From bb35e6ff08dbd33d3f47e9c969eb3da3a9acf18d Mon Sep 17 00:00:00 2001
From: Jameson Graef Rollins <jrollins@phys.columbia.edu>
Date: Fri, 15 Aug 2008 00:33:27 -0700
Subject: add start of add/revoke-hostname functions.  revocation needs to be
 implemented.

---
 man/man8/monkeysphere-server.8 | 18 +++++++--
 src/monkeysphere-server        | 91 +++++++++++++++++++++++++++++++++++-------
 2 files changed, 91 insertions(+), 18 deletions(-)

diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8
index 74e9a10..8e7278b 100644
--- a/man/man8/monkeysphere-server.8
+++ b/man/man8/monkeysphere-server.8
@@ -44,9 +44,21 @@ specified with the `-e' or `--expire' option (prompt otherwise).  A
 key revoker fingerprint can be specified with the `-r' or `--revoker'
 option.  `g' may be used in place of `gen-key'.
 .TP
-.B show-fingerprint
-Show the fingerprint for the host's OpenPGP key.  `f' may be used in place of
-`show-fingerprint'.
+.B add-hostname HOSTNAME
+Add a hostname user ID to the server host key.  `n+' may be used in
+place of `add-hostname'.
+.TP
+.B revoke-hostname HOSTNAME
+Revoke a hostname user ID from the server host key.  `n-' may be used
+in place of `revoke-hostname'.
+.TP
+.B show-key
+Output gpg information about host's OpenPGP key.  `s' may be used in
+place of `show-key'.
+.TP
+.B fingerprint
+Output just the fingerprint for the host's OpenPGP key.  `f' may be
+used in place of `fingerprint'.
 .TP
 .B publish-key
 Publish the host's OpenPGP key to the keyserver.  `p' may be used in
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 21973dd..598c3f7 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -39,11 +39,14 @@ MonkeySphere server admin tool.
 subcommands:
  update-users (u) [USER]...          update user authorized_keys files
 
- gen-key (g) [HOSTNAME]              generate gpg key for the server
+ gen-key (g) [NAME[:PORT]]           generate gpg key for the server
    -l|--length BITS                    key length in bits (2048)
    -e|--expire EXPIRE                  date to expire
    -r|--revoker FINGERPRINT            add a revoker
- show-fingerprint (f)                show server host key fingerprint
+ add-hostname (n+) NAME[:PORT]       add hostname user ID to server key
+ revoke-hostname (n-) NAME[:PORT]    revoke hostname user ID
+ show-key (s)                        output all server host key information
+ fingerprint (f)                     output just the key fingerprint
  publish-key (p)                     publish server host key to keyserver
  diagnostics (d)                     report on server monkeysphere status
 
@@ -97,6 +100,17 @@ gpg_authentication() {
     su_monkeysphere_user "gpg $@"
 }
 
+# output key information
+show_server_key() {
+    gpg_host --list-secret-keys --fingerprint
+}
+
+# output just key fingerprint
+fingerprint_server_key() {
+    gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \
+	grep '^fpr:' | head -1 | cut -d: -f10
+}
+
 # update authorized_keys for users
 update_users() {
     if [ "$1" ] ; then
@@ -339,9 +353,8 @@ EOF
     # output the server fingerprint
     fingerprint_server_key "=${userID}"
 
-    # find the key fingerprint of the server primary key
-    fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
-	grep '^fpr:' | head -1 | cut -d: -f10)
+    # find the key fingerprint of the newly generated key
+    fingerprint=$(fingerprint_server_key)
 
     # export host ownertrust to authentication keyring
     log "setting ultimate owner trust for server key..."
@@ -356,9 +369,47 @@ EOF
     log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key"
 }
 
-# gpg output key fingerprint
-fingerprint_server_key() {
-    gpg_host --fingerprint --list-secret-keys
+# add hostname user ID to server key
+add_hostname() {
+    if [ -z "$1" ] ; then
+	failure "You must specify a hostname to add."
+    fi
+
+    userID="ssh://${1}"
+
+    if [ "$(gpg_host --list-key "=${userID}")" ] ; then
+	failure "Host userID '$userID' already exists."
+    fi
+
+    fingerprint=$(fingerprint_server_key)
+
+    adduidCommand=$(cat <<EOF
+adduid
+$userID
+
+
+O
+save
+EOF
+	)
+
+    # add uid
+    echo "$adduidCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
+
+    echo "NOTE: new host userID has not been published."
+    echo "Use '$PGRM publish-key' to publish these changes."
+}
+
+# revoke hostname user ID to server key
+revoke_hostname() {
+    if [ -z "$1" ] ; then
+	failure "You must specify a hostname to revoke."
+    fi
+
+    failure "Sorry, not yet implemented."
+
+    echo "NOTE: host userID revokation has not been published."
+    echo "Use '$PGRM publish-key' to publish these changes."
 }
 
 # publish server key to keyserver
@@ -392,7 +443,7 @@ diagnostics() {
     local fingerprint
     local badhostkeys
 
-    seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
+    seckey=$(fingerprint_server_key)
     keysfound=$(echo "$seckey" | grep -c ^sec:)
     curdate=$(date +%s)
     # warn when anything is 2 months away from expiration
@@ -500,8 +551,6 @@ diagnostics() {
 	echo "$badauthorizedkeys"
 	echo " - Recommendation: remove the above AuthorizedKeysFile lines from /etc/ssh/sshd_config"
     fi
-
-
 }
 
 # retrieve key from web of trust, import it into the host keyring, and
@@ -684,11 +733,23 @@ case $COMMAND in
 	gen_key "$@"
 	;;
 
-    'show-fingerprint'|'f')
+    'add-hostname'|'add-name'|'n+')
+	add_hostname "$@"
+	;;
+
+    'revoke-hostname'|'revoke-name'|'n-')
+	revoke_hostname "$@"
+	;;
+
+    'show-key'|'show'|'s')
+	show_server_key
+	;;
+
+    'show-fingerprint'|'fingerprint'|'f')
 	fingerprint_server_key
 	;;
 
-    'publish-key'|'p')
+    'publish-key'|'publish'|'p')
 	publish_server_key
 	;;
 
@@ -697,11 +758,11 @@ case $COMMAND in
 	;;
 
     'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
-	add_certifier "$1"
+	add_certifier "$@"
 	;;
 
     'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
-	remove_certifier "$1"
+	remove_certifier "$@"
 	;;
 
     'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
-- 
cgit v1.2.3