIRED_KEY_CAPABILITY="e a" +#REQUIRED_USER_KEY_CAPABILITY="a" # Whether to add user controlled authorized_keys file to # monkeysphere-generated authorized_keys file. Should be path to file -# where '%h' will be substituted for the user's home directory. +# where '%h' will be replaced by the home directory of the user. #USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys diff --git a/etc/monkeysphere.conf b/etc/monkeysphere.conf index 385165a..d478b93 100644 --- a/etc/monkeysphere.conf +++ b/etc/monkeysphere.conf @@ -1,5 +1,8 @@ # MonkeySphere system-wide client configuration file. +# This is an sh-style shell configuration file. Variable names should +# be separated from their assignements by a single '=' and no spaces. + # authorized_user_ids file #AUTHORIZED_USER_IDS=~/.config/monkeysphere/authorized_user_ids @@ -15,7 +18,8 @@ # s = sign # c = certify # a = authentication -#REQUIRED_KEY_CAPABILITY="e a" +#REQUIRED_HOST_KEY_CAPABILITY="e a" +#REQUIRED_USER_KEY_CAPABILITY="a" # Path to user-controlled authorized_keys file to add to # Monkeysphere-generated authorized_keys file. If empty, then no diff --git a/src/common b/src/common index 19b5485..8d8e506 100644 --- a/src/common +++ b/src/common @@ -1,13 +1,13 @@ # -*-shell-script-*- -# Shared bash functions for the monkeysphere +# Shared sh functions for the monkeysphere # # Written by # Jameson Rollins # # Copyright 2008, released under the GPL, version 3 or later -# all caps variables are meant to be user supplied (ie. from config +# all-caps variables are meant to be user supplied (ie. from config # file) and are considered global ######################################################################## @@ -123,13 +123,14 @@ gpg2authorized_keys() { # userid and key policy checking # the following checks policy on the returned keys # - checks that full key has appropriate valididy (u|f) -# - checks key has specified capability (REQUIRED_KEY_CAPABILITY) +# - checks key has specified capability (REQUIRED_*_KEY_CAPABILITY) # - checks that particular desired user id has appropriate validity # see /usr/share/doc/gnupg/DETAILS.gz # expects global variable: "MODE" process_user_id() { local userID local cacheDir + local requiredCapability local requiredPubCapability local gpgOut local line @@ -148,7 +149,13 @@ process_user_id() { userID="$1" cacheDir="$2" - requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]") + # set the required key capability based on the mode + if [ "$MODE" = 'known_hosts' ] ; then + requiredCapability="$REQUIRED_HOST_KEY_CAPABILITY" + elif [ "$MODE" = 'authorized_keys' ] ; then + requiredCapability="$REQUIRED_USER_KEY_CAPABILITY" + fi + requiredPubCapability=$(echo "$requiredCapability" | tr "[:lower:]" "[:upper:]") # fetch keys from keyserver, return 1 if none found gpg_fetch_userid "$userID" || return 1 @@ -207,7 +214,7 @@ process_user_id() { keyOK=true # add primary key ID to key list if it has required capability - if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + if check_capability "$capability" $requiredCapability ; then keyIDs[${#keyIDs[*]}]="$keyid" fi ;; @@ -230,7 +237,7 @@ process_user_id() { ;; 'sub') # sub keys # add sub key ID to key list if it has required capability - if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then + if check_capability "$capability" $requiredCapability ; then keyIDs[${#keyIDs[*]}]="$keyid" fi ;; @@ -282,16 +289,16 @@ process_user_id() { update_userid() { local userID local cacheDir - local userIDKeyCache + local keyCache userID="$1" cacheDir="$2" log "processing userid: '$userID'" - userIDKeyCache=$(process_user_id "$userID" "$cacheDir") + keyCachePath=$(process_user_id "$userID" "$cacheDir") - if [ -z "$userIDKeyCache" ] ; then + if [ -z "$keyCachePath" ] ; then return 1 fi if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then @@ -328,17 +335,17 @@ remove_userid() { process_host() { local host local cacheDir - local hostKeyCachePath + local keyCachePath host="$1" cacheDir="$2" log "processing host: '$host'" - hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") + keyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") if [ $? = 0 ] ; then ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS" - cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS" + cat "$keyCachePath" >> "$USER_KNOWN_HOSTS" fi } @@ -425,7 +432,7 @@ process_authorized_ids() { # EXPERIMENTAL (unused) process userids found in authorized_keys file # go through line-by-line, extract monkeysphere userids from comment # fields, and process each userid -process_userids_from_authorized_keys() { +process_authorized_keys() { local authorizedKeys local cacheDir local userID diff --git a/src/monkeysphere b/src/monkeysphere index 1ba51d7..ff4423b 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -118,7 +118,8 @@ MS_CONF=${MS_CONF:-"${MS_HOME}/monkeysphere.conf"} AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"} GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"} KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} -REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} +REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"} +REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"} USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"} HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"} diff --git a/src/monkeysphere-server b/src/monkeysphere-server index e05b4b7..7d11138 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -113,7 +113,7 @@ MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere-server.conf} # set empty config variable with defaults GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} KEYSERVER=${KEYSERVER:-subkeys.pgp.net} -REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"} +REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys} export GNUPGHOME -- cgit v1.2.3 From 5ff6e131ad52ce4de7172e56170ea4f37e397a9e Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Sun, 15 Jun 2008 18:23:39 -0400 Subject: Fix gen-subkey function for client. --- man/man1/monkeysphere.1 | 15 ++++++----- src/monkeysphere | 68 ++++++++++++++++++++++++------------------------- src/monkeysphere-server | 2 +- 3 files changed, 42 insertions(+), 43 deletions(-) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index 526cad6..95f1e59 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -56,11 +56,11 @@ user_key cache, and the user's independently controlled authorized_keys file (usually ~/.ssh/authorized_keys). `a' may be used in place of `update-authorized_keys'. .TP -.B gen-ae-subkey KEYID -Generate an `ae` capable subkey. For the primary key with the -specified key ID, generate a subkey with "authentication" and -"encryption" capability that can be used for MonkeySphere -transactions. `g' may be used in place of `gen-ae-subkey'. +.B gen-subkey KEYID +Generate an `a` capable subkey. For the primary key with the +specified key ID, generate a subkey with "authentication" capability +that can be used for MonkeySphere transactions. `g' may be used in +place of `gen-subkey'. .TP .B help Output a brief usage summary. `h' or `?' may be used in place of @@ -76,8 +76,9 @@ specification for the host, ie. "ssh://host.full.domain". GPG keys are considered acceptable if the following criteria are met: .TP .B capability -The key must have both the "authentication" and "encrypt" capability -flags. +For host keys, the key must have both the "authentication" ("a") and +"encrypt" ("e") capability flags. For user keys, the key must have +the "authentication" ("a") capability flag. .TP .B validity The key must be "fully" valid, and must not be expired or revoked. diff --git a/src/monkeysphere b/src/monkeysphere index ff4423b..6369197 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # monkeysphere: MonkeySphere client tool # @@ -38,14 +38,15 @@ subcommands: update-userids (u) [USERID]... add/update user IDs remove-userids (r) [USERID]... remove user IDs update-authorized_keys (a) update authorized_keys file - gen-ae-subkey (g) KEYID generate an 'ae' capable subkey + gen-subkey (g) KEYID generate an 'a' capable subkey help (h,?) this help EOF } -# generate a subkey with the 'a' and 'e' usage flags set -gen_ae_subkey(){ +# generate a subkey with the 'a' usage flags set +# FIXME: not working yet. +gen_subkey(){ local keyID local gpgOut local userID @@ -54,11 +55,6 @@ gen_ae_subkey(){ keyID="$1" - # set subkey defaults - SUBKEY_TYPE=${KEY_TYPE:-"RSA"} - SUBKEY_LENGTH=${KEY_LENGTH:-"1024"} - SUBKEY_USAGE=${KEY_USAGE:-"encrypt,auth"} - gpgOut=$(gpg --fixed-list-mode --list-keys --with-colons \ "$keyID" 2> /dev/null) @@ -68,35 +64,37 @@ gen_ae_subkey(){ return 1 fi - userID=$(echo "$gpgOut" | grep "^uid:" | cut -d: -f10) - - # set key parameters - keyParameters=$(cat < = key expires in n days + w = key expires in n weeks + m = key expires in n months + y = key expires in n years EOF -) - - echo "The following key parameters will be used:" - echo "$keyParameters" - - read -p "generate key? [Y|n]: " OK; OK=${OK:=Y} - if [ ${OK/y/Y} != 'Y' ] ; then - failure "aborting." - fi - - # add commit command - keyParameters="${keyParameters}"$(cat < Date: Sun, 15 Jun 2008 18:31:09 -0400 Subject: fix some output formatting. --- src/monkeysphere | 13 +++++-------- src/monkeysphere-server | 14 +++++++------- 2 files changed, 12 insertions(+), 15 deletions(-) diff --git a/src/monkeysphere b/src/monkeysphere index 6369197..23ebd63 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -45,14 +45,12 @@ EOF } # generate a subkey with the 'a' usage flags set -# FIXME: not working yet. +# FIXME: this needs some tweaking to clean it up gen_subkey(){ local keyID local gpgOut local userID - log "warning: this function is still not working." - keyID="$1" gpgOut=$(gpg --fixed-list-mode --list-keys --with-colons \ @@ -60,8 +58,7 @@ gen_subkey(){ # return 1 if there only "tru" lines are output from gpg if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - log " key not found." - return 1 + failure "Key ID '$keyID' not found." fi # set subkey defaults @@ -171,7 +168,7 @@ case $COMMAND in for userID ; do update_userid "$userID" "$userKeysCacheDir" done - log "run the following to update your monkeysphere authorized_keys file:" + log "Run the following to update your monkeysphere authorized_keys file:" log "$PGRM update-authorized_keys" ;; @@ -182,7 +179,7 @@ case $COMMAND in for userID ; do remove_userid "$userID" done - log "run the following to update your monkeysphere authorized_keys file:" + log "Run the following to update your monkeysphere authorized_keys file:" log "$PGRM update-authorized_keys" ;; @@ -204,7 +201,7 @@ case $COMMAND in 'gen-subkey'|'g') keyID="$1" if [ -z "$keyID" ] ; then - failure "you must specify keyid of primary key." + failure "You must specify the key ID of your primary key." fi gen_subkey "$keyID" ;; diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 58eafaa..3cc7454 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -171,7 +171,7 @@ case $COMMAND in 'trust-keys'|'trust-key'|'t') if [ -z "$1" ] ; then - failure "you must specify at least one key to trust." + failure "You must specify at least one key to trust." fi # process key IDs @@ -184,10 +184,10 @@ case $COMMAND in uname="$1" shift if [ -z "$uname" ] ; then - failure "you must specify user." + failure "You must specify user." fi if [ -z "$1" ] ; then - failure "you must specify at least one userid." + failure "You must specify at least one user ID." fi # set variables for the user @@ -202,7 +202,7 @@ case $COMMAND in update_userid "$userID" "$cacheDir" done - log "run the following to update user's authorized_keys file:" + log "Run the following to update user's authorized_keys file:" log "$PGRM update-users $uname" ;; @@ -210,10 +210,10 @@ case $COMMAND in uname="$1" shift if [ -z "$uname" ] ; then - failure "you must specify user." + failure "You must specify user." fi if [ -z "$1" ] ; then - failure "you must specify at least one userid." + failure "You must specify at least one user ID." fi # set variables for the user @@ -227,7 +227,7 @@ case $COMMAND in remove_userid "$userID" done - log "run the following to update user's authorized_keys file:" + log "Run the following to update user's authorized_keys file:" log "$PGRM update-users $uname" ;; -- cgit v1.2.3 From b13286dc0e549347f86b64049d4eb2bd2891e1ab Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Mon, 16 Jun 2008 00:48:13 -0400 Subject: openpgp2ssh now handles private key export for subkeys, not just public keys. --- src/keytrans/openpgp2ssh.c | 120 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 98 insertions(+), 22 deletions(-) diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c index 58f569e..ce4d13d 100644 --- a/src/keytrans/openpgp2ssh.c +++ b/src/keytrans/openpgp2ssh.c @@ -40,6 +40,10 @@ int convert_private_pgp_to_x509(gnutls_x509_privkey_t* output, const gnutls_open gnutls_pk_algorithm_t pgp_algo; unsigned int pgp_bits; int ret; + gnutls_openpgp_keyid_t curkeyid; + int subkeyidx; + int subkeycount; + int found = 0; /* FIXME: actually respect keyid argument. At the moment, we just emit the primary key. */ @@ -54,32 +58,104 @@ int convert_private_pgp_to_x509(gnutls_x509_privkey_t* output, const gnutls_open init_datum(&y); init_datum(&x); - pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(*pgp_privkey, &pgp_bits); - if (pgp_algo < 0) { - err(0, "failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); + + subkeycount = gnutls_openpgp_privkey_get_subkey_count(*pgp_privkey); + if (subkeycount < 0) { + err(0,"Could not determine subkey count (got value %d)\n", subkeycount); return 1; } - if (pgp_algo == GNUTLS_PK_RSA) { - err(0,"OpenPGP RSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_rsa_raw(*pgp_privkey, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err(1, "failed to export RSA key parameters (error: %d)\n", ret); + + if ((keyid == NULL) && + (subkeycount > 0)) { + err(0,"No keyid passed in, but there were %d keys to choose from\n", subkeycount + 1); + return 1; + } + + if (keyid != NULL) { + ret = gnutls_openpgp_privkey_get_key_id(*pgp_privkey, curkeyid); + if (ret) { + err(0,"Could not get keyid (error: %d)\n", ret); return 1; } + } + if ((keyid == NULL) || (memcmp(*keyid, curkeyid, sizeof(gnutls_openpgp_keyid_t)) == 0)) { + /* we want to export the primary key: */ + err(0,"exporting primary key\n"); - ret = gnutls_x509_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); - if (GNUTLS_E_SUCCESS != ret) { - err(1, "failed to import RSA key parameters (error: %d)\n", ret); + /* FIXME: this is almost identical to the block below for subkeys. + This clumsiness seems inherent in the gnutls OpenPGP API, + though. ugh. */ + pgp_algo = gnutls_openpgp_privkey_get_pk_algorithm(*pgp_privkey, &pgp_bits); + if (pgp_algo < 0) { + err(0, "failed to get OpenPGP key algorithm (error: %d)\n", pgp_algo); return 1; } - } else if (pgp_algo == GNUTLS_PK_DSA) { - err(0,"OpenPGP DSA Key, with %d bits\n", pgp_bits); - ret = gnutls_openpgp_privkey_export_dsa_raw(*pgp_privkey, &p, &q, &g, &y, &x); + if (pgp_algo == GNUTLS_PK_RSA) { + err(0,"OpenPGP RSA Key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_rsa_raw(*pgp_privkey, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err(0, "failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + + } else if (pgp_algo == GNUTLS_PK_DSA) { + err(0,"OpenPGP DSA Key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_dsa_raw(*pgp_privkey, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err(0,"failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + } + found = 1; + } else { + /* lets trawl through the subkeys until we find the one we want: */ + for (subkeyidx = 0; (subkeyidx < subkeycount) && !found; subkeyidx++) { + ret = gnutls_openpgp_privkey_get_subkey_id(*pgp_privkey, subkeyidx, curkeyid); + if (ret) { + err(0,"Could not get keyid of subkey with index %d (error: %d)\n", subkeyidx, ret); + return 1; + } + if (memcmp(*keyid, curkeyid, sizeof(gnutls_openpgp_keyid_t)) == 0) { + err(0,"exporting subkey index %d\n", subkeyidx); + + /* FIXME: this is almost identical to the block above for the + primary key. */ + pgp_algo = gnutls_openpgp_privkey_get_subkey_pk_algorithm(*pgp_privkey, subkeyidx, &pgp_bits); + if (pgp_algo < 0) { + err(0,"failed to get the algorithm of the OpenPGP public key (error: %d)\n", pgp_algo); + return pgp_algo; + } else if (pgp_algo == GNUTLS_PK_RSA) { + err(0,"OpenPGP RSA key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_subkey_rsa_raw(*pgp_privkey, subkeyidx, &m, &e, &d, &p, &q, &u); + if (GNUTLS_E_SUCCESS != ret) { + err(0,"failed to export RSA key parameters (error: %d)\n", ret); + return 1; + } + } else if (pgp_algo == GNUTLS_PK_DSA) { + err(0,"OpenPGP DSA Key, with %d bits\n", pgp_bits); + ret = gnutls_openpgp_privkey_export_subkey_dsa_raw(*pgp_privkey, subkeyidx, &p, &q, &g, &y, &x); + if (GNUTLS_E_SUCCESS != ret) { + err(0,"failed to export DSA key parameters (error: %d)\n", ret); + return 1; + } + } + found = 1; + } + } + } + + if (!found) { + err(0,"Could not find key in input\n"); + return 1; + } + + if (pgp_algo == GNUTLS_PK_RSA) { + ret = gnutls_x509_privkey_import_rsa_raw (*output, &m, &e, &d, &p, &q, &u); if (GNUTLS_E_SUCCESS != ret) { - err(0,"failed to export DSA key parameters (error: %d)\n", ret); + err(0, "failed to import RSA key parameters (error: %d)\n", ret); return 1; } - + } else if (pgp_algo == GNUTLS_PK_DSA) { ret = gnutls_x509_privkey_import_dsa_raw (*output, &p, &q, &g, &y, &x); if (GNUTLS_E_SUCCESS != ret) { err(0,"failed to import DSA key parameters (error: %d)\n", ret); @@ -164,14 +240,14 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope err(0,"OpenPGP RSA certificate, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_pk_rsa_raw(*pgp_crt, &m, &e); if (GNUTLS_E_SUCCESS != ret) { - err(0,"failed to export RSA key parameters (error: %d)\n", ret); + err(0,"failed to export RSA certificate parameters (error: %d)\n", ret); return 1; } } else if (algo == GNUTLS_PK_DSA) { - err(0,"OpenPGP DSA Key, with %d bits\n", bits); + err(0,"OpenPGP DSA certificate, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_pk_dsa_raw(*pgp_crt, &p, &q, &g, &y); if (GNUTLS_E_SUCCESS != ret) { - err(0,"failed to export DSA key parameters (error: %d)\n", ret); + err(0,"failed to export DSA certificate parameters (error: %d)\n", ret); return 1; } } @@ -198,14 +274,14 @@ int emit_public_openssh_from_pgp(const gnutls_openpgp_crt_t* pgp_crt, gnutls_ope err(0,"OpenPGP RSA certificate, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_subkey_pk_rsa_raw(*pgp_crt, subkeyidx, &m, &e); if (GNUTLS_E_SUCCESS != ret) { - err(0,"failed to export RSA key parameters (error: %d)\n", ret); + err(0,"failed to export RSA certificate parameters (error: %d)\n", ret); return 1; } } else if (algo == GNUTLS_PK_DSA) { - err(0,"OpenPGP DSA Key, with %d bits\n", bits); + err(0,"OpenPGP DSA certificate, with %d bits\n", bits); ret = gnutls_openpgp_crt_get_subkey_pk_dsa_raw(*pgp_crt, subkeyidx, &p, &q, &g, &y); if (GNUTLS_E_SUCCESS != ret) { - err(0,"failed to export DSA key parameters (error: %d)\n", ret); + err(0,"failed to export DSA certificate parameters (error: %d)\n", ret); return 1; } } -- cgit v1.2.3 From 785736d891f6c61eb5d7f4f10687ef9a0d920c3b Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Mon, 16 Jun 2008 01:05:12 -0400 Subject: openpgp2ssh whitespace and comment cleanup. --- src/keytrans/openpgp2ssh.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/src/keytrans/openpgp2ssh.c b/src/keytrans/openpgp2ssh.c index ce4d13d..511af71 100644 --- a/src/keytrans/openpgp2ssh.c +++ b/src/keytrans/openpgp2ssh.c @@ -45,9 +45,6 @@ int convert_private_pgp_to_x509(gnutls_x509_privkey_t* output, const gnutls_open int subkeycount; int found = 0; -/* FIXME: actually respect keyid argument. At the moment, we just - emit the primary key. */ - init_datum(&m); init_datum(&e); init_datum(&d); @@ -58,7 +55,6 @@ int convert_private_pgp_to_x509(gnutls_x509_privkey_t* output, const gnutls_open init_datum(&y); init_datum(&x); - subkeycount = gnutls_openpgp_privkey_get_subkey_count(*pgp_privkey); if (subkeycount < 0) { err(0,"Could not determine subkey count (got value %d)\n", subkeycount); @@ -436,9 +432,6 @@ int main(int argc, char* argv[]) { } } - - - gnutls_global_deinit(); return 0; } -- cgit v1.2.3 From 9715df03ccc1620db97d3fea50e5031f6ed36fde Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Mon, 16 Jun 2008 10:24:39 -0400 Subject: genericized the hex printing capabilities. --- src/keytrans/gnutls-helpers.c | 19 ++++++++++++++----- src/keytrans/gnutls-helpers.h | 2 ++ 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/src/keytrans/gnutls-helpers.c b/src/keytrans/gnutls-helpers.c index d5f3719..5b4c46a 100644 --- a/src/keytrans/gnutls-helpers.c +++ b/src/keytrans/gnutls-helpers.c @@ -15,6 +15,8 @@ /* for exit() */ #include +#include + /* higher levels allow more frivolous error messages through. this is set with the MONKEYSPHERE_DEBUG variable */ static int loglevel = 0; @@ -40,14 +42,21 @@ void init_keyid(gnutls_openpgp_keyid_t keyid) { void make_keyid_printable(printable_keyid out, gnutls_openpgp_keyid_t keyid) +{ + assert(sizeof(out) >= 2*sizeof(keyid)); + hex_print_data((char*)out, (const char*)keyid, sizeof(keyid)); +} + +/* you must have twice as many bytes in the out buffer as in the in buffer */ +void hex_print_data(char* out, const char* in, size_t incount) { static const char hex[16] = "0123456789ABCDEF"; - unsigned int kix = 0, outix = 0; + unsigned int inix = 0, outix = 0; - while (kix < sizeof(gnutls_openpgp_keyid_t)) { - out[outix] = hex[(keyid[kix] >> 4) & 0x0f]; - out[outix + 1] = hex[keyid[kix] & 0x0f]; - kix++; + while (inix < incount) { + out[outix] = hex[(in[inix] >> 4) & 0x0f]; + out[outix + 1] = hex[in[inix] & 0x0f]; + inix++; outix += 2; } } diff --git a/src/keytrans/gnutls-helpers.h b/src/keytrans/gnutls-helpers.h index 670d5ff..f196456 100644 --- a/src/keytrans/gnutls-helpers.h +++ b/src/keytrans/gnutls-helpers.h @@ -48,6 +48,8 @@ void collapse_printable_keyid(gnutls_openpgp_keyid_t out, printable_keyid in); int convert_string_to_keyid(gnutls_openpgp_keyid_t out, const char* str); int convert_string_to_printable_keyid(printable_keyid out, const char* str); +/* you must have twice as many bytes in the out buffer as in the in buffer */ +void hex_print_data(char* out, const char* in, size_t incount); /* functions to get data into datum objects: */ -- cgit v1.2.3 From bb17921883afe6edfeaa029d2113baebf10b7b92 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 16 Jun 2008 14:07:33 -0400 Subject: Allow for specification of whether to check keyserver. Update proxy command to check keyserver if host not found in known_hosts. --- src/monkeysphere-ssh-proxycommand | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand index 417d013..ec162ab 100755 --- a/src/monkeysphere-ssh-proxycommand +++ b/src/monkeysphere-ssh-proxycommand @@ -16,6 +16,36 @@ HOST="$1" PORT="$2" +usage() { +cat <&2 +usage: ssh -o ProxyCommand="$(basename $0) %h %p" ... +EOF +} + +log() { + echo "$@" >&2 +} + +if [ -z "$HOST" ] ; then + log "host must be specified." + usage + exit 1 +fi +if [ -z "$PORT" ] ; then + log "port must be specified." + usage + exit 1 +fi + +# check for the host key in the known_hosts file +hostKey=$(ssh-keygen -F "$HOST") + +# if the host key is not found in the known_hosts file, +# check the keyserver +if [ -z "$hostKey" ] ; then + CHECK_KEYSERVER="true" +fi + # update the known_hosts file for the host monkeysphere update-known-hosts "$HOST" -- cgit v1.2.3 From b6983d7cb86f450ebd7fafcb254011fd7099c246 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 16 Jun 2008 14:07:33 -0400 Subject: Allow for specification of whether to check keyserver. Update proxy command to check keyserver if host not found in known_hosts. --- src/common | 40 +++++++++++++++++++++++++-------------- src/monkeysphere | 2 +- src/monkeysphere-ssh-proxycommand | 30 +++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+), 15 deletions(-) diff --git a/src/common b/src/common index 8d8e506..471e75a 100644 --- a/src/common +++ b/src/common @@ -43,12 +43,22 @@ cutline() { # FIXME: need to figure out how to retrieve all matching keys # (not just first 5) gpg_fetch_userid() { - local id - id="$1" - echo 1,2,3,4,5 | \ - gpg --quiet --batch --command-fd 0 --with-colons \ - --keyserver "$KEYSERVER" \ - --search ="$id" >/dev/null 2>&1 + local userID + + userID="$1" + + # if CHECK_KEYSERVER variable set, check the keyserver + # for the user ID + if [ "CHECK_KEYSERVER" ] ; then + echo 1,2,3,4,5 | \ + gpg --quiet --batch --command-fd 0 --with-colons \ + --keyserver "$KEYSERVER" \ + --search ="$userID" >/dev/null 2>&1 + + # otherwise just return true + else + return + fi } # check that characters are in a string (in an AND fashion). @@ -117,7 +127,7 @@ gpg2authorized_keys() { gpg --export "$keyID" | \ openpgp2ssh "$keyID" | tr -d '\n' - echo " MonkeySphere${DATE}:${userID}" + echo " MonkeySphere${DATE}: ${userID}" } # userid and key policy checking @@ -296,18 +306,23 @@ update_userid() { log "processing userid: '$userID'" + # return 1 if there is no output of the user ID processing + # ie. no key was found keyCachePath=$(process_user_id "$userID" "$cacheDir") - if [ -z "$keyCachePath" ] ; then return 1 fi + + # check if user ID is in the authorized_user_ids file if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then read -p "user ID not currently authorized. authorize? [Y|n]: " OK; OK=${OK:=Y} if [ ${OK/y/Y} = 'Y' ] ; then + # add if specified log -n "adding user ID to authorized_user_ids file... " echo "$userID" >> "$AUTHORIZED_USER_IDS" echo "done." else + # else do nothing log "authorized_user_ids file untouched." fi fi @@ -340,7 +355,7 @@ process_host() { host="$1" cacheDir="$2" - log "processing host: '$host'" + log "processing host: $host" keyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") if [ $? = 0 ] ; then @@ -353,18 +368,15 @@ process_host() { # go through line-by-line, extract each host, and process with the # host processing function process_known_hosts() { - local knownHosts local cacheDir local hosts local host - knownHosts="$1" - cacheDir="$2" + cacheDir="$1" # take all the hosts from the known_hosts file (first field), # grep out all the hashed hosts (lines starting with '|')... - cut -d ' ' -f 1 "$knownHosts" | \ - grep -v '^|.*$' | \ + meat "$USER_KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | \ while IFS=, read -r -a hosts ; do # ...and process each host for host in ${hosts[*]} ; do diff --git a/src/monkeysphere b/src/monkeysphere index 23ebd63..79bc352 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -157,7 +157,7 @@ case $COMMAND in failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." fi log "processing known_hosts file..." - process_known_hosts "$USER_KNOWN_HOSTS" "$hostKeysCacheDir" + process_known_hosts "$hostKeysCacheDir" fi ;; diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand index 417d013..ec162ab 100755 --- a/src/monkeysphere-ssh-proxycommand +++ b/src/monkeysphere-ssh-proxycommand @@ -16,6 +16,36 @@ HOST="$1" PORT="$2" +usage() { +cat <&2 +usage: ssh -o ProxyCommand="$(basename $0) %h %p" ... +EOF +} + +log() { + echo "$@" >&2 +} + +if [ -z "$HOST" ] ; then + log "host must be specified." + usage + exit 1 +fi +if [ -z "$PORT" ] ; then + log "port must be specified." + usage + exit 1 +fi + +# check for the host key in the known_hosts file +hostKey=$(ssh-keygen -F "$HOST") + +# if the host key is not found in the known_hosts file, +# check the keyserver +if [ -z "$hostKey" ] ; then + CHECK_KEYSERVER="true" +fi + # update the known_hosts file for the host monkeysphere update-known-hosts "$HOST" -- cgit v1.2.3 From c32302172e3533b2170329206ff011d6e3a26a49 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 16 Jun 2008 14:43:40 -0400 Subject: Fix bug in configuration handling for HASH_KNOWN_HOSTS and USER_CONTROLLED_AUTHORIZED_KEYS --- etc/monkeysphere-server.conf | 1 + etc/monkeysphere.conf | 11 +++++------ src/common | 4 ++-- src/monkeysphere | 7 ++----- src/monkeysphere-server | 6 +++--- 5 files changed, 13 insertions(+), 16 deletions(-) diff --git a/etc/monkeysphere-server.conf b/etc/monkeysphere-server.conf index 82da497..3915bf4 100644 --- a/etc/monkeysphere-server.conf +++ b/etc/monkeysphere-server.conf @@ -20,4 +20,5 @@ # Whether to add user controlled authorized_keys file to # monkeysphere-generated authorized_keys file. Should be path to file # where '%h' will be replaced by the home directory of the user. +# To not add any user-controlled file, put "-" #USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys diff --git a/etc/monkeysphere.conf b/etc/monkeysphere.conf index d478b93..003ecf6 100644 --- a/etc/monkeysphere.conf +++ b/etc/monkeysphere.conf @@ -22,14 +22,13 @@ #REQUIRED_USER_KEY_CAPABILITY="a" # Path to user-controlled authorized_keys file to add to -# Monkeysphere-generated authorized_keys file. If empty, then no -# user-controlled file will be added. +# Monkeysphere-generated authorized_keys file. +# To not add any user-controlled file, put "-" #USER_CONTROLLED_AUTHORIZED_KEYS=~/.ssh/authorized_keys # User known_hosts file #USER_KNOWN_HOSTS=~/.ssh/known_hosts -# Whether or not to hash the generated known_hosts lines -# (empty mean "no"). -#HASH_KNOWN_HOSTS= - +# Whether or not to hash the generated known_hosts lines. +# Should be "true" or "false" +#HASH_KNOWN_HOSTS=true diff --git a/src/common b/src/common index 471e75a..c0a9030 100644 --- a/src/common +++ b/src/common @@ -275,7 +275,7 @@ process_user_id() { gpg2known_hosts "$keyID" "$userID" >> \ "$cacheDir"/"$userIDHash"."$pubKeyID" # hash the cache file if specified - if [ "$HASH_KNOWN_HOSTS" ] ; then + if [ "$HASH_KNOWN_HOSTS" = "true" ] ; then ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 rm "$cacheDir"/"$userIDHash"."$pubKeyID".old fi @@ -408,7 +408,7 @@ update_authorized_keys() { else log "no gpg keys to add." fi - if [ "$userAuthorizedKeys" -a -s "$userAuthorizedKeys" ] ; then + if [ "$userAuthorizedKeys" != "-" -a -s "$userAuthorizedKeys" ] ; then log -n "adding user authorized_keys file... " cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" echo "done." diff --git a/src/monkeysphere b/src/monkeysphere index 79bc352..a6ca62d 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -115,7 +115,7 @@ GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"} KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"} REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} -USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"} USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"} HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"} @@ -191,11 +191,8 @@ case $COMMAND in failure "$AUTHORIZED_USER_IDS is empty." fi - # set user-controlled authorized_keys file path - userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$HOME"} - # update authorized_keys - update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir" + update_authorized_keys "$msAuthorizedKeys" "$USER_CONTROLLED_AUTHORIZED_KEYS" "$userKeysCacheDir" ;; 'gen-subkey'|'g') diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 3cc7454..cdb76ee 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -111,10 +111,10 @@ MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere-server.conf} [ -e "$MS_CONF" ] && . "$MS_CONF" # set empty config variable with defaults -GNUPGHOME=${GNUPGHOME:-"$MS_HOME"/gnupg} -KEYSERVER=${KEYSERVER:-subkeys.pgp.net} +GNUPGHOME=${GNUPGHOME:-"${MS_HOME}/gnupg"} +KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} -USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys} +USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"} export GNUPGHOME -- cgit v1.2.3 From 62ff87e0328bc1406979656029a5e313839cac35 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 16 Jun 2008 14:52:20 -0400 Subject: Add log output for keyserver checking. Fix bug in proxy command to export CHECK_KEYSERVER variable. --- src/common | 31 +++++++++++++++++-------------- src/monkeysphere | 1 + src/monkeysphere-ssh-proxycommand | 9 +++++---- 3 files changed, 23 insertions(+), 18 deletions(-) diff --git a/src/common b/src/common index c0a9030..d1554a6 100644 --- a/src/common +++ b/src/common @@ -47,17 +47,17 @@ gpg_fetch_userid() { userID="$1" - # if CHECK_KEYSERVER variable set, check the keyserver - # for the user ID - if [ "CHECK_KEYSERVER" ] ; then - echo 1,2,3,4,5 | \ - gpg --quiet --batch --command-fd 0 --with-colons \ - --keyserver "$KEYSERVER" \ - --search ="$userID" >/dev/null 2>&1 - - # otherwise just return true + log "checking keyserver $KEYSERVER..." + echo 1,2,3,4,5 | \ + gpg --quiet --batch --command-fd 0 --with-colons \ + --keyserver "$KEYSERVER" \ + --search ="$userID" >/dev/null 2>&1 + if [ "$?" = 0 ] ; then + log " user ID found on keyserver." + return 0 else - return + log " user ID not found on keyserver." + return 1 fi } @@ -167,8 +167,11 @@ process_user_id() { fi requiredPubCapability=$(echo "$requiredCapability" | tr "[:lower:]" "[:upper:]") - # fetch keys from keyserver, return 1 if none found - gpg_fetch_userid "$userID" || return 1 + # if CHECK_KEYSERVER variable set, check the keyserver + # for the user ID + if [ "$CHECK_KEYSERVER" = "true" ] ; then + gpg_fetch_userid "$userID" + fi # output gpg info for (exact) userid and store gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ @@ -176,7 +179,7 @@ process_user_id() { # return 1 if there only "tru" lines are output from gpg if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - log " key not found." + log " key not found in keychain." return 1 fi @@ -268,7 +271,7 @@ process_user_id() { # key cache file if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then for keyID in ${keyIDs[@]} ; do - log " acceptable key/uid found." + log " acceptable key/userID found." if [ "$MODE" = 'known_hosts' ] ; then # export the key diff --git a/src/monkeysphere b/src/monkeysphere index a6ca62d..230de06 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -113,6 +113,7 @@ MS_CONF=${MS_CONF:-"${MS_HOME}/monkeysphere.conf"} AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"} GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"} KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} +CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"} REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"} REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"} diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand index ec162ab..3887e48 100755 --- a/src/monkeysphere-ssh-proxycommand +++ b/src/monkeysphere-ssh-proxycommand @@ -40,11 +40,12 @@ fi # check for the host key in the known_hosts file hostKey=$(ssh-keygen -F "$HOST") -# if the host key is not found in the known_hosts file, -# check the keyserver -if [ -z "$hostKey" ] ; then - CHECK_KEYSERVER="true" +# if the host key is found in the known_hosts file, +# don't check the keyserver +if [ "$hostKey" ] ; then + CHECK_KEYSERVER="false" fi +export CHECK_KEYSERVER # update the known_hosts file for the host monkeysphere update-known-hosts "$HOST" -- cgit v1.2.3 From deb41134ca527508253244cfa8860a2031034825 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 16 Jun 2008 15:26:21 -0400 Subject: Add extra variables to gen-key. --- src/monkeysphere-server | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/src/monkeysphere-server b/src/monkeysphere-server index cdb76ee..6279c45 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -32,7 +32,7 @@ MonkeySphere server admin tool. subcommands: update-users (s) [USER]... update users authorized_keys files - gen-key (g) generate gpg key for the server + gen-key (g) [HOSTNAME] generate gpg key for the server publish-key (p) publish server key to keyserver trust-keys (t) KEYID... mark keyids as trusted update-user-userids (u) USER UID... add/update user IDs for a user @@ -44,14 +44,26 @@ EOF # generate server gpg key gen_key() { + local hostName + + hostName=${1:-$(hostname --fqdn)} + # set key defaults KEY_TYPE=${KEY_TYPE:-"RSA"} KEY_LENGTH=${KEY_LENGTH:-"2048"} KEY_USAGE=${KEY_USAGE:-"auth,encrypt"} - SERVICE=${SERVICE:-"ssh"} - HOSTNAME_FQDN=${HOSTNAME_FQDN:-$(hostname -f)} + cat < = key expires in n days + w = key expires in n weeks + m = key expires in n months + y = key expires in n years +EOF + read -p "Key is valid for? ($EXPIRE) " EXPIRE; EXPIRE=${EXPIRE:-"0"} - USERID=${USERID:-"$SERVICE"://"$HOSTNAME_FQDN"} + SERVICE=${SERVICE:-"ssh"} + USERID=${USERID:-"$SERVICE"://"$hostName"} # set key parameters keyParameters=$(cat < Date: Mon, 16 Jun 2008 19:54:12 -0400 Subject: Total rework of uid processing: rid of cache directory --- src/common | 249 +++++++++++++++++++++++++++++++------------------------ src/monkeysphere | 6 +- 2 files changed, 142 insertions(+), 113 deletions(-) diff --git a/src/common b/src/common index 8d8e506..8b078d6 100644 --- a/src/common +++ b/src/common @@ -43,12 +43,21 @@ cutline() { # FIXME: need to figure out how to retrieve all matching keys # (not just first 5) gpg_fetch_userid() { - local id - id="$1" - echo 1,2,3,4,5 | \ - gpg --quiet --batch --command-fd 0 --with-colons \ - --keyserver "$KEYSERVER" \ - --search ="$id" >/dev/null 2>&1 + local userID + userID="$1" + + # if CHECK_KEYSERVER variable set, check the keyserver + # for the user ID + if [ "CHECK_KEYSERVER" ] ; then + echo 1,2,3,4,5 | \ + gpg --quiet --batch --command-fd 0 --with-colons \ + --keyserver "$KEYSERVER" \ + --search ="$userID" >/dev/null 2>&1 + + # otherwise just return true + else + return + fi } # check that characters are in a string (in an AND fashion). @@ -117,7 +126,7 @@ gpg2authorized_keys() { gpg --export "$keyID" | \ openpgp2ssh "$keyID" | tr -d '\n' - echo " MonkeySphere${DATE}:${userID}" + echo " MonkeySphere${DATE}: ${userID}" } # userid and key policy checking @@ -133,17 +142,18 @@ process_user_id() { local requiredCapability local requiredPubCapability local gpgOut + local userIDHash + local keyCacheDir local line local type local validity local keyid local uidfpr - local capability + local usage local keyOK local pubKeyID local uidOK local keyIDs - local userIDHash local keyID userID="$1" @@ -161,126 +171,121 @@ process_user_id() { gpg_fetch_userid "$userID" || return 1 # output gpg info for (exact) userid and store - gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \ - ="$userID" 2> /dev/null) - - # return 1 if there only "tru" lines are output from gpg - if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then - log " key not found." - return 1 + gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \ + --with-fingerprint --with-fingerprint \ + ="$userID" 2>/dev/null) + + # if the gpg query return code is not 0, return 1 + if [ "$?" -ne 0 ] ; then + log " key not found." + return 1 fi + echo "$gpgOut" + # loop over all lines in the gpg output and process. # need to do it this way (as opposed to "while read...") so that # variables set in loop will be visible outside of loop - for line in $(seq 1 $(echo "$gpgOut" | wc -l)) ; do - - # read the contents of the line - type=$(echo "$gpgOut" | cutline "$line" | cut -d: -f1) - validity=$(echo "$gpgOut" | cutline "$line" | cut -d: -f2) - keyid=$(echo "$gpgOut" | cutline "$line" | cut -d: -f5) - uidfpr=$(echo "$gpgOut" | cutline "$line" | cut -d: -f10) - capability=$(echo "$gpgOut" | cutline "$line" | cut -d: -f12) - + echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \ + while IFS=: read -r type validity keyid uidfpr usage ; do # process based on record type case $type in 'pub') # primary keys # new key, wipe the slate keyOK= - pubKeyID= uidOK= - keyIDs= - - pubKeyID="$keyid" + pubKeyOK= + fingerprint= - # check primary key validity + # if overall key is not valid, skip if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then log " unacceptable primary key validity ($validity)." continue fi - # check capability is not Disabled... - if check_capability "$capability" 'D' ; then + # if overall key is disabled, skip + if check_capability "$usage" 'D' ; then log " key disabled." continue fi - # check overall key capability - # must be Encryption and Authentication - if ! check_capability "$capability" $requiredPubCapability ; then - log " unacceptable primary key capability ($capability)." + # if overall key capability is not ok, skip + if ! check_capability "$usage" $requiredPubCapability ; then + log " unacceptable primary key capability ($usage)." continue fi - # mark if primary key is acceptable + # mark overall key as ok keyOK=true - # add primary key ID to key list if it has required capability - if check_capability "$capability" $requiredCapability ; then - keyIDs[${#keyIDs[*]}]="$keyid" + # mark primary key as ok if capability is ok + if check_capability "$usage" $requiredCapability ; then + pubKeyOK=true fi ;; 'uid') # user ids - # check key ok and we have key fingerprint + # if the overall key is not ok, skip if [ -z "$keyOK" ] ; then continue fi - # check key validity - if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + # if an acceptable user ID was already found, skip + if [ "$uidOK" ] ; then continue fi - # check the uid matches + # if the user ID does not match, skip if [ "$(unescape "$uidfpr")" != "$userID" ] ; then continue fi + # if the user ID validity is not ok, skip + if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + continue + fi - # mark if uid acceptable + # mark user ID acceptable uidOK=true + + # output a line for the primary key + # 0 = ok, 1 = bad + if [ "$keyOK" -a "$uidOK" -a "$pubKeyOK" ] ; then + log " acceptable key found" + echo 0 "$fingerprint" + else + echo 1 "$fingerprint" + fi ;; 'sub') # sub keys - # add sub key ID to key list if it has required capability - if check_capability "$capability" $requiredCapability ; then - keyIDs[${#keyIDs[*]}]="$keyid" + # unset acceptability of last key + subKeyOK= + fingerprint= + + # if the overall key is not ok, skip + if [ -z "$keyOK" ] ; then + continue + fi + # if sub key validity is not ok, skip + if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + continue + fi + # if sub key capability is not ok, skip + if ! check_capability "$usage" $requiredCapability ; then + continue + fi + + # mark sub key as ok + subKeyOK=true + ;; + 'fpr') # key fingerprint + fingerprint="$uidfpr" + + # output a line for the last subkey + # 0 = ok, 1 = bad + if [ "$keyOK" -a "$uidOK" -a "$subKeyOK" ] ; then + log " acceptable key found" + echo 0 "$fingerprint" + else + echo 1 "$fingerprint" fi ;; esac done - - # hash userid for cache file name - userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }') - - # make sure the cache directory exists - mkdir -p "$cacheDir" - - # touch/clear key cache file - # (will be left empty if there are noacceptable keys) - > "$cacheDir"/"$userIDHash"."$pubKeyID" - - # for each acceptable key, write an ssh key line to the - # key cache file - if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then - for keyID in ${keyIDs[@]} ; do - log " acceptable key/uid found." - - if [ "$MODE" = 'known_hosts' ] ; then - # export the key - gpg2known_hosts "$keyID" "$userID" >> \ - "$cacheDir"/"$userIDHash"."$pubKeyID" - # hash the cache file if specified - if [ "$HASH_KNOWN_HOSTS" ] ; then - ssh-keygen -H -f "$cacheDir"/"$userIDHash"."$pubKeyID" > /dev/null 2>&1 - rm "$cacheDir"/"$userIDHash"."$pubKeyID".old - fi - elif [ "$MODE" = 'authorized_keys' ] ; then - # export the key - # FIXME: needs to apply extra options for authorized_keys - # lines if specified - gpg2authorized_keys "$keyID" "$userID" >> \ - "$cacheDir"/"$userIDHash"."$pubKeyID" - fi - done - fi - - # echo the path to the key cache file - echo "$cacheDir"/"$userIDHash"."$pubKeyID" } # update the cache for userid, and prompt to add file to @@ -296,18 +301,23 @@ update_userid() { log "processing userid: '$userID'" + # return 1 if there is no output of the user ID processing + # ie. no key was found keyCachePath=$(process_user_id "$userID" "$cacheDir") - if [ -z "$keyCachePath" ] ; then return 1 fi + + # check if user ID is in the authorized_user_ids file if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then read -p "user ID not currently authorized. authorize? [Y|n]: " OK; OK=${OK:=Y} if [ ${OK/y/Y} = 'Y' ] ; then + # add if specified log -n "adding user ID to authorized_user_ids file... " echo "$userID" >> "$AUTHORIZED_USER_IDS" echo "done." else + # else do nothing log "authorized_user_ids file untouched." fi fi @@ -321,16 +331,34 @@ remove_userid() { log "processing userid: '$userID'" + # check if user ID is in the authorized_user_ids file if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then log "user ID not currently authorized." return 1 fi + # remove user ID from file log -n "removing user ID '$userID'... " grep -v "$userID" "$AUTHORIZED_USER_IDS" | sponge "$AUTHORIZED_USER_IDS" echo "done." } +# remove all keys from specified key cache from known_hosts file +remove_known_hosts_host_keys() { + local keyCachePath + local hosts + local type + local key + local comment + + keyCachePath="$1" + + meat "${keyCachePath}/keys" | \ + while read -r hosts type key comment ; do + grep -v "$key" "$USER_KNOWN_HOSTS" | sponge "$USER_KNOWN_HOSTS" + done +} + # process a host for addition to a known_host file process_host() { local host @@ -340,31 +368,35 @@ process_host() { host="$1" cacheDir="$2" - log "processing host: '$host'" - - keyCachePath=$(process_user_id "ssh://${host}" "$cacheDir") - if [ $? = 0 ] ; then - ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS" - cat "$keyCachePath" >> "$USER_KNOWN_HOSTS" - fi + log "processing host: $host" + + userID="ssh://${host}" + process_user_id "ssh://${host}" + exit + process_user_id "ssh://${host}" | \ + while read -r ok key ; do + # remove the old host key line + remove_known_hosts_host_keys "$key" + # if key OK, add new host line + if [ "$ok" -eq '0' ] ; then + known_hosts_line "$host" "$key" >> "$USER_KNOWN_HOSTS" + fi + done } # process known_hosts file # go through line-by-line, extract each host, and process with the # host processing function process_known_hosts() { - local knownHosts local cacheDir local hosts local host - knownHosts="$1" - cacheDir="$2" + cacheDir="$1" # take all the hosts from the known_hosts file (first field), # grep out all the hashed hosts (lines starting with '|')... - cut -d ' ' -f 1 "$knownHosts" | \ - grep -v '^|.*$' | \ + meat "$USER_KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | \ while IFS=, read -r -a hosts ; do # ...and process each host for host in ${hosts[*]} ; do @@ -415,17 +447,14 @@ process_authorized_ids() { authorizedIDs="$1" cacheDir="$2" - # clean out keys file and remake keys directory - rm -rf "$cacheDir" - mkdir -p "$cacheDir" - - # loop through all user ids in file - # FIXME: needs to handle authorized_keys options - cat "$authorizedIDs" | meat | \ - while read -r userID ; do - # process the userid - log "processing userid: '$userID'" - process_user_id "$userID" "$cacheDir" > /dev/null + process_user_id "$userID" | \ + while read -r ok key ; do + # remove the old host key line + remove_authorized_keys_user_keys "$key" + # if key OK, add new host line + if [ "$ok" -eq '0' ] ; then + authorized_keys_line "$userID" "$key" >> "$USER_AUTHORIZED_KEYS" + fi done } diff --git a/src/monkeysphere b/src/monkeysphere index 23ebd63..91401b9 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -147,7 +147,7 @@ case $COMMAND in # those hosts if [ "$1" ] ; then for host ; do - process_host "$host" "$hostKeysCacheDir" + process_host "$host" done # otherwise, if no hosts are specified, process every user @@ -157,7 +157,7 @@ case $COMMAND in failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." fi log "processing known_hosts file..." - process_known_hosts "$USER_KNOWN_HOSTS" "$hostKeysCacheDir" + process_known_hosts "$USER_KNOWN_HOSTS" fi ;; @@ -166,7 +166,7 @@ case $COMMAND in failure "you must specify at least one userid." fi for userID ; do - update_userid "$userID" "$userKeysCacheDir" + update_userid "$userID" done log "Run the following to update your monkeysphere authorized_keys file:" log "$PGRM update-authorized_keys" -- cgit v1.2.3 From b92675786ac883551528b3870c71c98066d60c0f Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 17 Jun 2008 11:11:27 -0400 Subject: Major rework to remove all caching. Everything processed straight from gpg keyring. Major code simplification and cleanup. --- etc/monkeysphere.conf | 15 +- src/common | 388 ++++++++++++++++++++++++++---------------------- src/monkeysphere | 33 ++-- src/monkeysphere-server | 37 +++-- 4 files changed, 255 insertions(+), 218 deletions(-) diff --git a/etc/monkeysphere.conf b/etc/monkeysphere.conf index 003ecf6..17c1a14 100644 --- a/etc/monkeysphere.conf +++ b/etc/monkeysphere.conf @@ -3,9 +3,6 @@ # This is an sh-style shell configuration file. Variable names should # be separated from their assignements by a single '=' and no spaces. -# authorized_user_ids file -#AUTHORIZED_USER_IDS=~/.config/monkeysphere/authorized_user_ids - # GPG home directory #GNUPGHOME=~/.gnupg @@ -21,14 +18,12 @@ #REQUIRED_HOST_KEY_CAPABILITY="e a" #REQUIRED_USER_KEY_CAPABILITY="a" -# Path to user-controlled authorized_keys file to add to -# Monkeysphere-generated authorized_keys file. -# To not add any user-controlled file, put "-" -#USER_CONTROLLED_AUTHORIZED_KEYS=~/.ssh/authorized_keys - -# User known_hosts file -#USER_KNOWN_HOSTS=~/.ssh/known_hosts +# ssh known_hosts file +#KNOWN_HOSTS=~/.ssh/known_hosts # Whether or not to hash the generated known_hosts lines. # Should be "true" or "false" #HASH_KNOWN_HOSTS=true + +# ssh authorized_keys file +#AUTHORIZED_KEYS=~/.ssh/known_hosts diff --git a/src/common b/src/common index 64d28cb..7a90453 100644 --- a/src/common +++ b/src/common @@ -11,12 +11,16 @@ # file) and are considered global ######################################################################## +### COMMON VARIABLES + # managed directories ETC="/etc/monkeysphere" export ETC CACHE="/var/cache/monkeysphere" export CACHE + ######################################################################## +### UTILITY FUNCTIONS failure() { echo "$1" >&2 @@ -29,6 +33,10 @@ log() { echo "$@" 1>&2 } +loge() { + echo "$@" 1>&2 +} + # cut out all comments(#) and blank lines from standard input meat() { grep -v -e "^[[:space:]]*#" -e '^$' @@ -39,72 +47,89 @@ cutline() { head --line="$1" | tail -1 } -# retrieve all keys with given user id from keyserver -# FIXME: need to figure out how to retrieve all matching keys -# (not just first 5) -gpg_fetch_userid() { - local userID - - userID="$1" - - log "checking keyserver $KEYSERVER..." - echo 1,2,3,4,5 | \ - gpg --quiet --batch --command-fd 0 --with-colons \ - --keyserver "$KEYSERVER" \ - --search ="$userID" >/dev/null 2>&1 - if [ "$?" = 0 ] ; then - log " user ID found on keyserver." - return 0 - else - log " user ID not found on keyserver." - return 1 - fi -} - # check that characters are in a string (in an AND fashion). # used for checking key capability # check_capability capability a [b...] check_capability() { - local capability + local usage local capcheck - capability="$1" + usage="$1" shift 1 for capcheck ; do - if echo "$capability" | grep -q -v "$capcheck" ; then + if echo "$usage" | grep -q -v "$capcheck" ; then return 1 fi done return 0 } -# get the full fingerprint of a key ID -get_key_fingerprint() { +# convert escaped characters from gpg output back into original +# character +# FIXME: undo all escape character translation in with-colons gpg output +unescape() { + echo "$1" | sed 's/\\x3a/:/' +} + +# remove all lines with specified string from specified file +remove_file_line() { + local file + local string + + file="$1" + string="$2" + + if [ "$file" -a "$string" ] ; then + grep -v "$string" "$file" | sponge "$file" + fi +} + +### CONVERTION UTILITIES + +# output the ssh key for a given key ID +gpg2ssh() { local keyID + + #keyID="$1" #TMP + # only use last 16 characters until openpgp2ssh can take all 40 #TMP + keyID=$(echo "$1" | cut -c 25-) #TMP - keyID="$1" + gpg --export "$keyID" | openpgp2ssh "$keyID" 2> /dev/null +} - gpg --list-key --with-colons --fixed-list-mode \ - --with-fingerprint "$keyID" | grep "$keyID" | \ - grep '^fpr:' | cut -d: -f10 +# output known_hosts line from ssh key +ssh2known_hosts() { + local host + local key + + host="$1" + key="$2" + + echo -n "$host " + echo -n "$key" | tr -d '\n' + echo " MonkeySphere${DATE}" } +# output authorized_keys line from ssh key +ssh2authorized_keys() { + local userID + local key + + userID="$1" + key="$2" -# convert escaped characters from gpg output back into original -# character -# FIXME: undo all escape character translation in with-colons gpg output -unescape() { - echo "$1" | sed 's/\\x3a/:/' + echo -n "$key" | tr -d '\n' + echo " MonkeySphere${DATE}: ${userID}" } # convert key from gpg to ssh known_hosts format gpg2known_hosts() { - local keyID local host + local keyID - keyID="$1" - host=$(echo "$2" | sed -e "s|ssh://||") + host="$1" + keyID="$2" # NOTE: it seems that ssh-keygen -R removes all comment fields from # all lines in the known_hosts file. why? @@ -112,53 +137,88 @@ gpg2known_hosts() { # following regexp: # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' echo -n "$host " - gpg --export "$keyID" | \ - openpgp2ssh "$keyID" | tr -d '\n' + gpg2ssh "$keyID" | tr -d '\n' echo " MonkeySphere${DATE}" } # convert key from gpg to ssh authorized_keys format gpg2authorized_keys() { + local userID local keyID + + userID="$1" + keyID="$2" + + # NOTE: just in case, the COMMENT can be matched with the + # following regexp: + # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' + gpg2ssh "$keyID" | tr -d '\n' + echo " MonkeySphere${DATE}: ${userID}" +} + +### GPG UTILITIES + +# retrieve all keys with given user id from keyserver +# FIXME: need to figure out how to retrieve all matching keys +# (not just first N (5 in this case)) +gpg_fetch_userid() { local userID + userID="$1" + + log -n " checking keyserver $KEYSERVER... " + echo 1,2,3,4,5 | \ + gpg --quiet --batch --with-colons \ + --command-fd 0 --keyserver "$KEYSERVER" \ + --search ="$userID" > /dev/null 2>&1 + loge "done." +} + +# get the full fingerprint of a key ID +get_key_fingerprint() { + local keyID + keyID="$1" - userID="$2" - gpg --export "$keyID" | \ - openpgp2ssh "$keyID" | tr -d '\n' - echo " MonkeySphere${DATE}: ${userID}" + gpg --list-key --with-colons --fixed-list-mode \ + --with-fingerprint "$keyID" | grep "$keyID" | \ + grep '^fpr:' | cut -d: -f10 } +######################################################################## +### PROCESSING FUNCTIONS + # userid and key policy checking # the following checks policy on the returned keys # - checks that full key has appropriate valididy (u|f) # - checks key has specified capability (REQUIRED_*_KEY_CAPABILITY) -# - checks that particular desired user id has appropriate validity -# see /usr/share/doc/gnupg/DETAILS.gz +# - checks that requested user ID has appropriate validity +# (see /usr/share/doc/gnupg/DETAILS.gz) +# output is one line for every found key, in the following format: +# +# flag fingerprint +# +# "flag" is an acceptability flag, 0 = ok, 1 = bad +# "fingerprint" is the fingerprint of the key +# # expects global variable: "MODE" process_user_id() { local userID - local cacheDir local requiredCapability local requiredPubCapability local gpgOut - local userIDHash - local keyCacheDir - local line local type local validity local keyid local uidfpr local usage local keyOK - local pubKeyID local uidOK - local keyIDs - local keyID + local lastKey + local lastKeyOK + local fingerprint userID="$1" - cacheDir="$2" # set the required key capability based on the mode if [ "$MODE" = 'known_hosts' ] ; then @@ -181,12 +241,10 @@ process_user_id() { # if the gpg query return code is not 0, return 1 if [ "$?" -ne 0 ] ; then - log " key not found." + log " - key not found." return 1 fi - echo "$gpgOut" - # loop over all lines in the gpg output and process. # need to do it this way (as opposed to "while read...") so that # variables set in loop will be visible outside of loop @@ -198,22 +256,25 @@ process_user_id() { # new key, wipe the slate keyOK= uidOK= - pubKeyOK= + lastKey=pub + lastKeyOK= fingerprint= + log " primary key found: $keyid" + # if overall key is not valid, skip if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then - log " unacceptable primary key validity ($validity)." + log " - unacceptable primary key validity ($validity)." continue fi # if overall key is disabled, skip if check_capability "$usage" 'D' ; then - log " key disabled." + log " - key disabled." continue fi # if overall key capability is not ok, skip if ! check_capability "$usage" $requiredPubCapability ; then - log " unacceptable primary key capability ($usage)." + log " - unacceptable primary key capability ($usage)." continue fi @@ -222,14 +283,10 @@ process_user_id() { # mark primary key as ok if capability is ok if check_capability "$usage" $requiredCapability ; then - pubKeyOK=true + lastKeyOK=true fi ;; 'uid') # user ids - # if the overall key is not ok, skip - if [ -z "$keyOK" ] ; then - continue - fi # if an acceptable user ID was already found, skip if [ "$uidOK" ] ; then continue @@ -248,8 +305,8 @@ process_user_id() { # output a line for the primary key # 0 = ok, 1 = bad - if [ "$keyOK" -a "$uidOK" -a "$pubKeyOK" ] ; then - log " acceptable key found" + if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then + log " * acceptable key found." echo 0 "$fingerprint" else echo 1 "$fingerprint" @@ -257,13 +314,10 @@ process_user_id() { ;; 'sub') # sub keys # unset acceptability of last key - subKeyOK= + lastKey=sub + lastKeyOK= fingerprint= - # if the overall key is not ok, skip - if [ -z "$keyOK" ] ; then - continue - fi # if sub key validity is not ok, skip if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then continue @@ -274,15 +328,20 @@ process_user_id() { fi # mark sub key as ok - subKeyOK=true + lastKeyOK=true ;; 'fpr') # key fingerprint fingerprint="$uidfpr" + # if the last key was the pub key, skip + if [ "$lastKey" = pub ] ; then + continue + fi + # output a line for the last subkey # 0 = ok, 1 = bad - if [ "$keyOK" -a "$uidOK" -a "$subKeyOK" ] ; then - log " acceptable key found" + if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then + log " * acceptable key found." echo 0 "$fingerprint" else echo 1 "$fingerprint" @@ -297,32 +356,25 @@ process_user_id() { # and not already in file. update_userid() { local userID - local cacheDir - local keyCache userID="$1" - cacheDir="$2" log "processing userid: '$userID'" - # return 1 if there is no output of the user ID processing - # ie. no key was found - keyCachePath=$(process_user_id "$userID" "$cacheDir") - if [ -z "$keyCachePath" ] ; then - return 1 - fi + # process the user ID to pull it from keyserver + process_user_id "$userID" | grep -q "^0 " # check if user ID is in the authorized_user_ids file if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then read -p "user ID not currently authorized. authorize? [Y|n]: " OK; OK=${OK:=Y} if [ ${OK/y/Y} = 'Y' ] ; then # add if specified - log -n "adding user ID to authorized_user_ids file... " + log -n " adding user ID to authorized_user_ids file... " echo "$userID" >> "$AUTHORIZED_USER_IDS" - echo "done." + loge "done." else # else do nothing - log "authorized_user_ids file untouched." + log " authorized_user_ids file untouched." fi fi } @@ -337,53 +389,70 @@ remove_userid() { # check if user ID is in the authorized_user_ids file if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then - log "user ID not currently authorized." + log " user ID not currently authorized." return 1 fi # remove user ID from file - log -n "removing user ID '$userID'... " - grep -v "$userID" "$AUTHORIZED_USER_IDS" | sponge "$AUTHORIZED_USER_IDS" - echo "done." + log -n " removing user ID '$userID'... " + remove_file_line "$AUTHORIZED_USER_IDS" "^${userID}$" + loge "done." } -# remove all keys from specified key cache from known_hosts file -remove_known_hosts_host_keys() { - local keyCachePath - local hosts - local type - local key - local comment +# process a host in known_host file +process_host_known_hosts() { + local host + local userID + local ok + local keyid + local tmpfile - keyCachePath="$1" + host="$1" + userID="ssh://${host}" + + log "processing host: $host" - meat "${keyCachePath}/keys" | \ - while read -r hosts type key comment ; do - grep -v "$key" "$USER_KNOWN_HOSTS" | sponge "$USER_KNOWN_HOSTS" + process_user_id "ssh://${host}" | \ + while read -r ok keyid ; do + sshKey=$(gpg2ssh "$keyid") + # remove the old host key line + remove_file_line "$KNOWN_HOSTS" "$sshKey" + # if key OK, add new host line + if [ "$ok" -eq '0' ] ; then + # hash if specified + if [ "$HASH_KNOWN_HOSTS" = 'true' ] ; then + # FIXME: this is really hackish cause ssh-keygen won't + # hash from stdin to stdout + tmpfile=$(mktemp) + ssh2known_hosts "$host" "$sshKey" > "$tmpfile" + ssh-keygen -H -f "$tmpfile" 2> /dev/null + cat "$tmpfile" >> "$KNOWN_HOSTS" + rm -f "$tmpfile" "${tmpfile}.old" + else + ssh2known_hosts "$host" "$sshKey" >> "$KNOWN_HOSTS" + fi + fi done } -# process a host for addition to a known_host file -process_host() { - local host - local cacheDir - local keyCachePath +# process a uid in an authorized_keys file +process_uid_authorized_keys() { + local userID + local ok + local keyid - host="$1" - cacheDir="$2" + userID="$1" - log "processing host: $host" + log "processing user ID: $userID" - userID="ssh://${host}" - process_user_id "ssh://${host}" - exit - process_user_id "ssh://${host}" | \ - while read -r ok key ; do + process_user_id "$userID" | \ + while read -r ok keyid ; do + sshKey=$(gpg2ssh "$keyid") # remove the old host key line - remove_known_hosts_host_keys "$key" + remove_file_line "$AUTHORIZED_KEYS" "$sshKey" # if key OK, add new host line if [ "$ok" -eq '0' ] ; then - known_hosts_line "$host" "$key" >> "$USER_KNOWN_HOSTS" + ssh2authorized_keys "$userID" "$sshKey" >> "$AUTHORIZED_KEYS" fi done } @@ -392,110 +461,69 @@ process_host() { # go through line-by-line, extract each host, and process with the # host processing function process_known_hosts() { - local cacheDir local hosts local host - cacheDir="$1" - # take all the hosts from the known_hosts file (first field), # grep out all the hashed hosts (lines starting with '|')... - meat "$USER_KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | \ + cat "$KNOWN_HOSTS" | meat | \ + cut -d ' ' -f 1 | grep -v '^|.*$' | \ while IFS=, read -r -a hosts ; do - # ...and process each host + # and process each host for host in ${hosts[*]} ; do - process_host "$host" "$cacheDir" + process_host_known_hosts "$host" done done } -# update an authorized_keys file after first processing the -# authorized_user_ids file -update_authorized_keys() { - local msAuthorizedKeys - local userAuthorizedKeys - local cacheDir - - msAuthorizedKeys="$1" - userAuthorizedKeys="$2" - cacheDir="$3" - - process_authorized_ids "$AUTHORIZED_USER_IDS" "$cacheDir" - - # write output key file - log "writing monkeysphere authorized_keys file... " - touch "$msAuthorizedKeys" - if [ "$(ls "$cacheDir")" ] ; then - log -n "adding gpg keys... " - cat "$cacheDir"/* > "$msAuthorizedKeys" - echo "done." - else - log "no gpg keys to add." - fi - if [ "$userAuthorizedKeys" != "-" -a -s "$userAuthorizedKeys" ] ; then - log -n "adding user authorized_keys file... " - cat "$userAuthorizedKeys" >> "$msAuthorizedKeys" - echo "done." - fi - log "monkeysphere authorized_keys file generated:" - log "$msAuthorizedKeys" -} - -# process an authorized_*_ids file -# go through line-by-line, extract each userid, and process -process_authorized_ids() { - local authorizedIDs - local cacheDir - local userID - - authorizedIDs="$1" - cacheDir="$2" +# process an authorized_user_ids file for authorized_keys +process_authorized_user_ids() { + local userid - process_user_id "$userID" | \ - while read -r ok key ; do - # remove the old host key line - remove_authorized_keys_user_keys "$key" - # if key OK, add new host line - if [ "$ok" -eq '0' ] ; then - authorized_keys_line "$userID" "$key" >> "$USER_AUTHORIZED_KEYS" - fi + cat "$AUTHORIZED_USER_IDS" | meat | \ + while read -r userid ; do + process_uid_authorized_keys "$userid" done } # EXPERIMENTAL (unused) process userids found in authorized_keys file # go through line-by-line, extract monkeysphere userids from comment # fields, and process each userid +# NOT WORKING process_authorized_keys() { local authorizedKeys - local cacheDir local userID authorizedKeys="$1" - cacheDir="$2" # take all the monkeysphere userids from the authorized_keys file # comment field (third field) that starts with "MonkeySphere uid:" # FIXME: needs to handle authorized_keys options (field 0) - cat "$authorizedKeys" | \ + cat "$authorizedKeys" | meat | \ while read -r options keytype key comment ; do # if the comment field is empty, assume the third field was # the comment if [ -z "$comment" ] ; then comment="$key" fi - if ! echo "$comment" | grep '^MonkeySphere userID:.*$' ; then + + if echo "$comment" | egrep -v -q '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}:' ; then continue fi - userID=$(echo "$comment" | sed -e "/^MonkeySphere userID://") + userID=$(echo "$comment" | awk "{ print $2 }") if [ -z "$userID" ] ; then continue fi + # process the userid log "processing userid: '$userID'" - process_user_id "$userID" "$cacheDir" > /dev/null + process_user_id "$userID" > /dev/null done } +################################################## +### GPG HELPER FUNCTIONS + # retrieve key from web of trust, and set owner trust to "full" # if key is found. trust_key() { diff --git a/src/monkeysphere b/src/monkeysphere index 8e4c4eb..6853f58 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -53,7 +53,7 @@ gen_subkey(){ keyID="$1" - gpgOut=$(gpg --fixed-list-mode --list-keys --with-colons \ + gpgOut=$(gpg --quiet --fixed-list-mode --list-keys --with-colons \ "$keyID" 2> /dev/null) # return 1 if there only "tru" lines are output from gpg @@ -90,8 +90,9 @@ save EOF ) - echo "generating subkey..." + log "generating subkey..." echo "$editCommands" | gpg --expert --command-fd 0 --edit-key "$keyID" + log "done." } ######################################################################## @@ -116,25 +117,19 @@ KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"} REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"} REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} -USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"} -USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"} +KNOWN_HOSTS=${KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"} +AUTHORIZED_KEYS=${AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"} HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"} export GNUPGHOME -# stagging locations -hostKeysCacheDir="${MS_HOME}/host_keys" -userKeysCacheDir="${MS_HOME}/user_keys" -msAuthorizedKeys="${MS_HOME}/authorized_keys" - # make sure gpg home exists with proper permissions mkdir -p -m 0700 "$GNUPGHOME" # make sure the user monkeysphere home directory exists mkdir -p -m 0700 "$MS_HOME" -mkdir -p "$hostKeysCacheDir" -mkdir -p "$userKeysCacheDir" touch "$AUTHORIZED_USER_IDS" +touch "$AUTHORIZED_KEYS" case $COMMAND in 'update-known_hosts'|'update-known-hosts'|'k') @@ -142,23 +137,25 @@ case $COMMAND in # touch the known_hosts file to make sure it exists # ssh-keygen complains if it doesn't exist - touch "$USER_KNOWN_HOSTS" + touch "$KNOWN_HOSTS" # if hosts are specified on the command line, process just # those hosts if [ "$1" ] ; then for host ; do - process_host "$host" + process_host_known_hosts "$host" done + log "known_hosts file updated." # otherwise, if no hosts are specified, process every user # in the user's known_hosts file else - if [ ! -s "$USER_KNOWN_HOSTS" ] ; then - failure "known_hosts file '$USER_KNOWN_HOSTS' is empty." + if [ ! -s "$KNOWN_HOSTS" ] ; then + failure "known_hosts file '$KNOWN_HOSTS' is empty." fi log "processing known_hosts file..." process_known_hosts + log "known_hosts file updated." fi ;; @@ -192,8 +189,10 @@ case $COMMAND in failure "$AUTHORIZED_USER_IDS is empty." fi - # update authorized_keys - update_authorized_keys "$msAuthorizedKeys" "$USER_CONTROLLED_AUTHORIZED_KEYS" "$userKeysCacheDir" + # process authorized_user_ids file + log "processing authorized_user_ids file..." + process_authorized_user_ids + log "authorized_keys file updated." ;; 'gen-subkey'|'g') diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 6279c45..560d249 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -106,7 +106,7 @@ EOF log -n "generating server key... " echo "$keyParameters" | gpg --batch --gen-key - echo "done." + loge "done." } ######################################################################## @@ -127,20 +127,25 @@ MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere-server.conf} # set empty config variable with defaults GNUPGHOME=${GNUPGHOME:-"${MS_HOME}/gnupg"} KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} +CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"} REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"} export GNUPGHOME +# make sure the monkeysphere home directory exists +mkdir -p "${MS_HOME}/authorized_user_ids" # make sure gpg home exists with proper permissions mkdir -p -m 0700 "$GNUPGHOME" +# make sure the authorized_keys directory exists +mkdir -p "${CACHE}/authorized_keys" case $COMMAND in 'update-users'|'update-user'|'s') if [ "$1" ] ; then unames="$@" else - unames=$(ls -1 "$MS_HOME"/authorized_user_ids) + unames=$(ls -1 "${MS_HOME}/authorized_user_ids") fi for uname in $unames ; do @@ -149,12 +154,14 @@ case $COMMAND in log "----- user: $uname -----" # set variables for the user - AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" - msAuthorizedKeys="$CACHE"/"$uname"/authorized_keys - cacheDir="$CACHE"/"$uname"/user_keys + AUTHORIZED_USER_IDS="${MS_HOME}/authorized_user_ids/${uname}" + # temporary authorized_keys file + AUTHORIZED_KEYS="${CACHE}/authorized_keys/${uname}.tmp" # make sure user's authorized_user_ids file exists touch "$AUTHORIZED_USER_IDS" + # make sure the authorized_keys file exists and is clear + > "$AUTHORIZED_KEYS" # skip if the user's authorized_user_ids file is empty if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then @@ -162,14 +169,23 @@ case $COMMAND in continue fi - # set user-controlled authorized_keys file path - if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" ] ; then + # process authorized_user_ids file + log "processing authorized_user_ids file..." + process_authorized_user_ids + + # add user-controlled authorized_keys file path if specified + if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" != '-' ] ; then userHome=$(getent passwd "$uname" | cut -d: -f6) userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$userHome"} + log -n "adding user's authorized_keys file... " + cat "$userAuthorizedKeys" >> "$AUTHORIZED_KEYS" + loge "done." fi - # update authorized_keys - update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$cacheDir" + # move the temp authorized_keys file into place + mv -f "${CACHE}/authorized_keys/${uname}.tmp" "${CACHE}/authorized_keys/${uname}" + + log "authorized_keys file updated." done log "----- done. -----" @@ -206,14 +222,13 @@ case $COMMAND in # set variables for the user AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" - cacheDir="$CACHE"/"$uname"/user_keys # make sure user's authorized_user_ids file exists touch "$AUTHORIZED_USER_IDS" # process the user IDs for userID ; do - update_userid "$userID" "$cacheDir" + update_userid "$userID" done log "Run the following to update user's authorized_keys file:" -- cgit v1.2.3 From 79e9e7214bcbd4ecf4d555a1be413532b216c2e7 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 17 Jun 2008 14:33:19 -0400 Subject: Update man pages and TODO. --- debian/dirs | 1 + debian/monkeysphere.dirs | 1 + doc/TODO | 12 +++++++ man/man1/monkeysphere-ssh-proxycommand.1 | 13 ++++--- man/man1/monkeysphere.1 | 60 +++++++++++--------------------- man/man8/monkeysphere-server.8 | 11 +++--- 6 files changed, 48 insertions(+), 50 deletions(-) diff --git a/debian/dirs b/debian/dirs index bdf0fe0..b458649 100644 --- a/debian/dirs +++ b/debian/dirs @@ -1,4 +1,5 @@ var/cache/monkeysphere +var/cache/monkeysphere/authorized_keys usr/bin usr/sbin usr/share diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs index 4604eee..bc8abcf 100644 --- a/debian/monkeysphere.dirs +++ b/debian/monkeysphere.dirs @@ -1,4 +1,5 @@ usr/share/monkeysphere var/cache/monkeysphere +var/cache/monkeysphere/authorized_keys etc/monkeysphere etc/monkeysphere/authorized_user_ids diff --git a/doc/TODO b/doc/TODO index 6125fea..905d198 100644 --- a/doc/TODO +++ b/doc/TODO @@ -1,6 +1,18 @@ Next-Steps Monkeysphere Projects: --------------------------------- +Handle unknown hosts in such a way that they're not always removed + from known_hosts file. Ask user to lsign the host key? + +Handle multiple multiple hostnames (multiple user IDs?) when + generating host keys with gen-key. + +Make sure alternate ports are handled for known_hosts. + +Add environment variables sections to man pages. + +Script to import private key into ssh agent. + Provide a friendly interactive UI for marginal or failing client-side hostkey verifications. Handle the common cases smoothly, and provide good debugging info for the unusual cases. diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1 index 8392ae8..5fabb91 100644 --- a/man/man1/monkeysphere-ssh-proxycommand.1 +++ b/man/man1/monkeysphere-ssh-proxycommand.1 @@ -19,13 +19,12 @@ or by adding the following line to your ~/.ssh/config script: .B ProxyCommand monkeysphere-ssh-proxycommand %h %p The script is very simple, and can easily be incorporated into other -ProxyCommand scripts. All it does is first runs - -.B monkeysphere update-known-hosts HOST - -and then - -.B exec nc HOST PORT +ProxyCommand scripts. It first tests to see if the host is in the +known_hosts file. If it's not, the CHECK_KEYSERVER variable is set to +true and "update-known_hosts" is run for the host to check for a host +key for that host. If the host is found in the known_hosts file, +CHECK_KEYSERVER is set to false and "update-known_hosts" is run to +update from the local keychain. Run the following command for more info: diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index 95f1e59..8d89071 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -24,25 +24,23 @@ for authentication and encryption of ssh connection. .B update-known_hosts [HOST]... Update the known_hosts file. For each specified host, gpg will be queried for a key associated with the host URI (see HOST URIs), -querying a keyserver if none is found in the user's keychain. search -for a gpg key for the host in the Web of Trust. If a key is found, it -will be added to the host_keys cache (see KEY CACHES) and any ssh keys -for the host will be removed from the user's known_hosts file. If the -found key is acceptable (see KEY ACCEPTABILITY), then the host's gpg -key will be added to the known_hosts file. If no gpg key is found for -the host, then nothing is done. If no hosts are specified, all hosts -listed in the known_hosts file will be processed. `k' may be used in -place of `update-known_hosts'. +querying a keyserver if specified. If a key is found, it will be +converted to an ssh key, and any matching ssh keys will be removed +from the user's known_hosts file. If the found key is acceptable (see +KEY ACCEPTABILITY), then the key will be updated and re-added to the +known_hosts file. If no gpg key is found for the host, then nothing +is done. If no hosts are specified, all hosts listed in the +known_hosts file will be processed. `k' may be used in place of +`update-known_hosts'. .TP .B update-userids [USERID]... Add/update a user ID to the authorized_user_ids file. The user IDs specified should be exact matches to OpenPGP user IDs. For each specified user ID, gpg will be queried for a key associated with that -user ID, querying a keyserver if none is found in the user's keychain. -If a key is found, it will be added to the user_keys cache (see KEY -CACHES) and the user ID will be added to the user's -authorized_user_ids file (if it wasn't already present). `u' may be -used in place of `update-userids'. +user ID, querying a keyserver if specified. If a key is found, the +user ID will be added to the user's authorized_user_ids file (if it +wasn't already present). `u' may be used in place of +`update-userids'. .TP .B remove-userids [USERID]... Remove a user ID from the authorized_user_ids file. The user IDs @@ -50,11 +48,15 @@ specified should be exact matches to OpenPGP user IDs. `r' may be used in place of `remove-userids'. .TP .B update-authorized_keys -Update the monkeysphere authorized_keys file. The monkeysphere -authorized_keys file will be regenerated from the valid keys in the -user_key cache, and the user's independently controlled -authorized_keys file (usually ~/.ssh/authorized_keys). `a' may be -used in place of `update-authorized_keys'. +Update the monkeysphere authorized_keys file. For each user ID in the +user's authorized_user_ids file, gpg will be queried for keys +associated with that user ID, querying a keyserver if specified. If a +key is found, it will be converted to an ssh key, and any matching ssh +keys will be removed from the user's authorized_keys file. If the +found key is acceptable (see KEY ACCEPTABILITY), then the key will be +updated and re-added to the authorized_keys file. If no gpg key is +found for the user ID, then nothing is done. `a' may be used in place +of `update-authorized_keys'. .TP .B gen-subkey KEYID Generate an `a` capable subkey. For the primary key with the @@ -83,21 +85,6 @@ the "authentication" ("a") capability flag. .B validity The key must be "fully" valid, and must not be expired or revoked. -.SH KEY CACHES - -Monkeysphere keeps track of keys in key cache directories. The files -in the cache are named with the format "USERID_HASH.PUB_KEY_ID", where -USERID_HASH is a hash of the exact OpenPGP user ID, and PUB_KEY_ID is -the key ID of the primary key. If the user/key ID combo exists in the -Web of Trust but is not acceptable, then the file is empty. If the -primary key has at least one acceptable sub key, then an ssh-style -key, converted from the OpenPGP key, of all acceptable subkeys will be -stored in the cache file, one per line. known_hosts style key lines -will be stored in the host_keys cache files, and authorized_keys style -key lines will be stored in the user_keys cache files. OpenPGP keys -are converted to ssh-style keys with the openpgp2ssh utility (see `man -openpgp2ssh'). - .SH FILES .TP @@ -114,11 +101,6 @@ addition to the authorized_keys file. ~/.config/monkeysphere/authorized_keys Monkeysphere generated authorized_keys file. .TP -~/.config/monkeysphere/user_keys -User keys cache directory. -.TP -~/.config/monkeysphere/host_keys -Host keys cache directory. .SH AUTHOR diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index eafd6a8..5ca248a 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -24,8 +24,11 @@ be used for authentication and encryption of ssh connection. .B update-users [USER]... Update the admin-controlled authorized_keys files for user. For each user specified, update the user's authorized_keys file in -/var/cache/monkeysphere/USER. See `man monkeysphere' for more info. -`k' may be used in place of `update-known_hosts'. +/var/cache/monkeysphere/authorized_keys/USER. See `man monkeysphere' +for more info. If the USER_CONTROLLED_AUTHORIZED_KEYS variable is +set, then a user-controlled authorized_keys file (usually +~USER/.ssh/authorized_keys) is added to the authorized_keys file. `k' +may be used in place of `update-known_hosts'. .TP .B gen-key Generate a gpg key for the host. `g' may be used in place of @@ -66,8 +69,8 @@ Monkeysphere GNUPG home directory. /etc/monkeysphere/authorized_user_ids/USER Server maintained authorized_user_ids files for users. .TP -/var/cache/monkeysphere/USER -User keys cache directories. +/var/cache/monkeysphere/authorized_keys/USER +User authorized_keys file. .SH AUTHOR -- cgit v1.2.3 From 363b8d8cb785c25937460b552fefde5fbccfb6ba Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 17 Jun 2008 14:35:06 -0400 Subject: Add preliminary script to try to import a gpg private key into the ssh agent. --- src/seckey2sshagent | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100755 src/seckey2sshagent diff --git a/src/seckey2sshagent b/src/seckey2sshagent new file mode 100755 index 0000000..0e8d695 --- /dev/null +++ b/src/seckey2sshagent @@ -0,0 +1,25 @@ +#!/bin/sh + +cleanup() { + echo -n "removing temp gpg home... " + rm -rf $FOO + echo "done." +} + +trap cleanup EXIT + +GPGID="$1" + +idchars=$(echo $GPGID | wc -m) +if [ "$idchars" -ne 17 ] ; then + echo "GPGID is not 16 characters ($idchars)." + exit 1 +fi + +FOO=$(mktemp -d) + +gpg --export-secret-key --export-options export-reset-subkey-passwd $GPGID | GNUPGHOME=$FOO gpg --import + +GNUPGHOME=$FOO gpg --edit-key $GPGID + +GNUPGHOME=$FOO gpg --export-secret-key $GPGID | openpgp2ssh $GPGID | ssh-add -c /dev/stdin -- cgit v1.2.3 From ac63e6d6a916e4b51a183e60d7aeae3c2568f3af Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 17 Jun 2008 14:39:13 -0400 Subject: Fix small bug in man page. --- man/man1/monkeysphere.1 | 1 - 1 file changed, 1 deletion(-) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index 8d89071..a5b422c 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -100,7 +100,6 @@ addition to the authorized_keys file. .TP ~/.config/monkeysphere/authorized_keys Monkeysphere generated authorized_keys file. -.TP .SH AUTHOR -- cgit v1.2.3 From 2286a5520d8c5a39370350c2a45f9dd32870c0bc Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 17 Jun 2008 16:07:25 -0400 Subject: Very small change to comment field for authorized_keys lines. --- src/common | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/common b/src/common index 7a90453..ac43f0a 100644 --- a/src/common +++ b/src/common @@ -120,7 +120,7 @@ ssh2authorized_keys() { key="$2" echo -n "$key" | tr -d '\n' - echo " MonkeySphere${DATE}: ${userID}" + echo " MonkeySphere${DATE} ${userID}" } # convert key from gpg to ssh known_hosts format @@ -153,7 +153,7 @@ gpg2authorized_keys() { # following regexp: # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' gpg2ssh "$keyID" | tr -d '\n' - echo " MonkeySphere${DATE}: ${userID}" + echo " MonkeySphere${DATE} ${userID}" } ### GPG UTILITIES @@ -507,7 +507,7 @@ process_authorized_keys() { comment="$key" fi - if echo "$comment" | egrep -v -q '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}:' ; then + if echo "$comment" | egrep -v -q '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}' ; then continue fi userID=$(echo "$comment" | awk "{ print $2 }") -- cgit v1.2.3 From 1a19643197dafa975de9cae717cef3f4608879d8 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Jun 2008 23:31:35 -0400 Subject: Add more nuanced keyserver checking policy, including a defered check if key is not in keyring, but is in known_hosts. --- src/monkeysphere-ssh-proxycommand | 46 +++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand index 4b90a0d..4cbcd51 100755 --- a/src/monkeysphere-ssh-proxycommand +++ b/src/monkeysphere-ssh-proxycommand @@ -13,9 +13,6 @@ # established. Can be added to ~/.ssh/config as follows: # ProxyCommand monkeysphere-ssh-proxycommand %h %p -HOST="$1" -PORT="$2" - usage() { cat <&2 usage: ssh -o ProxyCommand="$(basename $0) %h %p" ... @@ -26,6 +23,14 @@ log() { echo "$@" >&2 } +if [ "$1" = '--no-connect' ] ; then + NO_CONNECT='true' + shift 1 +fi + +HOST="$1" +PORT="$2" + if [ -z "$HOST" ] ; then log "host must be specified." usage @@ -37,20 +42,39 @@ if [ -z "$PORT" ] ; then exit 1 fi -# check for the host key in the known_hosts file -hostKey=$(ssh-keygen -F "$HOST") +# set the host URI +URI="ssh://${HOST}" +if [ "$PORT" != '22' ] ; then + URI="${URI}:$PORT" +fi -# if the host key is found in the known_hosts file, -# don't check the keyserver -if [ "$hostKey" ] ; then +# if the host is in the gpg keyring... +if gpg --list-key ="${URI}" >/dev/null ; then + # do not check the keyserver CHECK_KEYSERVER="false" +# if the host is NOT in the keyring... else - CHECK_KEYSERVER="true" + # if the host key is found in the known_hosts file... + # FIXME: this only works for default known_hosts location + hostKey=$(ssh-keygen -F "$HOST") + if [ "$hostKey" ] ; then + # if the check keyserver variable is NOT set to true... + if [ "$CHECK_KEYSERVER" != 'true' ] ; then + # schedule a keyserver check for host at a later time + echo "monkeysphere update-known_hosts $HOST" | at noon + fi + # if the host key is not found in the known_hosts file... + else + # check the keyserver + CHECK_KEYSERVER="true" + fi fi export CHECK_KEYSERVER # update the known_hosts file for the host -monkeysphere update-known-hosts "$HOST" +monkeysphere update-known_hosts "$HOST" # exec a netcat passthrough to host for the ssh connection -exec nc "$HOST" "$PORT" +if [ -z "$NO_CONNECT" ] ; then + exec nc "$HOST" "$PORT" +fi -- cgit v1.2.3 From a9a56853a27e1dbce3c48af327b0adff0e4c38e0 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Wed, 18 Jun 2008 23:33:18 -0400 Subject: add george system changelog --- doc/george/changelog | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 doc/george/changelog diff --git a/doc/george/changelog b/doc/george/changelog new file mode 100644 index 0000000..2442061 --- /dev/null +++ b/doc/george/changelog @@ -0,0 +1,19 @@ +****************************************************************************** +* * +* george system log * +* * +****************************************************************************** +* Please add new entries in reverse chronological order whenever you make * +* changes to this system * +****************************************************************************** + + +2008-06-18 - micah + * debootstrap'd debian etch install + * installed /etc/apt/sources.list with local proxy sources for etch, + testing, unstable, backports and volatile + * configured /etc/apt/preferences and apt.conf.d/local-conf to + pin etch, but make testing, sid and backports available + * added backports.org apt-key + * installed openssh-server and openssh-client packages + * added dkg, jrollins, mjgoins ssh public_keys to /root/.ssh/authorized_keys -- cgit v1.2.3 From 8a977a8371f2ea54e3888494e1b474befeba318b Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Wed, 18 Jun 2008 23:36:22 -0400 Subject: add todo items that we discussed as being important to address at some point --- doc/TODO | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/TODO b/doc/TODO index 905d198..bf51ae0 100644 --- a/doc/TODO +++ b/doc/TODO @@ -1,6 +1,13 @@ Next-Steps Monkeysphere Projects: --------------------------------- +Detail advantages of monkeysphere: detail the race conditions in ssh, + and how the monkeysphere can help you reduce these threat vectors: + threat model reduction diagrams + +Determine how openssh handles multiple processes writing to + known_hosts file (atomic appends?) + Handle unknown hosts in such a way that they're not always removed from known_hosts file. Ask user to lsign the host key? -- cgit v1.2.3 From dcba8ebebf480a051f2b872f89ccbe68ad642f61 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Jun 2008 23:48:37 -0400 Subject: Update to new agreed default host key usage flag (only "a" required for users and hosts). Update TODO file. Some other small changes. --- doc/TODO | 31 +++++++++++++++++++++++++++---- etc/monkeysphere.conf | 6 +++++- src/common | 8 ++++---- src/monkeysphere | 2 +- 4 files changed, 37 insertions(+), 10 deletions(-) diff --git a/doc/TODO b/doc/TODO index 905d198..0402b46 100644 --- a/doc/TODO +++ b/doc/TODO @@ -4,13 +4,11 @@ Next-Steps Monkeysphere Projects: Handle unknown hosts in such a way that they're not always removed from known_hosts file. Ask user to lsign the host key? -Handle multiple multiple hostnames (multiple user IDs?) when - generating host keys with gen-key. +Handle multiple hostnames (multiple user IDs?) when generating host + keys with gen-key. Make sure alternate ports are handled for known_hosts. -Add environment variables sections to man pages. - Script to import private key into ssh agent. Provide a friendly interactive UI for marginal or failing client-side @@ -49,3 +47,28 @@ Make it easier to do domain-relative ssh host trust signatures with "tsign" in gpg(1). Fix the order of questions when user does a tsign in gpg or gpg2. + +File bug against ssh-keygen about how "-R" option removes comments + from known_hosts file. + +File bug against ssh-keygen to see if we can get it to write to hash a + known_hosts file to/from stdout/stdin. + +Note all threat model reductions (with diagrams). + +Add environment variables sections to man pages. + +Environment variable scoping. + +Move environment variable precedence before conf file. + +Handle lockfiles when modifying known_hosts or authorized_keys. + +When using ssh-proxycommand, if only host keys found are expired or + revoked, then output loud warning with prompt, or fail hard. + +Update monkeysphere-ssh-proxycommand man page with new keyserver + checking policy info. + +Update monkeysphere-ssh-proxycommand man page with info about + no-connect option. diff --git a/etc/monkeysphere.conf b/etc/monkeysphere.conf index 17c1a14..f2ba4a7 100644 --- a/etc/monkeysphere.conf +++ b/etc/monkeysphere.conf @@ -15,7 +15,7 @@ # s = sign # c = certify # a = authentication -#REQUIRED_HOST_KEY_CAPABILITY="e a" +#REQUIRED_HOST_KEY_CAPABILITY="a" #REQUIRED_USER_KEY_CAPABILITY="a" # ssh known_hosts file @@ -27,3 +27,7 @@ # ssh authorized_keys file #AUTHORIZED_KEYS=~/.ssh/known_hosts + +# This overrides other environment variables +# NOTE: there is leakage +#CHECK_KEYRING=true diff --git a/src/common b/src/common index ac43f0a..9b06b1d 100644 --- a/src/common +++ b/src/common @@ -73,7 +73,7 @@ unescape() { } # remove all lines with specified string from specified file -remove_file_line() { +remove_line() { local file local string @@ -395,7 +395,7 @@ remove_userid() { # remove user ID from file log -n " removing user ID '$userID'... " - remove_file_line "$AUTHORIZED_USER_IDS" "^${userID}$" + remove_line "$AUTHORIZED_USER_IDS" "^${userID}$" loge "done." } @@ -416,7 +416,7 @@ process_host_known_hosts() { while read -r ok keyid ; do sshKey=$(gpg2ssh "$keyid") # remove the old host key line - remove_file_line "$KNOWN_HOSTS" "$sshKey" + remove_line "$KNOWN_HOSTS" "$sshKey" # if key OK, add new host line if [ "$ok" -eq '0' ] ; then # hash if specified @@ -449,7 +449,7 @@ process_uid_authorized_keys() { while read -r ok keyid ; do sshKey=$(gpg2ssh "$keyid") # remove the old host key line - remove_file_line "$AUTHORIZED_KEYS" "$sshKey" + remove_line "$AUTHORIZED_KEYS" "$sshKey" # if key OK, add new host line if [ "$ok" -eq '0' ] ; then ssh2authorized_keys "$userID" "$sshKey" >> "$AUTHORIZED_KEYS" diff --git a/src/monkeysphere b/src/monkeysphere index 6853f58..a6cecfd 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -115,7 +115,7 @@ AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"} GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"} KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"} -REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"e a"} +REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"a"} REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} KNOWN_HOSTS=${KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"} AUTHORIZED_KEYS=${AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"} -- cgit v1.2.3 From 6ee67a218916f6f9c30dfe9787109017c11e8185 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Jun 2008 23:53:09 -0400 Subject: Update TODO after merge. --- doc/TODO | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/doc/TODO b/doc/TODO index c17ef61..3538fbf 100644 --- a/doc/TODO +++ b/doc/TODO @@ -3,10 +3,10 @@ Next-Steps Monkeysphere Projects: Detail advantages of monkeysphere: detail the race conditions in ssh, and how the monkeysphere can help you reduce these threat vectors: - threat model reduction diagrams + threat model reduction diagrams. Determine how openssh handles multiple processes writing to - known_hosts file (atomic appends?) + known_hosts/authorized_keys files (lockfile, atomic appends?) Handle unknown hosts in such a way that they're not always removed from known_hosts file. Ask user to lsign the host key? @@ -61,16 +61,12 @@ File bug against ssh-keygen about how "-R" option removes comments File bug against ssh-keygen to see if we can get it to write to hash a known_hosts file to/from stdout/stdin. -Note all threat model reductions (with diagrams). - Add environment variables sections to man pages. Environment variable scoping. Move environment variable precedence before conf file. -Handle lockfiles when modifying known_hosts or authorized_keys. - When using ssh-proxycommand, if only host keys found are expired or revoked, then output loud warning with prompt, or fail hard. -- cgit v1.2.3 From fadd814ce4351c3869e49d91b31aa5b2efc68a01 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Jun 2008 23:58:01 -0400 Subject: update george changelog --- doc/george/changelog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/doc/george/changelog b/doc/george/changelog index 2442061..5d35355 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -7,6 +7,9 @@ * changes to this system * ****************************************************************************** +2008-06-18 - jrollins + * installed less, emacs; + * aptitude update && aptitude dist-upgrade 2008-06-18 - micah * debootstrap'd debian etch install -- cgit v1.2.3 From e158221fd47d035fa3a7a8cd715327714d40d32a Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 00:17:38 -0400 Subject: added policy docs about george.riseup.net --- doc/george/policy | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 doc/george/policy diff --git a/doc/george/policy b/doc/george/policy new file mode 100644 index 0000000..6da08e9 --- /dev/null +++ b/doc/george/policy @@ -0,0 +1,32 @@ +Policy for maintaining george.riseup.net +---------------------------------------- + +Riseup graciously provided the MonkeySphere project with a vserver for +testing and public documentation. This is known as george.riseup.net, +for those who are curious about the MonkeySphere. + +george will be maintained as a debian lenny machine, with minimal +packages from experimental as needed for installing and running what +we build elsewhere. + +george will host 3 public-facing services: an ssh daemon on port 22, +an http service on port 80, and an OpenPGP keyserver (the HKP +protocol) on port 11371. + +Administration of george is a shared responsibility across the core +members of the MonkeySphere development team. Administrators will log +changes in their git repositories, in doc/george/changelog (a peer of +this policy file). + +monkeysphere packages installed on george will use unique, tagged +version numbers so we know what we're running. + +We will try to keep the installation as minimal as possible while +still allowing for comfortable day-to-day administration. + + +Outstanding questions: + +Who should have superuser access? + +Who should get regular user accounts? -- cgit v1.2.3 From b894e98ae67832a320ec5d7597231c94ddf29b99 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 00:34:10 -0400 Subject: added debian-package target to Makefile to simplify package building process. It gets a little weird and recursive; could probably be better-engineered. --- Makefile | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 64e6cbe..1a214fc 100644 --- a/Makefile +++ b/Makefile @@ -1,12 +1,27 @@ +MONKEYSPHERE_VERSION=`head -n1 debian/changelog | sed 's/.*(\([^-]*\)-.*/\1/'` + all: keytrans keytrans: $(MAKE) -C src/keytrans release: clean - tar c COPYING doc etc Makefile man src | gzip -n > ../monkeysphere_`head -n1 debian/changelog | sed 's/.*(\([^-]*\)-.*/\1/'`.orig.tar.gz + rm -rf monkeysphere-$(MONKEYSPHERE_VERSION) + mkdir -p monkeysphere-$(MONKEYSPHERE_VERSION)/doc + ln -s ../../doc/README ../../doc/TODO ../../doc/MonkeySpec monkeysphere-$(MONKEYSPHERE_VERSION)/doc + ln -s ../COPYING ../etc ../Makefile ../man ../src monkeysphere-$(MONKEYSPHERE_VERSION) + tar -ch monkeysphere-$(MONKEYSPHERE_VERSION) | gzip -n > monkeysphere_$(MONKEYSPHERE_VERSION).orig.tar.gz + rm -rf monkeysphere-$(MONKEYSPHERE_VERSION) + +debian-package: release + tar xzf monkeysphere_$(MONKEYSPHERE_VERSION).orig.tar.gz + cp -a debian monkeysphere-$(MONKEYSPHERE_VERSION) + (cd monkeysphere-$(MONKEYSPHERE_VERSION) && debuild -uc -us) + rm -rf monkeysphere-$(MONKEYSPHERE_VERSION) clean: $(MAKE) -C src/keytrans clean + # clean up old monkeysphere packages lying around as well. + rm -f monkeysphere_* -.PHONY: all clean release +.PHONY: all clean release debian-package -- cgit v1.2.3 From 418db67eab25d035e585e2237b57b5d9ebf261c6 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 00:35:41 -0400 Subject: preparing for first tagged release (planned for george.riseup.net). --- debian/changelog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index ec744e1..ce425b0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,5 +3,5 @@ monkeysphere (0.1-1) unstable; urgency=low * First release of debian package for monkeysphere. * This is experimental -- please report bugs! - -- Daniel Kahn Gillmor Fri, 13 Jun 2008 10:53:43 -0400 + -- Daniel Kahn Gillmor Thu, 19 Jun 2008 00:34:53 -0400 -- cgit v1.2.3 From 70ee9836c30c3264660010156944d3b76e9300b2 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 01:12:30 -0400 Subject: more notes on work on george. --- doc/george/changelog | 16 ++++++++++++++++ doc/george/policy | 1 + 2 files changed, 17 insertions(+) diff --git a/doc/george/changelog b/doc/george/changelog index 5d35355..8eebe4b 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -7,6 +7,22 @@ * changes to this system * ****************************************************************************** +2008-06-19 - dkg + * removed etch sources, switched "testing" to "lenny", added + lenny/updates, removed all contrib and non-free. + + * removed testing pin in /etc/apt/preferences + * ran the upgrade + + * reset emacs22 to emacs22-nox (avoiding dependencies) + + * removed sysklog and klogd because of errors restarting klogd. + Installed syslog-ng in their stead, which still gives errors + related to /proc/kmsg unreadability, but the install completes :/ + + * added experimental, juggled pinning: + experimental: 1, unstable: 2 + 2008-06-18 - jrollins * installed less, emacs; * aptitude update && aptitude dist-upgrade diff --git a/doc/george/policy b/doc/george/policy index 6da08e9..a17a310 100644 --- a/doc/george/policy +++ b/doc/george/policy @@ -24,6 +24,7 @@ version numbers so we know what we're running. We will try to keep the installation as minimal as possible while still allowing for comfortable day-to-day administration. +We will use aptitude for package management where possible. Outstanding questions: -- cgit v1.2.3 From e31c134605f9f03ac559a9095736ea7e3cbf347d Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 01:14:22 -0400 Subject: added Ross Glover to credits (Ross, do you want to change your identification here somehow? send a patch!) --- COPYING | 1 + debian/copyright | 1 + 2 files changed, 2 insertions(+) diff --git a/COPYING b/COPYING index 36b1d08..fefe9ab 100644 --- a/COPYING +++ b/COPYING @@ -9,6 +9,7 @@ It is free software, developed by: Matthew Goins Mike Castleman Elliot Winard + Ross Glover Greg Lyle MonkeySphere is distributed in the hope that it will be useful, but diff --git a/debian/copyright b/debian/copyright index 040e6c8..1fa6d83 100644 --- a/debian/copyright +++ b/debian/copyright @@ -11,6 +11,7 @@ Copyright: 2008 Jameson Rollins , Matthew Goins , Mike Castleman , Elliot Winard , + Ross Glover , Greg Lyle License: GPL-3+ -- cgit v1.2.3 From 7e23258c90a1e1c851de756f678ae7bbbede81b5 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 01:31:26 -0400 Subject: monkeysphere-server gen-key creates keys with only the auth flag set. --- src/monkeysphere-server | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 560d249..06c9c7f 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -51,7 +51,7 @@ gen_key() { # set key defaults KEY_TYPE=${KEY_TYPE:-"RSA"} KEY_LENGTH=${KEY_LENGTH:-"2048"} - KEY_USAGE=${KEY_USAGE:-"auth,encrypt"} + KEY_USAGE=${KEY_USAGE:-"auth"} cat < Date: Thu, 19 Jun 2008 01:53:05 -0400 Subject: clarify why monkeysphere-server publish_key is currently non-functional. --- src/common | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/common b/src/common index 9b06b1d..c39506d 100644 --- a/src/common +++ b/src/common @@ -561,6 +561,8 @@ publish_server_key() { # FIXME: need to figure out better way to identify host key # dummy command so as not to publish fakes keys during testing # eventually: - #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f) - echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)" + #gpg --keyserver "$KEYSERVER" --send-keys $(hostname -f) + echo "NOT PUBLISHED (to avoid permanent publication errors during monkeysphere development). +To publish manually, do: gpg --keyserver $KEYSERVER --send-keys $(hostname -f)" + return 1 } -- cgit v1.2.3 From ec3b1c13b5a071234d5e8e9b321f521dc58af924 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 01:59:08 -0400 Subject: adjust man pages to reflect current thinking about purpose of keys (authentication, not encryption). --- man/man1/monkeysphere.1 | 2 +- man/man8/monkeysphere-server.8 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index a5b422c..f36d69e 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -13,7 +13,7 @@ monkeysphere \- MonkeySphere client user interface MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh authentication and encryption. OpenPGP keys are tracked via GnuPG, and added to the ssh authorized_keys and known_hosts files to be used -for authentication and encryption of ssh connection. +for authentication of ssh connections. \fBmonkeysphere\fP is the MonkeySphere client utility. diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index 5ca248a..edb493f 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -13,7 +13,7 @@ monkeysphere-server \- monkeysphere server admin user interface \fBMonkeySphere\fP is a system to leverage the OpenPGP Web of Trust for ssh authentication and encryption. OpenPGP keys are tracked via GnuPG, and added to the ssh authorized_keys and known_hosts files to -be used for authentication and encryption of ssh connection. +be used for authentication of ssh connections. \fBmonkeysphere-server\fP is the MonkeySphere server admin utility. -- cgit v1.2.3 From 79147b6612104c0e3a347f3a99adc377047d24fc Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 02:20:49 -0400 Subject: added monkeysphere-server show-fingerprint --- man/man8/monkeysphere-server.8 | 6 +++++- src/monkeysphere-server | 14 +++++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index edb493f..28149fb 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -34,9 +34,13 @@ may be used in place of `update-known_hosts'. Generate a gpg key for the host. `g' may be used in place of `gen-key'. .TP +.B show-fingerprint +Show the fingerprint for the host's OpenPGP key. `f' may be used in place of +`show-fingerprint'. +.TP .B publish-key Publish the host's gpg key to the keyserver. `p' may be used in place -of `publish-key' +of `publish-key'. .TP .B trust-keys KEYID... Mark key specified with key IDs with full owner trust. `t' may be used diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 06c9c7f..ce5aa9c 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -76,6 +76,9 @@ EOF ) # add the revoker field if requested +# FIXME: the 1: below assumes that $REVOKER's key is an RSA key. why? +# FIXME: why is this marked "sensitive"? how will this signature ever +# be transmitted to the expected revoker? if [ "$REVOKER" ] ; then keyParameters="${keyParameters}"$(cat < Date: Thu, 19 Jun 2008 02:23:19 -0400 Subject: update monkeysphere-server help to include new show-fingerprint. --- src/monkeysphere-server | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/monkeysphere-server b/src/monkeysphere-server index ce5aa9c..f222130 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -31,10 +31,12 @@ usage: $PGRM [args] MonkeySphere server admin tool. subcommands: - update-users (s) [USER]... update users authorized_keys files gen-key (g) [HOSTNAME] generate gpg key for the server + show-fingerprint (f) show server's host key fingerprint publish-key (p) publish server key to keyserver trust-keys (t) KEYID... mark keyids as trusted + + update-users (s) [USER]... update users authorized_keys files update-user-userids (u) USER UID... add/update user IDs for a user remove-user-userids (r) USER UID... remove user IDs for a user help (h,?) this help -- cgit v1.2.3 From d8dd7e109a119ed66e7a32777f0de34ce69c0928 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 03:04:58 -0400 Subject: added description of steps needed to get host key published for george.riseup.net. --- doc/george/host-key-publication | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 doc/george/host-key-publication diff --git a/doc/george/host-key-publication b/doc/george/host-key-publication new file mode 100644 index 0000000..03e2510 --- /dev/null +++ b/doc/george/host-key-publication @@ -0,0 +1,28 @@ +2008-06-19 02:34:57-0400 +------------------------ + +Adding george's host key to the monkeysphere was more complicated than +it needed to be. + +As the server admin, i did (accepting the defaults where possible): + + monkeysphere-server gen-key + KEYID=$(GNUPGHOME=/etc/monkeysphere/gnupg gpg --with-colons --list-key =ssh://$(hostname --fqdn) | grep ^pub: | cut -f5 -d:) + (umask 077 && GNUPGHOME=/etc/monkeysphere/gnupg gpg --export-secret-key $KEYID | openpgp2ssh $KEYID >/etc/monkeysphere/ssh_host_rsa_key) + # modify /etc/ssh/sshd_config to remove old host keys lines, and + # add new line: HostKey /etc/monkeysphere/ssh_host_rsa_key + /etc/init.d/ssh restart + + KEYSERVER=george.riseup.net monkeysphere-server publish-key + # (needed to publish by hand here because of reasonable sanity checks) + monkeysphere-server show-fingerprint + + # then from a remote host: + gpg --keyserver george.riseup.net --search =ssh://george.riseup.net + gpg --fingerprint --sign-key =ssh://george.riseup.net + KEYID=$(gpg --with-colons --list-key =ssh://george.riseup.net | grep ^pub: | cut -f5 -d:) + gpg --keyserver george.riseup.net --send "$KEYID" + gpg --keyserver george.riseup.net --send "$MYGPGID" + + +How could this have been streamlined? -- cgit v1.2.3 From 1066e96e927e812159274af4b6ca78c6a46881ee Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 03:05:40 -0400 Subject: updated doc/README to match the location of authorized_user_ids that is created by the package. --- doc/README | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/README b/doc/README index 427f214..7880530 100644 --- a/doc/README +++ b/doc/README @@ -34,7 +34,7 @@ users. For each user account on the server, the userids of people authorized to log into that account would be placed in: -/etc/monkeysphere/authorized_user_file/USER +/etc/monkeysphere/authorized_user_ids/USER However, in order for users to become authenticated, the server must determine that the user keys have "full" validity. This means that -- cgit v1.2.3 From a5066c3a37a84bf47e1e1d6ff8ad755ad5fa9414 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 03:17:01 -0400 Subject: added more documentation about george, and more TODO notes. --- doc/TODO | 25 +++++++++++++++++++++++-- doc/george/changelog | 14 ++++++++++++-- doc/george/user-id-configuration | 21 +++++++++++++++++++++ 3 files changed, 56 insertions(+), 4 deletions(-) create mode 100644 doc/george/user-id-configuration diff --git a/doc/TODO b/doc/TODO index 3538fbf..e2fce0e 100644 --- a/doc/TODO +++ b/doc/TODO @@ -8,12 +8,33 @@ Detail advantages of monkeysphere: detail the race conditions in ssh, Determine how openssh handles multiple processes writing to known_hosts/authorized_keys files (lockfile, atomic appends?) -Handle unknown hosts in such a way that they're not always removed - from known_hosts file. Ask user to lsign the host key? +Handle unverified monkeysphere hosts in such a way that they're not + always removed from known_hosts file. Ask user to lsign the host + key? Handle multiple hostnames (multiple user IDs?) when generating host keys with gen-key. +Work out the details (and describe a full use case) for assigning a + REVOKER during monkeysphere-server gen_key -- how is this set? How + do we export it so it's available when a second-party revocation is + needed? + +Actually enable server hostkey publication. + +Streamline host key generation, publication, verification. See + doc/george/host-key-publication for what dkg went through on + 2008-06-19 + +Streamline authorized_user_ids setup (including question of where + authorized_user_ids files should go). See + doc/george/user-id-configuration for what dkg went through on + 2008-06-19 + +Ensure that authorized_user_ids are under as tight control as ssh + expects from authorized_keys: we don't want monkeysphere to be a + weak link in the filesystem. + Make sure alternate ports are handled for known_hosts. Script to import private key into ssh agent. diff --git a/doc/george/changelog b/doc/george/changelog index 8eebe4b..afea2d0 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -20,8 +20,18 @@ Installed syslog-ng in their stead, which still gives errors related to /proc/kmsg unreadability, but the install completes :/ - * added experimental, juggled pinning: - experimental: 1, unstable: 2 + * added experimental + * juggled pinning: experimental: 1, unstable: 2 + * added mathopd onak, tweaked /etc/mathopd.conf and /etc/onak.conf + + * installed monkeysphere v0.1-1, changed host key, published + them via the local keyserver (see host-key-publication) + + * added local unprivileged user accounts for everyone listed in + /usr/share/doc/monkeysphere/copyright + + * configured authorized_user_ids for every user account based on + my best guess at their OpenPGP User ID. 2008-06-18 - jrollins * installed less, emacs; diff --git a/doc/george/user-id-configuration b/doc/george/user-id-configuration new file mode 100644 index 0000000..d95279d --- /dev/null +++ b/doc/george/user-id-configuration @@ -0,0 +1,21 @@ +2008-06-19 03:00:58-0400 +------------------------ + +setting up authorized_user_id configuration on george was also more +cumbersome than it needs to be. Here's what i (dkg) did: + + GNUPGHOME=/etc/monkeysphere/gnupg gpg --keyserver subkeys.pgp.net --search dkg@fifthhorseman.net + GNUPGHOME=/etc/monkeysphere/gnupg gpg --fingerprint dkg@fifthhorseman.net + +set up the authorized_user_ids (why are these in /etc/ and not in +people's home directories?) + +echo 'Daniel Kahn Gillmor ' > /etc/monkeysphere/authorized_user_ids/dkg +echo 'Jameson Rollins ' > /etc/monkeysphere/authorized_user_ids/jrollins +echo 'Micah Anderson ' > /etc/monkeysphere/authorized_user_ids/micah +echo 'Matthew Goins ' > /etc/monkeysphere/authorized_user_ids/mjgoins +echo 'Ross Glover ' > /etc/monkeysphere/authorized_user_ids/ross +echo 'Jamie McClelland ' > /etc/monkeysphere/authorized_user_ids/jamie +echo 'mike castleman ' > /etc/monkeysphere/authorized_user_ids/mlcastle +echo 'Elliot Winard ' > /etc/monkeysphere/authorized_user_ids/enw +echo 'Greg Lyle ' > /etc/monkeysphere/authorized_user_ids/greg -- cgit v1.2.3 From 1cfde8b57895ab300f47452d03da20e73f27032d Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 03:33:29 -0400 Subject: monkeysphere-server should not bother adding the user-controlled authorized_keys file if it does not exist. --- src/monkeysphere-server | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/monkeysphere-server b/src/monkeysphere-server index f222130..96a1070 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -111,7 +111,7 @@ EOF log -n "generating server key... " echo "$keyParameters" | gpg --batch --gen-key - log "done." + loge "done." fingerprint_server_key } @@ -187,9 +187,11 @@ case $COMMAND in if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" != '-' ] ; then userHome=$(getent passwd "$uname" | cut -d: -f6) userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$userHome"} - log -n "adding user's authorized_keys file... " - cat "$userAuthorizedKeys" >> "$AUTHORIZED_KEYS" - loge "done." + if [ -f "$userAuthorizedKeys" ] ; then + log -n "adding user's authorized_keys file... " + cat "$userAuthorizedKeys" >> "$AUTHORIZED_KEYS" + loge "done." + fi fi # move the temp authorized_keys file into place -- cgit v1.2.3 From d96875037bca527fe2bc88f7cc1a3842e3080f04 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 03:34:46 -0400 Subject: fixed think-o: running a commend with no arguments should have no arguments. --- doc/README | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/README b/doc/README index 7880530..cda1194 100644 --- a/doc/README +++ b/doc/README @@ -53,4 +53,4 @@ system would then run the following: To update the monkeysphere authorized_keys file for all users on the the system, run the same command with no arguments: -# monkeysphere-server update-users bob +# monkeysphere-server update-users -- cgit v1.2.3 From 86e9e0e3fd03db1770857990882d955954a5265b Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 04:00:42 -0400 Subject: re-worked documentation and raised issues in TODO about end user authentication. --- doc/TODO | 26 +++++++++++++++++++ doc/george/user-id-configuration | 56 +++++++++++++++++++++++++++++----------- 2 files changed, 67 insertions(+), 15 deletions(-) diff --git a/doc/TODO b/doc/TODO index e2fce0e..5cd9be9 100644 --- a/doc/TODO +++ b/doc/TODO @@ -35,6 +35,32 @@ Ensure that authorized_user_ids are under as tight control as ssh expects from authorized_keys: we don't want monkeysphere to be a weak link in the filesystem. +What happens when there are no entries in the authorized_user_ids file + for a user? /var/cache/monkeysphere/authorized_keys/$USER.tmp + seems like it gets created and then left there. + +What happens when a user account has no corresponding + /etc/monkeysphere/authorized_user_ids/$USER file? What gets placed + in /var/cache/monkeysphere/authorized_keys/$USER? It looks + currently untouched, which could mean bad things for such a user. + +Consider the default permissions for + /var/cache/monkeysphere/authorized_keys/* (and indeed the whole + directory path leading up to that) + +What should happen when an admin does + "monkeysphere-server update-users not_an_existent_user"? + currently, it adds + /etc/monkeysphere/authorized_user_ids/not_an_existent_user, which + seems rather wrong. + +is /var/cache/monkeysphere/authorized_keys/$USER.tmp guaranteed to + avoid collisions? Why not use a real mktemp file? + +As an administrator, how do i reverse the effect of a + "monkeysphere-server trust-keys" that i later decide i should not + have run? + Make sure alternate ports are handled for known_hosts. Script to import private key into ssh agent. diff --git a/doc/george/user-id-configuration b/doc/george/user-id-configuration index d95279d..d42bfbd 100644 --- a/doc/george/user-id-configuration +++ b/doc/george/user-id-configuration @@ -4,18 +4,44 @@ setting up authorized_user_id configuration on george was also more cumbersome than it needs to be. Here's what i (dkg) did: - GNUPGHOME=/etc/monkeysphere/gnupg gpg --keyserver subkeys.pgp.net --search dkg@fifthhorseman.net - GNUPGHOME=/etc/monkeysphere/gnupg gpg --fingerprint dkg@fifthhorseman.net - -set up the authorized_user_ids (why are these in /etc/ and not in -people's home directories?) - -echo 'Daniel Kahn Gillmor ' > /etc/monkeysphere/authorized_user_ids/dkg -echo 'Jameson Rollins ' > /etc/monkeysphere/authorized_user_ids/jrollins -echo 'Micah Anderson ' > /etc/monkeysphere/authorized_user_ids/micah -echo 'Matthew Goins ' > /etc/monkeysphere/authorized_user_ids/mjgoins -echo 'Ross Glover ' > /etc/monkeysphere/authorized_user_ids/ross -echo 'Jamie McClelland ' > /etc/monkeysphere/authorized_user_ids/jamie -echo 'mike castleman ' > /etc/monkeysphere/authorized_user_ids/mlcastle -echo 'Elliot Winard ' > /etc/monkeysphere/authorized_user_ids/enw -echo 'Greg Lyle ' > /etc/monkeysphere/authorized_user_ids/greg +monkeysphere-server trust-keys 0EE5BE979282D80B9F7540F1CCD2ED94D21739E9 + +monkeysphere-server update-user-userids dkg 'Daniel Kahn Gillmor ' +monkeysphere-server update-user-userids jrollins 'Jameson Rollins ' +monkeysphere-server update-user-userids micah 'Micah Anderson ' +monkeysphere-server update-user-userids mjgoins 'Matthew Goins ' +monkeysphere-server update-user-userids ross 'Ross Glover ' +monkeysphere-server update-user-userids jamie 'Jamie McClelland ' +monkeysphere-server update-user-userids mlcastle 'mike castleman ' +monkeysphere-server update-user-userids enw 'Elliot Winard ' +monkeysphere-server update-user-userids greg 'Greg Lyle ' + + +then i added a scheduled: + + monkeysphere-server update-users + +to run hourly via /etc/crontab + +and made sure that root's keys were working with a temporary symlink +(see TODO about that business) + +and then modified /etc/ssh/sshd_config with: + + AuthorizedKeysFile /var/cache/monkeysphere/authorized_keys/%u + + +Some outstanding questions: + + * why are the authorized_user_ids stored in /etc/ and not in people's + home directories? + + * why are authorized_user_ids managed with a special sub-command of + monkeysphere-server, instead of just being hand-managed files, the + way that authorized_keys are in stock openssh? + + * Should we ship a scheduled monkeysphere-server update-users cron + job automatically? + + * why was i not prompted to confirm the trust-keys line, which seems + like the most delicate/sensitive line of all of them? -- cgit v1.2.3 From f126697f731f311fb9561217be751b36ec49db4a Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 04:04:32 -0400 Subject: bumping revision number for next version. --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian/changelog b/debian/changelog index ce425b0..d326473 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +monkeysphere (0.2-1) UNRELEASED; urgency=low + + * NOT YET RELEASED + * + + -- Daniel Kahn Gillmor Thu, 19 Jun 2008 04:03:45 -0400 + monkeysphere (0.1-1) unstable; urgency=low * First release of debian package for monkeysphere. -- cgit v1.2.3 From 0e7b7f17fd635486371798a513067ba747dd47dc Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 04:10:55 -0400 Subject: documented cronjob, and referred to user-id-configuration. --- doc/george/changelog | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/george/changelog b/doc/george/changelog index afea2d0..381fa0f 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -31,7 +31,11 @@ /usr/share/doc/monkeysphere/copyright * configured authorized_user_ids for every user account based on - my best guess at their OpenPGP User ID. + my best guess at their OpenPGP User ID (see + user-id-configuration). + + * set up a cronjob (in /etc/crontab) to run "monkeysphere-server + update-users" at 26 minutes past the hour. 2008-06-18 - jrollins * installed less, emacs; -- cgit v1.2.3 From bb383503ddd5df97801afe10fb104705ca41f66c Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 11:40:25 -0400 Subject: switching suite to experimental to properly reflect status. --- debian/changelog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/changelog b/debian/changelog index d326473..74c5d8b 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,11 +1,11 @@ monkeysphere (0.2-1) UNRELEASED; urgency=low - * NOT YET RELEASED + * NOT YET RELEASED (switch to "experimental" when ready to release) * -- Daniel Kahn Gillmor Thu, 19 Jun 2008 04:03:45 -0400 -monkeysphere (0.1-1) unstable; urgency=low +monkeysphere (0.1-1) experimental; urgency=low * First release of debian package for monkeysphere. * This is experimental -- please report bugs! -- cgit v1.2.3 From 2e817838052450ec7a8942f24c5190e51bbd31d0 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 12:02:33 -0400 Subject: documenting addition of apt repo on george. --- doc/george/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/george/changelog b/doc/george/changelog index 381fa0f..55d46bc 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -7,6 +7,13 @@ * changes to this system * ****************************************************************************** +2008-06-19 - dkg + * installed rsync (for maintaining a public apt repo) + + * configured mathopd to listen on port 80, serving /srv/www as / + and /srv/apt as /debian. We've got nothing in /srv/www at the + moment, though. + 2008-06-19 - dkg * removed etch sources, switched "testing" to "lenny", added lenny/updates, removed all contrib and non-free. -- cgit v1.2.3 From f95798d4fd83cb227b69c136b16b592d997303c6 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 12:20:08 -0400 Subject: documenting george debugging steps. --- doc/george/changelog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/george/changelog b/doc/george/changelog index 55d46bc..6dc3a29 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -13,6 +13,11 @@ * configured mathopd to listen on port 80, serving /srv/www as / and /srv/apt as /debian. We've got nothing in /srv/www at the moment, though. + + * installed lsof and psmisc as sysadmin utilities. sorry for the + bloat! + + * installed strace to try to figure out why onak is segfaulting. 2008-06-19 - dkg * removed etch sources, switched "testing" to "lenny", added -- cgit v1.2.3 From 15637a9ab9b4fe7ea537988f5cc145d35948d783 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Thu, 19 Jun 2008 15:22:46 -0400 Subject: Added server config variable to specify user authorized_user_ids file, and changed default. --- debian/changelog | 9 +++++-- etc/monkeysphere-server.conf | 9 ++++++- src/common | 32 +++++++++++++++++++---- src/monkeysphere | 6 ++--- src/monkeysphere-server | 55 +++++++++++++++++++++++---------------- src/monkeysphere-ssh-proxycommand | 2 +- 6 files changed, 78 insertions(+), 35 deletions(-) diff --git a/debian/changelog b/debian/changelog index 74c5d8b..9bfcc26 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,9 +1,14 @@ monkeysphere (0.2-1) UNRELEASED; urgency=low + [ Daniel Kahn Gillmor ] * NOT YET RELEASED (switch to "experimental" when ready to release) - * - -- Daniel Kahn Gillmor Thu, 19 Jun 2008 04:03:45 -0400 + [ Jameson Graef Rollins ] + * Add AUTHORIZED_USER_IDS config variable for server, which defaults to + %h/.config/monkeysphere/authorized_user_ids, instead of + /etc/monkeysphere/authorized_user_ids. + + -- Jameson Graef Rollins Thu, 19 Jun 2008 15:22:05 -0400 monkeysphere (0.1-1) experimental; urgency=low diff --git a/etc/monkeysphere-server.conf b/etc/monkeysphere-server.conf index 3915bf4..847e879 100644 --- a/etc/monkeysphere-server.conf +++ b/etc/monkeysphere-server.conf @@ -17,8 +17,15 @@ # a = authentication #REQUIRED_USER_KEY_CAPABILITY="a" +# Path to authorized_user_ids file to process to create +# authorized_keys file. '%h' will be replaced by the home directory +# of the user, and %u will be replaced by the username of the user. +# For purely admin-controlled authorized_user_ids, you might put them +# in /etc/monkeysphere/authorized_user_ids/%u +#AUTHORIZED_USER_IDS="%h/.config/monkeysphere/authorized_user_ids" + # Whether to add user controlled authorized_keys file to # monkeysphere-generated authorized_keys file. Should be path to file # where '%h' will be replaced by the home directory of the user. # To not add any user-controlled file, put "-" -#USER_CONTROLLED_AUTHORIZED_KEYS=%h/.ssh/authorized_keys +#USER_CONTROLLED_AUTHORIZED_KEYS="%h/.ssh/authorized_keys" diff --git a/src/common b/src/common index c39506d..89efc46 100644 --- a/src/common +++ b/src/common @@ -85,6 +85,24 @@ remove_line() { fi } +# translate ssh-style path variables %h and %u +translate_ssh_variables() { + local uname + local home + + uname="$1" + path="$2" + + # get the user's home directory + userHome=$(getent passwd "$uname" | cut -d: -f6) + + # translate ssh-style path variables + path=${path/\%u/"$uname"} + path=${path/\%h/"$userHome"} + + echo "$path" +} + ### CONVERTION UTILITIES # output the ssh key for a given key ID @@ -358,6 +376,7 @@ update_userid() { local userID userID="$1" + authorizedUserIDs="$2" log "processing userid: '$userID'" @@ -365,12 +384,12 @@ update_userid() { process_user_id "$userID" | grep -q "^0 " # check if user ID is in the authorized_user_ids file - if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + if ! grep -q "^${userID}\$" "$authorizedUserIDs" ; then read -p "user ID not currently authorized. authorize? [Y|n]: " OK; OK=${OK:=Y} if [ ${OK/y/Y} = 'Y' ] ; then # add if specified log -n " adding user ID to authorized_user_ids file... " - echo "$userID" >> "$AUTHORIZED_USER_IDS" + echo "$userID" >> "$authorizedUserIDs" loge "done." else # else do nothing @@ -384,18 +403,19 @@ remove_userid() { local userID userID="$1" + authorizedUserIDs="$2" log "processing userid: '$userID'" # check if user ID is in the authorized_user_ids file - if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then + if ! grep -q "^${userID}\$" "$authorizedUserIDs" ; then log " user ID not currently authorized." return 1 fi # remove user ID from file log -n " removing user ID '$userID'... " - remove_line "$AUTHORIZED_USER_IDS" "^${userID}$" + remove_line "$authorizedUserIDs" "^${userID}$" loge "done." } @@ -480,7 +500,9 @@ process_known_hosts() { process_authorized_user_ids() { local userid - cat "$AUTHORIZED_USER_IDS" | meat | \ + authorizedUserIDs="$1" + + cat "$authorizedUserIDs" | meat | \ while read -r userid ; do process_uid_authorized_keys "$userid" done diff --git a/src/monkeysphere b/src/monkeysphere index a6cecfd..a9c9d58 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -164,7 +164,7 @@ case $COMMAND in failure "you must specify at least one userid." fi for userID ; do - update_userid "$userID" + update_userid "$userID" "$AUTHORIZED_USER_IDS" done log "Run the following to update your monkeysphere authorized_keys file:" log "$PGRM update-authorized_keys" @@ -175,7 +175,7 @@ case $COMMAND in failure "you must specify at least one userid." fi for userID ; do - remove_userid "$userID" + remove_userid "$userID" "$AUTHORIZED_USER_IDS" done log "Run the following to update your monkeysphere authorized_keys file:" log "$PGRM update-authorized_keys" @@ -191,7 +191,7 @@ case $COMMAND in # process authorized_user_ids file log "processing authorized_user_ids file..." - process_authorized_user_ids + process_authorized_user_ids "$AUTHORIZED_USER_IDS" log "authorized_keys file updated." ;; diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 96a1070..bfd5db8 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -139,6 +139,7 @@ GNUPGHOME=${GNUPGHOME:-"${MS_HOME}/gnupg"} KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"} CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"} REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"} +AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"%h/.config/monkeysphere/authorized_user_ids"} USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"} export GNUPGHOME @@ -153,40 +154,44 @@ mkdir -p "${CACHE}/authorized_keys" case $COMMAND in 'update-users'|'update-user'|'s') if [ "$1" ] ; then + # get users from command line unames="$@" else - unames=$(ls -1 "${MS_HOME}/authorized_user_ids") + # or just look at all users if none specified + unames=$(getent passwd | cut -d: -f1) fi + # loop over users for uname in $unames ; do MODE="authorized_keys" + # set authorized_user_ids variable, + # translate ssh-style path variables + authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") + + # skip user if authorized_user_ids file does not exist + if [ ! -f "$authorizedUserIDs" ] ; then + continue + fi + log "----- user: $uname -----" - # set variables for the user - AUTHORIZED_USER_IDS="${MS_HOME}/authorized_user_ids/${uname}" # temporary authorized_keys file - AUTHORIZED_KEYS="${CACHE}/authorized_keys/${uname}.tmp" - - # make sure user's authorized_user_ids file exists - touch "$AUTHORIZED_USER_IDS" - # make sure the authorized_keys file exists and is clear - > "$AUTHORIZED_KEYS" + AUTHORIZED_KEYS=$(mktemp) # skip if the user's authorized_user_ids file is empty - if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then - log "authorized_user_ids file for '$uname' is empty." + if [ ! -s "$authorizedUserIDs" ] ; then + log "authorized_user_ids file '$authorizedUserIDs' is empty." continue fi # process authorized_user_ids file log "processing authorized_user_ids file..." - process_authorized_user_ids + process_authorized_user_ids "$authorizedUserIDs" # add user-controlled authorized_keys file path if specified if [ "$USER_CONTROLLED_AUTHORIZED_KEYS" != '-' ] ; then - userHome=$(getent passwd "$uname" | cut -d: -f6) - userAuthorizedKeys=${USER_CONTROLLED_AUTHORIZED_KEYS/\%h/"$userHome"} + userAuthorizedKeys=$(translate_ssh_variables "$uname" "$USER_CONTROLLED_AUTHORIZED_KEYS") if [ -f "$userAuthorizedKeys" ] ; then log -n "adding user's authorized_keys file... " cat "$userAuthorizedKeys" >> "$AUTHORIZED_KEYS" @@ -195,7 +200,7 @@ case $COMMAND in fi # move the temp authorized_keys file into place - mv -f "${CACHE}/authorized_keys/${uname}.tmp" "${CACHE}/authorized_keys/${uname}" + mv -f "$AUTHORIZED_KEYS" "${CACHE}/authorized_keys/${uname}" log "authorized_keys file updated." done @@ -236,15 +241,16 @@ case $COMMAND in failure "You must specify at least one user ID." fi - # set variables for the user - AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" + # set authorized_user_ids variable, + # translate ssh-style path variables + authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") # make sure user's authorized_user_ids file exists - touch "$AUTHORIZED_USER_IDS" + touch "$authorizedUserIDs" # process the user IDs for userID ; do - update_userid "$userID" + update_userid "$userID" "$authorizedUserIDs" done log "Run the following to update user's authorized_keys file:" @@ -261,15 +267,18 @@ case $COMMAND in failure "You must specify at least one user ID." fi - # set variables for the user - AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname" + # set authorized_user_ids variable, + # translate ssh-style path variables + authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") # make sure user's authorized_user_ids file exists - touch "$AUTHORIZED_USER_IDS" + if [ ! -f "$authorizedUserIDs" ] ; then + failure "authorized_user_ids file '$authorizedUserIDs' does not exist." + fi # process the user IDs for userID ; do - remove_userid "$userID" + remove_userid "$userID" "$authorizedUserIDs" done log "Run the following to update user's authorized_keys file:" diff --git a/src/monkeysphere-ssh-proxycommand b/src/monkeysphere-ssh-proxycommand index 4cbcd51..f4d4b0d 100755 --- a/src/monkeysphere-ssh-proxycommand +++ b/src/monkeysphere-ssh-proxycommand @@ -49,7 +49,7 @@ if [ "$PORT" != '22' ] ; then fi # if the host is in the gpg keyring... -if gpg --list-key ="${URI}" >/dev/null ; then +if gpg --list-key ="${URI}" 2>&1 >/dev/null ; then # do not check the keyserver CHECK_KEYSERVER="false" # if the host is NOT in the keyring... -- cgit v1.2.3 From fe0e35fa72edb5bbb9e2026b8e5c920a5c3f6a86 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 15:28:16 -0400 Subject: added comments to seckey2sshagent. --- src/seckey2sshagent | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/seckey2sshagent b/src/seckey2sshagent index 0e8d695..d8e9b79 100755 --- a/src/seckey2sshagent +++ b/src/seckey2sshagent @@ -1,5 +1,20 @@ #!/bin/sh +# seckey2sshagent: this is a hack of a script to cope with the fact +# that openpgp2ssh currently cannot support encrypted secret keys. + +# the basic operating principal is: + +# export the secret key in encrypted format to a new keyring + +# remove the passphrase in that keyring + +# use that keyring with openpgp2ssh + +# Authors: Daniel Kahn Gillmor , +# Jameson Rollins + + cleanup() { echo -n "removing temp gpg home... " rm -rf $FOO -- cgit v1.2.3 From f511119f57f076147acb2b5dccae597b34df6c8d Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Thu, 19 Jun 2008 16:57:09 -0400 Subject: Remove {update,remove}-userids functions, since we decided they weren't worth it. Updated man pages as well. --- debian/changelog | 4 ++- man/man1/monkeysphere-ssh-proxycommand.1 | 30 +++++++++++----- man/man1/monkeysphere.1 | 21 +----------- man/man8/monkeysphere-server.8 | 11 ++---- src/common | 50 --------------------------- src/monkeysphere | 24 ------------- src/monkeysphere-server | 59 +------------------------------- 7 files changed, 28 insertions(+), 171 deletions(-) diff --git a/debian/changelog b/debian/changelog index 9bfcc26..726f262 100644 --- a/debian/changelog +++ b/debian/changelog @@ -7,8 +7,10 @@ monkeysphere (0.2-1) UNRELEASED; urgency=low * Add AUTHORIZED_USER_IDS config variable for server, which defaults to %h/.config/monkeysphere/authorized_user_ids, instead of /etc/monkeysphere/authorized_user_ids. + * Remove {update,remove}-userids functions, since we decided they + weren't useful enough to be worth maintaining. - -- Jameson Graef Rollins Thu, 19 Jun 2008 15:22:05 -0400 + -- Jameson Graef Rollins Thu, 19 Jun 2008 16:56:32 -0400 monkeysphere (0.1-1) experimental; urgency=low diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1 index 5fabb91..c4196f2 100644 --- a/man/man1/monkeysphere-ssh-proxycommand.1 +++ b/man/man1/monkeysphere-ssh-proxycommand.1 @@ -18,17 +18,29 @@ or by adding the following line to your ~/.ssh/config script: .B ProxyCommand monkeysphere-ssh-proxycommand %h %p -The script is very simple, and can easily be incorporated into other -ProxyCommand scripts. It first tests to see if the host is in the -known_hosts file. If it's not, the CHECK_KEYSERVER variable is set to -true and "update-known_hosts" is run for the host to check for a host -key for that host. If the host is found in the known_hosts file, -CHECK_KEYSERVER is set to false and "update-known_hosts" is run to -update from the local keychain. +The script can easily be incorporated into other ProxyCommand scripts +by calling it with the "--no-connect" option, ie: -Run the following command for more info: +.B monkeysphere-ssh-proxycommand --no-connect "$HOST" "$PORT" -.B less $(which monkeysphere-ssh-proxycommand) +This will run everything but will not exec netcat to make the tcp +connection to the host. + +.SH KEYSERVER CHECKING + +The proxy command has a fairly nuanced policy for when keyservers are +queried when processing host. If the host userID is not found in +either the user's keyring or in the known_hosts file, then the +keyserver is queried for the host userID. If the host userID is found +in the user's keyring, then the keyserver is not checked. This is +because... If the host userID is not found in the user's keyring, but +the host is listed in the known_hosts file, then defered check is +scheduled. + +.SH ENVIRONMENT VARIABLES + +.TP +KEYSERVER The keyserver to query. .SH AUTHOR diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1 index f36d69e..30e35bb 100644 --- a/man/man1/monkeysphere.1 +++ b/man/man1/monkeysphere.1 @@ -33,20 +33,6 @@ is done. If no hosts are specified, all hosts listed in the known_hosts file will be processed. `k' may be used in place of `update-known_hosts'. .TP -.B update-userids [USERID]... -Add/update a user ID to the authorized_user_ids file. The user IDs -specified should be exact matches to OpenPGP user IDs. For each -specified user ID, gpg will be queried for a key associated with that -user ID, querying a keyserver if specified. If a key is found, the -user ID will be added to the user's authorized_user_ids file (if it -wasn't already present). `u' may be used in place of -`update-userids'. -.TP -.B remove-userids [USERID]... -Remove a user ID from the authorized_user_ids file. The user IDs -specified should be exact matches to OpenPGP user IDs. `r' may be -used in place of `remove-userids'. -.TP .B update-authorized_keys Update the monkeysphere authorized_keys file. For each user ID in the user's authorized_user_ids file, gpg will be queried for keys @@ -78,9 +64,7 @@ specification for the host, ie. "ssh://host.full.domain". GPG keys are considered acceptable if the following criteria are met: .TP .B capability -For host keys, the key must have both the "authentication" ("a") and -"encrypt" ("e") capability flags. For user keys, the key must have -the "authentication" ("a") capability flag. +The key must have the "authentication" ("a") usage flag set. .TP .B validity The key must be "fully" valid, and must not be expired or revoked. @@ -97,9 +81,6 @@ System-wide monkeysphere config file. ~/.config/monkeysphere/authorized_user_ids OpenPGP user IDs associated with keys that will be checked for addition to the authorized_keys file. -.TP -~/.config/monkeysphere/authorized_keys -Monkeysphere generated authorized_keys file. .SH AUTHOR diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index 28149fb..3073adc 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -23,7 +23,8 @@ be used for authentication of ssh connections. .TP .B update-users [USER]... Update the admin-controlled authorized_keys files for user. For each -user specified, update the user's authorized_keys file in +user specified, user ID's listed in the user's authorized_user_ids +file are processed, and the user's authorized_keys file in /var/cache/monkeysphere/authorized_keys/USER. See `man monkeysphere' for more info. If the USER_CONTROLLED_AUTHORIZED_KEYS variable is set, then a user-controlled authorized_keys file (usually @@ -46,14 +47,6 @@ of `publish-key'. Mark key specified with key IDs with full owner trust. `t' may be used in place of `trust-keys'. .TP -.B update-user-userids USER USERID... -Add/update a user ID to the authorized_user_ids file for USER. `u' may -be used in place of `update-user-userids'. -.TP -.B remove-user-userids USER USERID... -Remove a user ID from the authorized_user_ids file for USER. `r' may -be used in place of `remove-user-userids'. -.TP .B help Output a brief usage summary. `h' or `?' may be used in place of `help'. diff --git a/src/common b/src/common index 89efc46..00ee7b0 100644 --- a/src/common +++ b/src/common @@ -369,56 +369,6 @@ process_user_id() { done } -# update the cache for userid, and prompt to add file to -# authorized_user_ids file if the userid is found in gpg -# and not already in file. -update_userid() { - local userID - - userID="$1" - authorizedUserIDs="$2" - - log "processing userid: '$userID'" - - # process the user ID to pull it from keyserver - process_user_id "$userID" | grep -q "^0 " - - # check if user ID is in the authorized_user_ids file - if ! grep -q "^${userID}\$" "$authorizedUserIDs" ; then - read -p "user ID not currently authorized. authorize? [Y|n]: " OK; OK=${OK:=Y} - if [ ${OK/y/Y} = 'Y' ] ; then - # add if specified - log -n " adding user ID to authorized_user_ids file... " - echo "$userID" >> "$authorizedUserIDs" - loge "done." - else - # else do nothing - log " authorized_user_ids file untouched." - fi - fi -} - -# remove a userid from the authorized_user_ids file -remove_userid() { - local userID - - userID="$1" - authorizedUserIDs="$2" - - log "processing userid: '$userID'" - - # check if user ID is in the authorized_user_ids file - if ! grep -q "^${userID}\$" "$authorizedUserIDs" ; then - log " user ID not currently authorized." - return 1 - fi - - # remove user ID from file - log -n " removing user ID '$userID'... " - remove_line "$authorizedUserIDs" "^${userID}$" - loge "done." -} - # process a host in known_host file process_host_known_hosts() { local host diff --git a/src/monkeysphere b/src/monkeysphere index a9c9d58..a433701 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -35,8 +35,6 @@ MonkeySphere client tool. subcommands: update-known_hosts (k) [HOST]... update known_hosts file - update-userids (u) [USERID]... add/update user IDs - remove-userids (r) [USERID]... remove user IDs update-authorized_keys (a) update authorized_keys file gen-subkey (g) KEYID generate an 'a' capable subkey help (h,?) this help @@ -159,28 +157,6 @@ case $COMMAND in fi ;; - 'update-userids'|'update-userid'|'u') - if [ -z "$1" ] ; then - failure "you must specify at least one userid." - fi - for userID ; do - update_userid "$userID" "$AUTHORIZED_USER_IDS" - done - log "Run the following to update your monkeysphere authorized_keys file:" - log "$PGRM update-authorized_keys" - ;; - - 'remove-userids'|'remove-userid'|'r') - if [ -z "$1" ] ; then - failure "you must specify at least one userid." - fi - for userID ; do - remove_userid "$userID" "$AUTHORIZED_USER_IDS" - done - log "Run the following to update your monkeysphere authorized_keys file:" - log "$PGRM update-authorized_keys" - ;; - 'update-authorized_keys'|'update-authorized-keys'|'a') MODE='authorized_keys' diff --git a/src/monkeysphere-server b/src/monkeysphere-server index bfd5db8..154c146 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -31,14 +31,11 @@ usage: $PGRM [args] MonkeySphere server admin tool. subcommands: + update-users (s) [USER]... update users authorized_keys files gen-key (g) [HOSTNAME] generate gpg key for the server show-fingerprint (f) show server's host key fingerprint publish-key (p) publish server key to keyserver trust-keys (t) KEYID... mark keyids as trusted - - update-users (s) [USER]... update users authorized_keys files - update-user-userids (u) USER UID... add/update user IDs for a user - remove-user-userids (r) USER UID... remove user IDs for a user help (h,?) this help EOF @@ -231,60 +228,6 @@ case $COMMAND in done ;; - 'update-user-userids'|'update-user-userid'|'u') - uname="$1" - shift - if [ -z "$uname" ] ; then - failure "You must specify user." - fi - if [ -z "$1" ] ; then - failure "You must specify at least one user ID." - fi - - # set authorized_user_ids variable, - # translate ssh-style path variables - authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") - - # make sure user's authorized_user_ids file exists - touch "$authorizedUserIDs" - - # process the user IDs - for userID ; do - update_userid "$userID" "$authorizedUserIDs" - done - - log "Run the following to update user's authorized_keys file:" - log "$PGRM update-users $uname" - ;; - - 'remove-user-userids'|'remove-user-userid'|'r') - uname="$1" - shift - if [ -z "$uname" ] ; then - failure "You must specify user." - fi - if [ -z "$1" ] ; then - failure "You must specify at least one user ID." - fi - - # set authorized_user_ids variable, - # translate ssh-style path variables - authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") - - # make sure user's authorized_user_ids file exists - if [ ! -f "$authorizedUserIDs" ] ; then - failure "authorized_user_ids file '$authorizedUserIDs' does not exist." - fi - - # process the user IDs - for userID ; do - remove_userid "$userID" "$authorizedUserIDs" - done - - log "Run the following to update user's authorized_keys file:" - log "$PGRM update-users $uname" - ;; - 'help'|'h'|'?') usage ;; -- cgit v1.2.3 From 7019354a75ca19ffd2e10f2e2b3dc89b480156bd Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Thu, 19 Jun 2008 18:09:41 -0400 Subject: Better handling of unknown users in server update-users. Updated TODO file. --- debian/changelog | 3 ++- doc/TODO | 21 +++------------------ doc/george/user-id-configuration | 7 ------- src/common | 13 ++++++++++--- src/monkeysphere-server | 10 ++++++++-- 5 files changed, 23 insertions(+), 31 deletions(-) diff --git a/debian/changelog b/debian/changelog index 726f262..bd12e1a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -9,8 +9,9 @@ monkeysphere (0.2-1) UNRELEASED; urgency=low /etc/monkeysphere/authorized_user_ids. * Remove {update,remove}-userids functions, since we decided they weren't useful enough to be worth maintaining. + * Better handling of unknown users in server update-users - -- Jameson Graef Rollins Thu, 19 Jun 2008 16:56:32 -0400 + -- Jameson Graef Rollins Thu, 19 Jun 2008 18:08:57 -0400 monkeysphere (0.1-1) experimental; urgency=low diff --git a/doc/TODO b/doc/TODO index 5cd9be9..a82f031 100644 --- a/doc/TODO +++ b/doc/TODO @@ -26,37 +26,22 @@ Streamline host key generation, publication, verification. See doc/george/host-key-publication for what dkg went through on 2008-06-19 -Streamline authorized_user_ids setup (including question of where - authorized_user_ids files should go). See - doc/george/user-id-configuration for what dkg went through on - 2008-06-19 - Ensure that authorized_user_ids are under as tight control as ssh expects from authorized_keys: we don't want monkeysphere to be a weak link in the filesystem. -What happens when there are no entries in the authorized_user_ids file - for a user? /var/cache/monkeysphere/authorized_keys/$USER.tmp - seems like it gets created and then left there. - What happens when a user account has no corresponding /etc/monkeysphere/authorized_user_ids/$USER file? What gets placed in /var/cache/monkeysphere/authorized_keys/$USER? It looks currently untouched, which could mean bad things for such a user. + - if authorized_user_ids is empty, then the user's authorized_keys + file will be also, unless the user-controlled authorized_keys file + is added. I believe this is expected, correct behavior. Consider the default permissions for /var/cache/monkeysphere/authorized_keys/* (and indeed the whole directory path leading up to that) -What should happen when an admin does - "monkeysphere-server update-users not_an_existent_user"? - currently, it adds - /etc/monkeysphere/authorized_user_ids/not_an_existent_user, which - seems rather wrong. - -is /var/cache/monkeysphere/authorized_keys/$USER.tmp guaranteed to - avoid collisions? Why not use a real mktemp file? - As an administrator, how do i reverse the effect of a "monkeysphere-server trust-keys" that i later decide i should not have run? diff --git a/doc/george/user-id-configuration b/doc/george/user-id-configuration index d42bfbd..9a7f4d2 100644 --- a/doc/george/user-id-configuration +++ b/doc/george/user-id-configuration @@ -33,13 +33,6 @@ and then modified /etc/ssh/sshd_config with: Some outstanding questions: - * why are the authorized_user_ids stored in /etc/ and not in people's - home directories? - - * why are authorized_user_ids managed with a special sub-command of - monkeysphere-server, instead of just being hand-managed files, the - way that authorized_keys are in stock openssh? - * Should we ship a scheduled monkeysphere-server update-users cron job automatically? diff --git a/src/common b/src/common index 00ee7b0..e98f1bc 100644 --- a/src/common +++ b/src/common @@ -18,10 +18,17 @@ ETC="/etc/monkeysphere" export ETC CACHE="/var/cache/monkeysphere" export CACHE +ERR=0 +export ERR ######################################################################## ### UTILITY FUNCTIONS +error() { + log "$1" + ERR=${2:-'1'} +} + failure() { echo "$1" >&2 exit ${2:-'1'} @@ -29,12 +36,12 @@ failure() { # write output to stderr log() { - echo -n "ms: " 1>&2 - echo "$@" 1>&2 + echo -n "ms: " >&2 + echo "$@" >&2 } loge() { - echo "$@" 1>&2 + echo "$@" >&2 } # cut out all comments(#) and blank lines from standard input diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 154c146..a9a9aed 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -162,6 +162,12 @@ case $COMMAND in for uname in $unames ; do MODE="authorized_keys" + # check all specified users exist + if ! getent passwd | cut -d: -f1 | grep -q "^${uname}$" ; then + error "----- unknown user '$uname' -----" + continue + fi + # set authorized_user_ids variable, # translate ssh-style path variables authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") @@ -201,8 +207,6 @@ case $COMMAND in log "authorized_keys file updated." done - - log "----- done. -----" ;; 'gen-key'|'g') @@ -237,3 +241,5 @@ case $COMMAND in Type '$PGRM help' for usage." ;; esac + +exit "$ERR" -- cgit v1.2.3 From 6d39b726c0742d46bb697612c13dd77628e8362c Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Thu, 19 Jun 2008 18:25:02 -0400 Subject: Fix for better way to check for user on system. --- src/monkeysphere-server | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/monkeysphere-server b/src/monkeysphere-server index a9a9aed..693c062 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -163,7 +163,7 @@ case $COMMAND in MODE="authorized_keys" # check all specified users exist - if ! getent passwd | cut -d: -f1 | grep -q "^${uname}$" ; then + if ! getent passwd "$uname" >/dev/null ; then error "----- unknown user '$uname' -----" continue fi -- cgit v1.2.3 From 0c4317405228723a2f7e8a6d3c3737af0dc85299 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 18:37:02 -0400 Subject: remove /etc/monkeysphere/authorized_user_ids directory from packaging since it is not used by default. --- debian/monkeysphere.dirs | 1 - 1 file changed, 1 deletion(-) diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs index bc8abcf..6e90899 100644 --- a/debian/monkeysphere.dirs +++ b/debian/monkeysphere.dirs @@ -2,4 +2,3 @@ usr/share/monkeysphere var/cache/monkeysphere var/cache/monkeysphere/authorized_keys etc/monkeysphere -etc/monkeysphere/authorized_user_ids -- cgit v1.2.3 From 736054b1c1d8e3433d709ea8bbeb1b8ac7257927 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 20 Jun 2008 00:44:36 -0400 Subject: add file locking to known_hosts and authorized_keys --- debian/changelog | 3 +- src/common | 102 +++++++++++++++++++++++++++++++------------------------ src/monkeysphere | 10 +++--- 3 files changed, 64 insertions(+), 51 deletions(-) diff --git a/debian/changelog b/debian/changelog index bd12e1a..2133d2d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -10,8 +10,9 @@ monkeysphere (0.2-1) UNRELEASED; urgency=low * Remove {update,remove}-userids functions, since we decided they weren't useful enough to be worth maintaining. * Better handling of unknown users in server update-users + * Add file locking when modifying known_hosts or authorized_keys - -- Jameson Graef Rollins Thu, 19 Jun 2008 18:08:57 -0400 + -- Jameson Graef Rollins Fri, 20 Jun 2008 00:43:44 -0400 monkeysphere (0.1-1) experimental; urgency=low diff --git a/src/common b/src/common index e98f1bc..7df6908 100644 --- a/src/common +++ b/src/common @@ -376,62 +376,79 @@ process_user_id() { done } -# process a host in known_host file -process_host_known_hosts() { +# process hosts in the known_host file +process_hosts_known_hosts() { local host local userID local ok local keyid local tmpfile - host="$1" - userID="ssh://${host}" - - log "processing host: $host" - - process_user_id "ssh://${host}" | \ - while read -r ok keyid ; do - sshKey=$(gpg2ssh "$keyid") - # remove the old host key line - remove_line "$KNOWN_HOSTS" "$sshKey" - # if key OK, add new host line - if [ "$ok" -eq '0' ] ; then - # hash if specified - if [ "$HASH_KNOWN_HOSTS" = 'true' ] ; then - # FIXME: this is really hackish cause ssh-keygen won't - # hash from stdin to stdout - tmpfile=$(mktemp) - ssh2known_hosts "$host" "$sshKey" > "$tmpfile" - ssh-keygen -H -f "$tmpfile" 2> /dev/null - cat "$tmpfile" >> "$KNOWN_HOSTS" - rm -f "$tmpfile" "${tmpfile}.old" - else - ssh2known_hosts "$host" "$sshKey" >> "$KNOWN_HOSTS" + # create a lockfile on known_hosts + lockfile-create "$KNOWN_HOSTS" + + for host ; do + log "processing host: $host" + + userID="ssh://${host}" + + process_user_id "ssh://${host}" | \ + while read -r ok keyid ; do + sshKey=$(gpg2ssh "$keyid") + # remove the old host key line + remove_line "$KNOWN_HOSTS" "$sshKey" + # if key OK, add new host line + if [ "$ok" -eq '0' ] ; then + # hash if specified + if [ "$HASH_KNOWN_HOSTS" = 'true' ] ; then + # FIXME: this is really hackish cause ssh-keygen won't + # hash from stdin to stdout + tmpfile=$(mktemp) + ssh2known_hosts "$host" "$sshKey" > "$tmpfile" + ssh-keygen -H -f "$tmpfile" 2> /dev/null + cat "$tmpfile" >> "$KNOWN_HOSTS" + rm -f "$tmpfile" "${tmpfile}.old" + else + ssh2known_hosts "$host" "$sshKey" >> "$KNOWN_HOSTS" + fi fi - fi + done + # touch the lockfile, for good measure. + lockfile-touch --oneshot "$KNOWN_HOSTS" done + + # remove the lockfile + lockfile-remove "$KNOWN_HOSTS" } -# process a uid in an authorized_keys file -process_uid_authorized_keys() { +# process uids for the authorized_keys file +process_uids_authorized_keys() { local userID local ok local keyid - userID="$1" + # create a lockfile on authorized_keys + lockfile-create "$AUTHORIZED_KEYS" - log "processing user ID: $userID" + for userID ; do + log "processing user ID: $userID" - process_user_id "$userID" | \ - while read -r ok keyid ; do - sshKey=$(gpg2ssh "$keyid") - # remove the old host key line - remove_line "$AUTHORIZED_KEYS" "$sshKey" - # if key OK, add new host line - if [ "$ok" -eq '0' ] ; then - ssh2authorized_keys "$userID" "$sshKey" >> "$AUTHORIZED_KEYS" - fi + process_user_id "$userID" | \ + while read -r ok keyid ; do + sshKey=$(gpg2ssh "$keyid") + # remove the old host key line + remove_line "$AUTHORIZED_KEYS" "$sshKey" + # if key OK, add new host line + if [ "$ok" -eq '0' ] ; then + ssh2authorized_keys "$userID" "$sshKey" >> "$AUTHORIZED_KEYS" + fi + done + # touch the lockfile, for good measure. + lockfile-touch --oneshot "$AUTHORIZED_KEYS" done + + # remove the lockfile + lockfile-remove "$AUTHORIZED_KEYS" } # process known_hosts file @@ -446,10 +463,7 @@ process_known_hosts() { cat "$KNOWN_HOSTS" | meat | \ cut -d ' ' -f 1 | grep -v '^|.*$' | \ while IFS=, read -r -a hosts ; do - # and process each host - for host in ${hosts[*]} ; do - process_host_known_hosts "$host" - done + process_hosts_known_hosts ${hosts[@]} done } @@ -461,7 +475,7 @@ process_authorized_user_ids() { cat "$authorizedUserIDs" | meat | \ while read -r userid ; do - process_uid_authorized_keys "$userid" + process_uids_authorized_keys "$userid" done } diff --git a/src/monkeysphere b/src/monkeysphere index a433701..58f0fdc 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -140,12 +140,9 @@ case $COMMAND in # if hosts are specified on the command line, process just # those hosts if [ "$1" ] ; then - for host ; do - process_host_known_hosts "$host" - done - log "known_hosts file updated." + process_hosts_known_hosts "$@" - # otherwise, if no hosts are specified, process every user + # otherwise, if no hosts are specified, process every host # in the user's known_hosts file else if [ ! -s "$KNOWN_HOSTS" ] ; then @@ -153,8 +150,9 @@ case $COMMAND in fi log "processing known_hosts file..." process_known_hosts - log "known_hosts file updated." fi + + log "known_hosts file updated." ;; 'update-authorized_keys'|'update-authorized-keys'|'a') -- cgit v1.2.3 From c6a958a369c58ec78f380fc739d75ff465b61c6a Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 20 Jun 2008 14:00:42 -0400 Subject: touched /etc/environment on george. --- doc/george/changelog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/doc/george/changelog b/doc/george/changelog index 6dc3a29..9992aae 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -7,6 +7,10 @@ * changes to this system * ****************************************************************************** +2008-06-20 - dkg + * touched /etc/environment to get rid of some spurious auth.log + entries. + 2008-06-19 - dkg * installed rsync (for maintaining a public apt repo) -- cgit v1.2.3 From 9efdaab59edb2ff4454082f6a36c9dc0d90b8885 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 20 Jun 2008 14:04:28 -0400 Subject: bumped up ssh logging on george. --- doc/george/changelog | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/george/changelog b/doc/george/changelog index 9992aae..c157cec 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -10,6 +10,7 @@ 2008-06-20 - dkg * touched /etc/environment to get rid of some spurious auth.log entries. + * turned up sshd's LogLevel from INFO to DEBUG 2008-06-19 - dkg * installed rsync (for maintaining a public apt repo) -- cgit v1.2.3