From ca88f1bccc252571c1f40ed84c40ea7ed4d7db20 Mon Sep 17 00:00:00 2001 From: Jameson Rollins Date: Sun, 4 Jul 2010 00:06:35 -0400 Subject: add keys-for-user subcommand to monkeysphere-authentication This subcommand will output all valid key for a given user. The user's authorized_user_ids file will be read for OpenPGP user IDs, one per line. The ssh-formated RSA keys will be output to stdout. Also included is a simple script that takes the user as it's one argument and exec's this command. This is something that would be suitable for the proposed sshd AuthorizedKeysCommand. --- Makefile | 1 + man/man8/monkeysphere-authentication.8 | 7 +++- src/monkeysphere-authentication | 6 ++++ src/monkeysphere-authentication-keys-for-user | 2 ++ src/share/ma/keys_for_user | 50 +++++++++++++++++++++++++++ 5 files changed, 65 insertions(+), 1 deletion(-) create mode 100755 src/monkeysphere-authentication-keys-for-user create mode 100644 src/share/ma/keys_for_user diff --git a/Makefile b/Makefile index 9f5028a..7662f7b 100755 --- a/Makefile +++ b/Makefile @@ -42,6 +42,7 @@ install: all installman printf "Monkeysphere %s\n" $(MONKEYSPHERE_VERSION) > $(DESTDIR)$(PREFIX)/share/monkeysphere/VERSION install src/monkeysphere $(DESTDIR)$(PREFIX)/bin install src/monkeysphere-host src/monkeysphere-authentication $(DESTDIR)$(PREFIX)/sbin + install src/monkeysphere-authentication-keys-for-user $(DESTDIR)$(PREFIX)/share/monkeysphere install -m 0644 src/share/common $(DESTDIR)$(PREFIX)/share/monkeysphere install -m 0644 src/share/defaultenv $(DESTDIR)$(PREFIX)/share/monkeysphere install -m 0755 src/share/checkperms $(DESTDIR)$(PREFIX)/share/monkeysphere diff --git a/man/man8/monkeysphere-authentication.8 b/man/man8/monkeysphere-authentication.8 index 7c12673..e9e24b0 100644 --- a/man/man8/monkeysphere-authentication.8 +++ b/man/man8/monkeysphere-authentication.8 @@ -1,4 +1,4 @@ -.TH MONKEYSPHERE-AUTHENTICATION "8" "January 2010" "monkeysphere" "System Commands" +.TH MONKEYSPHERE-AUTHENTICATION "8" "July 3, 2010" "monkeysphere" "System Commands" .SH NAME @@ -42,6 +42,11 @@ Refresh all keys in the monkeysphere-authentication keyring. If no accounts are specified, then all accounts on the system are processed. `r' may be used in place of `refresh\-keys'. .TP +.B keys\-for\-user USER +Output to stdout all acceptable keys for a given user. User IDs are +read from the user's authorized_user_ids file (see +MONKEYSPHERE_AUTHORIZED_USER_IDS below). +.TP .B add\-id\-certifier KEYID|FILE Instruct system to trust user identity certifications made by KEYID. The key ID will be loaded from the keyserver. A file may be loaded diff --git a/src/monkeysphere-authentication b/src/monkeysphere-authentication index 8c58645..af8c40d 100755 --- a/src/monkeysphere-authentication +++ b/src/monkeysphere-authentication @@ -55,6 +55,7 @@ Monkeysphere authentication admin tool. subcommands: update-users (u) [USER]... update user authorized_keys files refresh-keys (r) refresh keys in keyring + keys-for-user USER output valid keys for user add-id-certifier (c+) KEYID|FILE import and tsign a certification key [--domain (-n) DOMAIN] limit ID certifications to DOMAIN @@ -177,6 +178,11 @@ case $COMMAND in gpg_sphere "--keyserver $KEYSERVER --refresh-keys" ;; + 'keys-for-user') + source "${MASHAREDIR}/keys_for_user" + keys_for_user "$@" + ;; + 'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+') source "${MASHAREDIR}/setup" setup diff --git a/src/monkeysphere-authentication-keys-for-user b/src/monkeysphere-authentication-keys-for-user new file mode 100755 index 0000000..fb589ea --- /dev/null +++ b/src/monkeysphere-authentication-keys-for-user @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +exec monkeysphere-authentication keys-for-user "$@" diff --git a/src/share/ma/keys_for_user b/src/share/ma/keys_for_user new file mode 100644 index 0000000..f48d5d3 --- /dev/null +++ b/src/share/ma/keys_for_user @@ -0,0 +1,50 @@ +# -*-shell-script-*- +# This should be sourced by bash (though we welcome changes to make it POSIX sh compliant) + +# Monkeysphere authentication keys-for-user subcommand +# +# The monkeysphere scripts are written by: +# Jameson Rollins +# Daniel Kahn Gillmor +# +# They are Copyright 2008-2010, and are all released under the GPL, +# version 3 or later. + +# This command could be run as an sshd AuthorizedKeysCommand to +# provide the authorized keys for a user, based on OpenPGP user id's +# listed in the user's authorized_user_ids file. + +keys_for_user() { + +local uname +local authorizedUserIDs +local line +local userIDs + +# get users from command line +uname="$1" + +# path to authorized_user_ids file, translating ssh-style path +# variables +authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS") + +# exit if the authorized_user_ids file is empty +if [ ! -s "$authorizedUserIDs" ] ; then + failure "authorized_user_ids file '$authorizedUserIDs' is empty or does not exist." +fi + +log debug "authorized_user_ids file: $authorizedUserIDs" + +# check permissions on the authorized_user_ids file path +check_key_file_permissions "$uname" "$authorizedUserIDs" || failure + +GNUPGHOME="$GNUPGHOME_SPHERE" +export GNUPGHOME + +# extract user IDs from authorized_user_ids file +IFS=$'\n' +for line in $(meat "$authorizedUserIDs") ; do + su_monkeysphere_user ". ${SYSSHAREDIR}/common; keys_for_userid '$line'" +done + +} -- cgit v1.2.3