From f728df69bbb04ed21a437832c486590cc5a83684 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 9 Feb 2009 00:21:40 -0500 Subject: Break out host export commands into gpg_host_export and gpg_host_export_to_ssh_file functions, and update the {gen,import}_key functions accordingly. --- src/share/mh/gen_key | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'src/share/mh/gen_key') diff --git a/src/share/mh/gen_key b/src/share/mh/gen_key index eb951cf..c75ad65 100644 --- a/src/share/mh/gen_key +++ b/src/share/mh/gen_key @@ -79,15 +79,16 @@ chmod 700 "$GNUPGHOME_HOST" log verbose "generating host key..." echo "$keyParameters" | gpg_host --batch --gen-key -# find the key fingerprint of the newly generated key -fingerprint=$(fingerprint_host_key) +# find the key fingerprint of the newly converted key +HOST_FINGERPRINT=$(fingerprint_host_key) +export HOST_FINGERPRINT # translate the private key to ssh format, and export to a file # for sshs usage. # NOTE: assumes that the primary key is the proper key to use log debug "exporting new secret key to ssh format..." (umask 077 && \ - gpg_host --export-secret-key "$fingerprint" | \ + gpg_host --export-secret-key "$HOST_FINGERPRINT" | \ openpgp2ssh "$fingerprint" > "${MHDATADIR}/ssh_host_rsa_key") log info "SSH host private key output to file: ${MHDATADIR}/ssh_host_rsa_key" @@ -95,9 +96,8 @@ log debug "creating ssh public key..." ssh-keygen -y -f "${MHDATADIR}/ssh_host_rsa_key" > "${MHDATADIR}/ssh_host_rsa_key.pub" log info "SSH host public key output to file: ${MHDATADIR}/ssh_host_rsa_key.pub" -log debug "exporting openpgp public key..." -gpg_host --export-options export-minimal --armor --export "0x${fingerprint}!" > "${MHDATADIR}/ssh_host_rsa_key.pub.gpg" -log info "SSH host public key in OpenPGP form: ${MHDATADIR}/ssh_host_rsa_key.pub.gpg" +# export public key to file +gpg_host_export_to_ssh_file # show info about new key show_key -- cgit v1.2.3 From c0ab14d9df7959057a04f2ebd837c50e169c1c01 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 9 Feb 2009 00:30:04 -0500 Subject: a couple of small fixes to the {gen,import}_key functions --- src/share/mh/gen_key | 56 +++++++++++++++++-------------------------------- src/share/mh/import_key | 8 +++---- 2 files changed, 22 insertions(+), 42 deletions(-) (limited to 'src/share/mh/gen_key') diff --git a/src/share/mh/gen_key b/src/share/mh/gen_key index c75ad65..1f8e97e 100644 --- a/src/share/mh/gen_key +++ b/src/share/mh/gen_key @@ -13,19 +13,16 @@ gen_key() { +local hostName=$(hostname -f) local keyType="RSA" local keyLength="2048" local keyUsage="auth" local keyExpire="0" -local hostName=$(hostname -f) local userID -local keyParameters -local fingerprint -# check for presense of secret key -# FIXME: is this the proper test to be doing here? -fingerprint_host_key >/dev/null \ - && failure "An OpenPGP host key already exists." +# check for presense of a key +[ "$FINGERPRINT" ] && \ + failure "An OpenPGP host key already exists." # get options while true ; do @@ -39,45 +36,30 @@ while true ; do failure "Unknown option '$1'. Type '$PGRM help' for usage." fi - hostName="$1" - shift break ;; esac done +hostName="$1" userID="ssh://${hostName}" -# set key parameters -keyParameters=\ -"Key-Type: $keyType +# create host home +mkdir -p "$GNUPGHOME_HOST" +chmod 700 "$GNUPGHOME_HOST" + +log debug "generating host key..." +gpg_host --batch --gen-key < "${MHDATADIR}/ssh_host_rsa_key") + openpgp2ssh "$HOST_FINGERPRINT" > "${MHDATADIR}/ssh_host_rsa_key") log info "SSH host private key output to file: ${MHDATADIR}/ssh_host_rsa_key" log debug "creating ssh public key..." -ssh-keygen -y -f "${MHDATADIR}/ssh_host_rsa_key" > "${MHDATADIR}/ssh_host_rsa_key.pub" -log info "SSH host public key output to file: ${MHDATADIR}/ssh_host_rsa_key.pub" +ssh-keygen -y -f "${MHDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub" +log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub" # export public key to file gpg_host_export_to_ssh_file diff --git a/src/share/mh/import_key b/src/share/mh/import_key index 6a897b6..1efb1ac 100644 --- a/src/share/mh/import_key +++ b/src/share/mh/import_key @@ -15,12 +15,10 @@ import_key() { local hostName local userID -local fingerprint -# check for presence of secret key -# FIXME: is this the proper test to be doing here? -fingerprint_host_key >/dev/null \ - && failure "An OpenPGP host key already exists." +# check for presense of a key +[ "$FINGERPRINT" ] && \ + failure "An OpenPGP host key already exists." hostName=${1:-$(hostname -f)} -- cgit v1.2.3 From 69354c87864076343793fb270b296ccb89bf3759 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 9 Feb 2009 00:42:16 -0500 Subject: define variable for public key files (HOST_KEY_PUB, HOST_KEY_PUB_GPG). also, fix some function calls to check_host_fail function. --- src/monkeysphere-host | 36 +++++++++++++++++++++--------------- src/share/mh/gen_key | 4 ++-- 2 files changed, 23 insertions(+), 17 deletions(-) (limited to 'src/share/mh/gen_key') diff --git a/src/monkeysphere-host b/src/monkeysphere-host index bcb570b..3c2e3ee 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -14,6 +14,9 @@ ######################################################################## set -e +# set the pipefail option so pipelines fail on first command failure +set -o pipefail + PGRM=$(basename $0) SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"} @@ -106,15 +109,13 @@ gpg_host_export() { # export the host key to the monkeysphere host file key gpg_host_export_to_ssh_file() { log debug "exporting openpgp public key..." - gpg_host_export > "${MHDATADIR}/ssh_host_rsa_key.pub.gpg" - log info "SSH host public key in OpenPGP form: ${MHDATADIR}/ssh_host_rsa_key.pub.gpg" + + gpg_host_export > "$HOST_KEY_PUB_GPG" + log info "SSH host public key in OpenPGP form: $HOST_KEY_PUB_GPG" } # output just key fingerprint fingerprint_host_key() { - # set the pipefail option so functions fails if can't read sec key - set -o pipefail - gpg_host --list-secret-keys --fingerprint \ --with-colons --fixed-list-mode 2> /dev/null | \ grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null @@ -163,12 +164,13 @@ show_key() { echo "OpenPGP fingerprint: $HOST_FINGERPRINT" - if [ -f "${MHDATADIR}/ssh_host_rsa_key.pub" ] ; then - fingerprintSSH=$(ssh-keygen -l -f "${MHDATADIR}/ssh_host_rsa_key.pub" | \ + if [ -f "$HOST_KEY_PUB" ] ; then + fingerprintSSH=$(ssh-keygen -l -f "$HOST_KEY_PUB" | \ awk '{ print $1, $2, $4 }') + echo "ssh fingerprint: $fingerprintSSH" else - log info "SSH host key not found." + log error "SSH host key not found." fi # FIXME: show expiration date @@ -201,6 +203,10 @@ GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"} # host key fingerprint HOST_FINGERPRINT=$(fingerprint_host_key) +# host pub key files +HOST_KEY_PUB="${SYSDATADIR}/ssh_host_rsa_key.pub" +HOST_KEY_PUB_GPG="${SYSDATADIR}/ssh_host_rsa_key.pub.gpg" + # export variables needed in su invocation export DATE export MODE @@ -219,42 +225,42 @@ shift case $COMMAND in 'show-key'|'show'|'s') - check_host_keyring + check_host_fail show_key ;; 'set-expire'|'extend-key'|'e') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/set_expire" set_expire "$@" ;; 'add-hostname'|'add-name'|'n+') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/add_hostname" add_hostname "$@" ;; 'revoke-hostname'|'revoke-name'|'n-') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/revoke_hostname" revoke_hostname "$@" ;; 'add-revoker'|'o') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/add_revoker" add_revoker "$@" ;; 'revoke-key'|'r') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/revoke_key" revoke_key "$@" ;; 'publish-key'|'publish'|'p') - check_host_keyring + check_host_fail source "${MHSHAREDIR}/publish_key" publish_key ;; diff --git a/src/share/mh/gen_key b/src/share/mh/gen_key index 1f8e97e..44109bb 100644 --- a/src/share/mh/gen_key +++ b/src/share/mh/gen_key @@ -75,8 +75,8 @@ log debug "exporting ssh secret key..." log info "SSH host private key output to file: ${MHDATADIR}/ssh_host_rsa_key" log debug "creating ssh public key..." -ssh-keygen -y -f "${MHDATADIR}/ssh_host_rsa_key" > "${SYSDATADIR}/ssh_host_rsa_key.pub" -log info "SSH host public key output to file: ${SYSDATADIR}/ssh_host_rsa_key.pub" +ssh-keygen -y -f "${MHDATADIR}/ssh_host_rsa_key" > "$HOST_KEY_PUB" +log info "SSH host public key output to file: $HOST_KEY_PUB" # export public key to file gpg_host_export_to_ssh_file -- cgit v1.2.3 From 563800612b54203d5cd68aedfd9d482215d9289d Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Mon, 9 Feb 2009 01:41:30 -0500 Subject: rename function to get the host fingerprint, and fix some HOST_FINGERPRINT variables. --- src/monkeysphere-host | 15 +++++++-------- src/share/mh/gen_key | 4 ++-- src/share/mh/import_key | 4 ++-- 3 files changed, 11 insertions(+), 12 deletions(-) (limited to 'src/share/mh/gen_key') diff --git a/src/monkeysphere-host b/src/monkeysphere-host index 506dcf9..be398b1 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -102,10 +102,13 @@ gpg_host_export_to_ssh_file() { } # output just key fingerprint -fingerprint_host_key() { +# FIXME: should not have to be priviledged user to get host +# fingerprint. should be taken from publicly accessible key files, +# instead of the keyring. +get_host_fingerprint() { gpg_host --list-secret-keys --fingerprint \ --with-colons --fixed-list-mode 2> /dev/null | \ - grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null + grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null || true } # output the index of a user ID on the host key @@ -142,12 +145,9 @@ check_host_fail() { show_key() { local fingerprintSSH - # FIXME: should not have to be priviledged user to see this info. - # should be taken from publicly accessible key files, instead of - # the keyring. - gpg_host --fingerprint --list-key --list-options show-unusable-uids \ "0x${HOST_FINGERPRINT}!" 2>/dev/null + # FIXME: make sure expiration date is shown echo "OpenPGP fingerprint: $HOST_FINGERPRINT" @@ -160,7 +160,6 @@ show_key() { log error "SSH host key not found." fi - # FIXME: show expiration date # FIXME: other relevant key parameters? } @@ -188,7 +187,7 @@ CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"} GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"} # host key fingerprint -HOST_FINGERPRINT=$(fingerprint_host_key) +HOST_FINGERPRINT=$(get_host_fingerprint) # host pub key files HOST_KEY_PUB="${SYSDATADIR}/ssh_host_rsa_key.pub" diff --git a/src/share/mh/gen_key b/src/share/mh/gen_key index 44109bb..7b427e4 100644 --- a/src/share/mh/gen_key +++ b/src/share/mh/gen_key @@ -21,7 +21,7 @@ local keyExpire="0" local userID # check for presense of a key -[ "$FINGERPRINT" ] && \ +[ "$HOST_FINGERPRINT" ] && \ failure "An OpenPGP host key already exists." # get options @@ -62,7 +62,7 @@ Expire-Date: $keyExpire EOF # find the key fingerprint of the newly converted key -HOST_FINGERPRINT=$(fingerprint_host_key) +HOST_FINGERPRINT=$(get_host_fingerprint) export HOST_FINGERPRINT # translate the private key to ssh format, and export to a file diff --git a/src/share/mh/import_key b/src/share/mh/import_key index 1efb1ac..99511a8 100644 --- a/src/share/mh/import_key +++ b/src/share/mh/import_key @@ -17,7 +17,7 @@ local hostName local userID # check for presense of a key -[ "$FINGERPRINT" ] && \ +[ "$HOST_FINGERPRINT" ] && \ failure "An OpenPGP host key already exists." hostName=${1:-$(hostname -f)} @@ -34,7 +34,7 @@ PEM2OPENPGP_USAGE_FLAGS=authenticate pem2openpgp "$userID" | \ gpg_host --import # find the key fingerprint of the newly converted key -HOST_FINGERPRINT=$(fingerprint_host_key) +HOST_FINGERPRINT=$(get_host_fingerprint) export HOST_FINGERPRINT # export public key to file -- cgit v1.2.3