From 3f71bfc52f158a76755a7b75362b449439819fa7 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Mar 2009 12:01:02 -0400 Subject: modify the ssh_proxycommand marginal ui output so that it better handles the case where the host can not be contacted. the new system attempts to retrieve the host ssh key before any ui output is made. this should make things a little clearer in this corner case, and make things a little more flexible down the line. --- src/share/m/ssh_proxycommand | 137 +++++++++++++++++++++++-------------------- 1 file changed, 74 insertions(+), 63 deletions(-) (limited to 'src/share') diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand index 7ab4bec..2078445 100644 --- a/src/share/m/ssh_proxycommand +++ b/src/share/m/ssh_proxycommand @@ -36,52 +36,55 @@ output_no_valid_key() { LOG_PREFIX= - cat </dev/null | awk '{ print $2, $3 }') - # FIXME: should we do any checks for failed keyscans, eg. host not - # found? + # retrieve the ssh key being offered by the host + sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null \ + | awk '{ print $2, $3 }') # get the gpg info for userid gpgOut=$(gpg_user --list-key --fixed-list-mode --with-colon \ --with-fingerprint --with-fingerprint \ ="$userID" 2>/dev/null) - # find all 'pub' and 'sub' lines in the gpg output, which each - # represent a retrieved key for the user ID - echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \ - while IFS=: read -r type validity keyid uidfpr usage ; do - case $type in - 'pub'|'sub') - # get the ssh key of the gpg key - sshKeyGPG=$(gpg2ssh "$keyid") - - # if one of keys found matches the one offered by the - # host, then output info - if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then - cat <"$sshKeyGPGFile" - sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \ - awk '{ print $2 }') - rm -f "$sshKeyGPGFile" + sshKeyGPGFile=$(msmktempfile) + printf "%s" "$sshKeyGPG" >"$sshKeyGPGFile" + sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \ + awk '{ print $2 }') + rm -f "$sshKeyGPGFile" - # get the sigs for the matching key - gpgSigOut=$(gpg_user --check-sigs \ - --list-options show-uid-validity \ - "$keyid") + # get the sigs for the matching key + gpgSigOut=$(gpg_user --check-sigs \ + --list-options show-uid-validity \ + "$keyid") - # output the sigs, but only those on the user ID - # we are looking for - echo "$gpgSigOut" | awk ' + # output the sigs, but only those on the user ID + # we are looking for + echo "$gpgSigOut" | awk ' { if (match($0,"^pub")) { print; } if (match($0,"^uid")) { ok=0; } @@ -89,50 +92,58 @@ if (match($0,"^uid.*'$userID'$")) { ok=1; print; } if (ok) { if (match($0,"^sig")) { print; } } } ' | log info - echo | log info + echo | log info - # output the other user IDs for reference - if (echo "$gpgSigOut" | grep "^uid" | grep -v -q "$userID") ; then - cat < Date: Wed, 18 Mar 2009 14:31:43 -0400 Subject: remove some extraneous invocations of cat. --- src/share/m/gen_subkey | 7 ++----- src/share/m/ssh_proxycommand | 14 +++++++------- src/share/mh/set_expire | 2 +- 3 files changed, 10 insertions(+), 13 deletions(-) (limited to 'src/share') diff --git a/src/share/m/gen_subkey b/src/share/m/gen_subkey index dbd9dd6..a0fa3ce 100644 --- a/src/share/m/gen_subkey +++ b/src/share/m/gen_subkey @@ -44,8 +44,7 @@ Type '$PGRM help' for usage." check_gpg_authentication_subkey "$keyID" # generate the list of commands that will be passed to edit-key - editCommands=$(cat </dev/null) # output header - cat < Date: Sun, 22 Mar 2009 20:11:16 -0400 Subject: some more pruning of unnecessary usage of cat for the gnupg scripts. --- packaging/macports/Portfile | 2 +- src/share/ma/add_certifier | 8 +++----- src/share/mh/add_hostname | 8 +++----- src/share/mh/add_revoker | 8 +++----- src/share/mh/revoke_hostname | 8 +++----- 5 files changed, 13 insertions(+), 21 deletions(-) (limited to 'src/share') diff --git a/packaging/macports/Portfile b/packaging/macports/Portfile index f9cf7a5..99d0d69 100644 --- a/packaging/macports/Portfile +++ b/packaging/macports/Portfile @@ -20,7 +20,7 @@ long_description SSH key-based authentication is tried-and-true, \ users. homepage http://web.monkeysphere.info/ -master_sites ??? +master_sites http://archive.monkeysphere.info/debian/pool/monkeysphere/m/monkeysphere/ distname ${name}_${version} worksrcdir ${name}-${version} checksums md5 8590532f4702fa44027a6a583657c9ef diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier index 544a3f0..402da08 100644 --- a/src/share/ma/add_certifier +++ b/src/share/ma/add_certifier @@ -153,16 +153,14 @@ gpg_sphere "--export 0x${fingerprint}!" | gpg_core --import # edit-key script to ltsign key # NOTE: *all* user IDs will be ltsigned -ltsignCommand=$(cat < Date: Mon, 23 Mar 2009 14:41:07 -0400 Subject: proposed patch for issue #660, to properly specify host and port number in known_hosts lines. --- src/share/common | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) (limited to 'src/share') diff --git a/src/share/common b/src/share/common index ea872ba..5a11817 100644 --- a/src/share/common +++ b/src/share/common @@ -464,14 +464,19 @@ gpg2ssh() { # output known_hosts line from ssh key ssh2known_hosts() { local host + local port local key - host="$1" + host=${1%%:*} + port=${1##*:} key="$2" - echo -n "$host " - echo -n "$key" | tr -d '\n' - echo " MonkeySphere${DATE}" + # specify the host and port properly for new ssh known_hosts + # format + if [ "$port" != "$host" ] ; then + host="[${host}]:${port}" + fi + printf "%s %s MonkeySphere%s\n" "$host" "$key" "$DATE" } # output authorized_keys line from ssh key @@ -482,41 +487,43 @@ ssh2authorized_keys() { userID="$1" key="$2" - echo -n "$key" | tr -d '\n' - echo " MonkeySphere${DATE} ${userID}" + printf "%s MonkeySphere%s %s\n" "$key" "$DATE" "$userID" } # convert key from gpg to ssh known_hosts format gpg2known_hosts() { local host local keyID + local key host="$1" keyID="$2" + key=$(gpg2ssh "$keyID") + # NOTE: it seems that ssh-keygen -R removes all comment fields from # all lines in the known_hosts file. why? # NOTE: just in case, the COMMENT can be matched with the # following regexp: # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' - echo -n "$host " - gpg2ssh "$keyID" | tr -d '\n' - echo " MonkeySphere${DATE}" + printf "%s %s MonkeySphere%s\n" "$host" "$key" "$DATE" } # convert key from gpg to ssh authorized_keys format gpg2authorized_keys() { local userID local keyID + local key userID="$1" keyID="$2" + key=$(gpg2ssh "$keyID") + # NOTE: just in case, the COMMENT can be matched with the # following regexp: # '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' - gpg2ssh "$keyID" | tr -d '\n' - echo " MonkeySphere${DATE} ${userID}" + printf "%s MonkeySphere%s %s\n" "$key" "$DATE" "$userID" } ### GPG UTILITIES -- cgit v1.2.3 From b701db93e07fa839cf599577b45ccf3ff7b71351 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Mon, 23 Mar 2009 16:54:20 -0400 Subject: add FIXME note about IPv6 addresses, and break out hostnames from the last colon, not the first. --- src/share/common | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'src/share') diff --git a/src/share/common b/src/share/common index 5a11817..d6e4949 100644 --- a/src/share/common +++ b/src/share/common @@ -467,7 +467,11 @@ ssh2known_hosts() { local port local key - host=${1%%:*} + # FIXME this does not properly deal with IPv6 hosts using the + # standard port (because it's unclear whether their final + # colon-delimited address section is a port number or an address + # string) + host=${1%:*} port=${1##*:} key="$2" -- cgit v1.2.3