From 617f03c948b66774e6765206bed2c56d30157187 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Fri, 15 Aug 2008 14:44:18 -0400 Subject: first pass at revoking hostnames. --- src/common | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/common') diff --git a/src/common b/src/common index 17955a7..24decae 100644 --- a/src/common +++ b/src/common @@ -76,6 +76,13 @@ unescape() { echo "$1" | sed 's/\\x3a/:/g' } +# convert nasty chars into gpg-friendly form +# FIXME: escape everything, not just colons! +escape() { + echo "$1" | sed 's/:/\\x3a/g' +} + + # remove all lines with specified string from specified file remove_line() { local file -- cgit v1.2.3 From 8cf936aa9d62f6e8655904375a2d8217f559947a Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Fri, 15 Aug 2008 13:02:05 -0700 Subject: more work on hostname add/revoke --- src/common | 13 ++++---- src/monkeysphere-server | 89 +++++++++++++++++++++++++++++++++++++++++-------- 2 files changed, 82 insertions(+), 20 deletions(-) (limited to 'src/common') diff --git a/src/common b/src/common index 17955a7..34c86cb 100644 --- a/src/common +++ b/src/common @@ -69,11 +69,12 @@ file_hash() { md5sum "$1" 2> /dev/null } -# convert escaped characters from gpg output back into original -# character -# FIXME: undo all escape character translation in with-colons gpg output -unescape() { - echo "$1" | sed 's/\\x3a/:/g' +# convert escaped characters in pipeline from gpg output back into +# original character +# FIXME: undo all escape character translation in with-colons gpg +# output +gpg_unescape() { + sed 's/\\x3a/:/g' } # remove all lines with specified string from specified file @@ -398,7 +399,7 @@ process_user_id() { continue fi # if the user ID does not match, skip - if [ "$(unescape "$uidfpr")" != "$userID" ] ; then + if [ "$(echo "$uidfpr" | gpg_unescape)" != "$userID" ] ; then continue fi # if the user ID validity is not ok, skip diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 023ce9b..31bce7d 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -100,17 +100,19 @@ gpg_authentication() { su_monkeysphere_user "gpg $@" } -# output key information -show_server_key() { - gpg_host --list-secret-keys --fingerprint -} - # output just key fingerprint fingerprint_server_key() { gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \ grep '^fpr:' | head -1 | cut -d: -f10 } +# output key information +show_server_key() { + local fingerprint + fingerprint=$(fingerprint_server_key) + gpg_host --fingerprint --list-secret-key "$fingerprint" +} + # update authorized_keys for users update_users() { if [ "$1" ] ; then @@ -371,52 +373,111 @@ EOF # add hostname user ID to server key add_hostname() { + local userID + local fingerprint + local adduidCommand + if [ -z "$1" ] ; then failure "You must specify a hostname to add." fi userID="ssh://${1}" - if [ "$(gpg_host --list-key "=${userID}")" ] ; then + if [ "$(gpg_host --list-key "=${userID}" 2> /dev/null)" ] ; then failure "Host userID '$userID' already exists." fi + echo "The following user ID will be added to the host key:" + echo " '$userID'" + read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N} + if [ ${OK/y/Y} != 'Y' ] ; then + failure "user ID not added." + fi + fingerprint=$(fingerprint_server_key) + # edit-key script command to add user ID adduidCommand=$(cat < /dev/null | \ + egrep "^(uid|uat):" | cut -d: -f10 | gpg_unescape | cat -n | \ + grep "$userID" | awk '{ print $1 }') + + if [ -z "$uidIndex" ] ; then + failure "User ID '$userID' not found in host key." + fi - echo "NOTE: host userID revokation has not been published." - echo "Use '$PGRM publish-key' to publish these changes." + echo "The following user ID will be revoked from the host key:" + echo " '$userID'" + read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N} + if [ ${OK/y/Y} != 'Y' ] ; then + failure "user ID not revoked." + fi + + # edit-key script command to revoke user ID + revuidCommand=$(cat < Date: Mon, 18 Aug 2008 10:13:42 -0700 Subject: fixed bad bug in user id processing that prevented bad primary keys from being properly handled. --- debian/changelog | 7 +++++++ src/common | 25 ++++++++++--------------- 2 files changed, 17 insertions(+), 15 deletions(-) (limited to 'src/common') diff --git a/debian/changelog b/debian/changelog index ecb2f16..828973f 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +monkeysphere (0.9-1) experimental; urgency=low + + * fixed bug in user id processing that prevented bad primary keys from + being properly removed. + + -- Jameson Graef Rollins Mon, 18 Aug 2008 10:13:36 -0700 + monkeysphere (0.8-1) experimental; urgency=low [ Daniel Kahn Gillmor ] diff --git a/src/common b/src/common index bb988f7..9a03b9c 100644 --- a/src/common +++ b/src/common @@ -393,29 +393,24 @@ process_user_id() { ;; 'uid') # user ids if [ "$lastKey" != pub ] ; then - log " - got a user ID after a sub key! user IDs should only follow primary keys!" - continue - fi - # don't bother with a uid if there is no valid or reasonable primary key. - if [ "$keyOK" != true ] ; then + log " - got a user ID after a sub key?! user IDs should only follow primary keys!" continue fi # if an acceptable user ID was already found, skip - if [ "$uidOK" ] ; then - continue - fi - # if the user ID does not match, skip - if [ "$(echo "$uidfpr" | gpg_unescape)" != "$userID" ] ; then + if [ "$uidOK" = 'true' ] ; then continue fi - # if the user ID validity is not ok, skip - if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + # if the user ID does matches... + if [ "$(echo "$uidfpr" | gpg_unescape)" = "$userID" ] ; then + # and the user ID validity is ok + if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + # mark user ID acceptable + uidOK=true + fi + else continue fi - # mark user ID acceptable - uidOK=true - # output a line for the primary key # 0 = ok, 1 = bad if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then -- cgit v1.2.3 From d8ece7d101fb16c99dfcc1224cc48f2c9cd4024d Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Mon, 18 Aug 2008 15:21:11 -0400 Subject: added 'monkeysphere-server extend-key' subcommand --- debian/changelog | 7 +++++- man/man8/monkeysphere-server.8 | 29 +++++++++++++++++------ src/common | 22 +++++++++++++++++ src/monkeysphere-server | 54 ++++++++++++++++++++++++++++-------------- 4 files changed, 86 insertions(+), 26 deletions(-) (limited to 'src/common') diff --git a/debian/changelog b/debian/changelog index 828973f..40172aa 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,9 +1,14 @@ monkeysphere (0.9-1) experimental; urgency=low + [ Daniel Kahn Gillmor ] + * implemented "monkeysphere-server extend-key" to adjust expiration + dates. + + [ Jameson Graef Rollins ] * fixed bug in user id processing that prevented bad primary keys from being properly removed. - -- Jameson Graef Rollins Mon, 18 Aug 2008 10:13:36 -0700 + -- Daniel Kahn Gillmor Mon, 18 Aug 2008 14:59:56 -0400 monkeysphere (0.8-1) experimental; urgency=low diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index 8e7278b..416cc87 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -36,13 +36,28 @@ specified, then all accounts on the system are processed. `u' may be used in place of `update-users'. .TP .B gen-key [HOSTNAME] -Generate a OpenPGP key pair for the host. If HOSTNAME is not -specified, then the system fully-qualified domain name will be user. -An alternate key bit length can be specified with the `-l' or -`--length' option (default 2048). An expiration length can be -specified with the `-e' or `--expire' option (prompt otherwise). A -key revoker fingerprint can be specified with the `-r' or `--revoker' -option. `g' may be used in place of `gen-key'. +Generate a OpenPGP key for the host. If HOSTNAME is not specified, +then the system fully-qualified domain name will be user. An +alternate key bit length can be specified with the `-l' or `--length' +option (default 2048). An expiration length can be specified with the +`-e' or `--expire' option (prompt otherwise). The expiration format +is the same as that of \fBextend-key\fP, below. A key revoker +fingerprint can be specified with the `-r' or `--revoker' option. `g' +may be used in place of `gen-key'. +.TP +.B extend-key EXPIRE +Extend the validity of the OpenPGP key for the host until EXPIRE from +the present. If EXPIRE is not specified, then the user will be +prompted for the extension term. Expiration is specified like GnuPG +does: +.nf + 0 = key does not expire + = key expires in n days + w = key expires in n weeks + m = key expires in n months + y = key expires in n years +.fi +`e' may be used in place of `extend-key'. .TP .B add-hostname HOSTNAME Add a hostname user ID to the server host key. `n+' may be used in diff --git a/src/common b/src/common index 9a03b9c..54ea9cb 100644 --- a/src/common +++ b/src/common @@ -83,6 +83,28 @@ gpg_escape() { sed 's/:/\\x3a/g' } +# prompt for GPG-formatted expiration, and emit result on stdout +get_gpg_expiration() { + local keyExpire= + + cat >&2 < = key expires in n days + w = key expires in n weeks + m = key expires in n months + y = key expires in n years +EOF + while [ -z "$keyExpire" ] ; do + read -p "Key is valid for? (0) " keyExpire + if ! test_gpg_expire ${keyExpire:=0} ; then + echo "invalid value" >&2 + unset keyExpire + fi + done + echo "$keyExpire" +} + # remove all lines with specified string from specified file remove_line() { local file diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 052e6de..91e2121 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -4,6 +4,7 @@ # # The monkeysphere scripts are written by: # Jameson Rollins +# Daniel Kahn Gillmor # # They are Copyright 2008, and are all released under the GPL, version 3 # or later. @@ -43,6 +44,7 @@ subcommands: --length (-l) BITS key length in bits (2048) --expire (-e) EXPIRE date to expire --revoker (-r) FINGERPRINT add a revoker + extend-key (e) EXPIRE extend expiration to EXPIRE add-hostname (n+) NAME[:PORT] add hostname user ID to server key revoke-hostname (n-) NAME[:PORT] revoke hostname user ID show-key (s) output all server host key information @@ -296,22 +298,9 @@ gen_key() { # prompt about key expiration if not specified if [ -z "$keyExpire" ] ; then - cat < = key expires in n days - w = key expires in n weeks - m = key expires in n months - y = key expires in n years -EOF - while [ -z "$keyExpire" ] ; do - read -p "Key is valid for? (0) " keyExpire - if ! test_gpg_expire ${keyExpire:=0} ; then - echo "invalid value" - unset keyExpire - fi - done - elif ! test_gpg_expire "$keyExpire" ; then + keyExpire=$(get_gpg_expiration) + fi + if ! test_gpg_expire "$keyExpire" ; then failure "invalid key expiration value '$keyExpire'." fi @@ -373,6 +362,31 @@ EOF log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key" } +# extend the lifetime of a host key: +extend_key() { + local fpr=$(fingerprint_server_key) + local extendTo="$1" + + if [ -z "$fpr" ] ; then + failure "You don't appear to have a MonkeySphere host key on this server. Try 'monkeysphere-server gen-key' first." + fi + + if [ -z "$extendTo" ]; then + extendTo=$(get_gpg_expiration) + fi + if ! test_gpg_expire "$extendTo" ; then + failure "invalid expiration value '$extendTo'." + fi + + gpg_host --quiet --command-fd 0 --edit-key "$fpr" < Date: Mon, 18 Aug 2008 13:16:21 -0700 Subject: stupid big jimmy. fix bug in previous bug fix. --- debian/changelog | 6 ++++++ src/common | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) (limited to 'src/common') diff --git a/debian/changelog b/debian/changelog index 9d2a13d..7e1af90 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +monkeysphere (0.10-1) experimental; urgency=low + + * Fix bug in previous uid processing bug fix (stupid stupid). + + -- Jameson Graef Rollins Mon, 18 Aug 2008 13:16:15 -0700 + monkeysphere (0.9-1) experimental; urgency=low [ Daniel Kahn Gillmor ] diff --git a/src/common b/src/common index 54ea9cb..9d7deb7 100644 --- a/src/common +++ b/src/common @@ -425,7 +425,7 @@ process_user_id() { # if the user ID does matches... if [ "$(echo "$uidfpr" | gpg_unescape)" = "$userID" ] ; then # and the user ID validity is ok - if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then + if [ "$validity" = 'u' -o "$validity" = 'f' ] ; then # mark user ID acceptable uidOK=true fi -- cgit v1.2.3