blob: fab3ef70e96ad5d22a23e2abcd4d69dc709d82fa (
plain)
- #!/usr/bin/env bash
- # monkeysphere-host: Monkeysphere host admin tool
- #
- # The monkeysphere scripts are written by:
- # Jameson Rollins <jrollins@finestructure.net>
- # Jamie McClelland <jm@mayfirst.org>
- # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
- # Micah Anderson <micah@riseup.net>
- #
- # They are Copyright 2008-2010, and are all released under the GPL,
- # version 3 or later.
- ########################################################################
- set -e
- # set the pipefail option so pipelines fail on first command failure
- set -o pipefail
- PGRM=$(basename $0)
- SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
- export SYSSHAREDIR
- . "${SYSSHAREDIR}/defaultenv"
- . "${SYSSHAREDIR}/common"
- SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
- export SYSDATADIR
- # sharedir for host functions
- MHSHAREDIR="${SYSSHAREDIR}/mh"
- # datadir for host functions
- MHDATADIR="${SYSDATADIR}/host"
- # host pub key files
- HOST_KEY_FILE="${SYSDATADIR}/host_keys.pub.pgp"
- # UTC date in ISO 8601 format if needed
- DATE=$(date -u '+%FT%T')
- # unset some environment variables that could screw things up
- unset GREP_OPTIONS
- ########################################################################
- # FUNCTIONS
- ########################################################################
- usage() {
- cat <<EOF >&2
- usage: $PGRM <subcommand> [options] [args]
- Monkeysphere host admin tool.
- subcommands:
- import-key (i) FILE SERVICENAME import PEM-encoded key from file
- show-keys (s) [KEYID ...] output host key information
- publish-keys (p) [KEYID ...] publish key(s) to keyserver
- set-expire (e) EXPIRE [KEYID] set key expiration
- add-servicename (n+) SERVICENAME [KEYID]
- add a service name to key
- revoke-servicename (n-) SERVICENAME [KEYID]
- revoke a service name from key
- add-revoker (r+) REVOKER_KEYID|FILE [KEYID]
- add a revoker to key
- revoke-key [KEYID] generate and/or publish revocation
- certificate for key
- version (v) show version number
- help (h,?) this help
- See ${PGRM}(8) for more info.
- EOF
- }
- # function to interact with the gpg keyring
- gpg_host() {
- GNUPGHOME="$GNUPGHOME_HOST" gpg --no-greeting --quiet --no-tty "$@"
- }
- # list the info about the a key, in colon format, to stdout
- gpg_host_list_keys() {
- if [ "$1" ] ; then
- gpg_host --list-keys --with-colons --fixed-list-mode \
- --with-fingerprint --with-fingerprint \
- "$1"
- else
- gpg_host --list-keys --with-colons --fixed-list-mode \
- --with-fingerprint --with-fingerprint
- fi
- }
- # edit key scripts, takes scripts on stdin, and keyID as first input
- gpg_host_edit() {
- gpg_host --command-fd 0 --edit-key "$@"
- }
- # export the monkeysphere OpenPGP pub key file
- update_pgp_pub_file() {
- log debug "updating openpgp public key file '$HOST_KEY_FILE'..."
- gpg_host --export --armor --export-options export-minimal \
- $(gpg_host --list-secret-keys --with-colons --fingerprint | grep ^fpr | cut -f10 -d:) \
- > "$HOST_KEY_FILE"
- }
- # check that the service name is well formed
- check_service_name() {
- local name="$1"
- log error "FIX ME: check service name"
- }
- # fail if host key not present
- check_no_keys() {
- [ -s "$HOST_KEY_FILE" ] \
- || failure "You don't appear to have a Monkeysphere host key on this server.
- Please run 'monkeysphere-host import-key' import a key."
- }
- # key input to functions, outputs full fingerprint of specified key if
- # found
- check_key_input() {
- local keyID="$1"
- # array of fingerprints
- local fprs=($(list_primary_fingerprints <"$HOST_KEY_FILE"))
- case ${#fprs[@]} in
- 0)
- failure "You don't appear to have any Monkeysphere host keys.
- Please run 'monkeysphere-host import-key' to import a key."
- ;;
- 1)
- :
- ;;
- *)
- if [ -z "$keyID" ] ; then
- failure "Your host keyring contains multiple keys.
- Please specify one to act on (see 'monkeysphere-host show-keys')."
- fi
- ;;
- esac
- printf '%s\n' "${fprs[@]}" | grep "${keyID}$" \
- || failure "Host key '$keyID' not found."
- }
- # return 0 if user ID was found.
- # return 1 if user ID not found.
- check_key_userid() {
- local keyID="$1"
- local userID="$2"
- local tmpuidMatch
- # match to only "unknown" user IDs (host has no need for ultimate trust)
- tmpuidMatch="uid:-:$(echo $userID | gpg_escape)"
- # See whether the requsted user ID is present
- gpg_host_list_keys "$keyID" | cut -f1,2,10 -d: | \
- grep -q -x -F "$tmpuidMatch" 2>/dev/null
- }
- prompt_userid_exists() {
- local userID="$1"
- local gpgOut
- local fingerprint
- if gpgOut=$(gpg_host_list_keys "=${userID}" 2>/dev/null) ; then
- fingerprint=$(echo "$gpgOut" | grep '^fpr:' | cut -d: -f10)
- if [ "$PROMPT" != "false" ] ; then
- printf "Service name '%s' is already being used by key '%s'.\nAre you sure you want to use it again? (y/N) " "$fingerprint" "$userID" >&2
- read OK; OK=${OK:=N}
- if [ "${OK/y/Y}" != 'Y' ] ; then
- failure "Service name not added."
- fi
- else
- log info "Key '%s' is already using the service name '%s'." "$fingerprint" "$userID" >&2
- fi
- fi
- }
- # run command looped over keys
- multi_key() {
- local cmd="$1"
- shift
- local keys=$@
- local i=0
- local fprs=($(list_primary_fingerprints <"$HOST_KEY_FILE"))
- local key
- check_no_keys
- if [[ -z "$1" || "$1" == '--all' ]] ; then
- keys="${fprs[@]}"
- fi
- for key in $keys ; do
- if (( i++ > 0 )) ; then
- echo "##############################"
- fi
- eval "$cmd" "$key"
- done
- }
- # show info about the a key
- show_key() {
- local id="$1"
- local GNUPGHOME
- local fingerprint
- local tmpssh
- local revokers
- # tmp gpghome dir
- export GNUPGHOME=$(msmktempdir)
- # trap to remove tmp dir if break
- trap "rm -rf $GNUPGHOME" EXIT
- # import the host key into the tmp dir
- gpg --quiet --import <"$HOST_KEY_FILE"
- # get the gpg fingerprint
- if gpg --quiet --list-keys \
- --with-colons --with-fingerprint "$id" \
- | grep '^fpr:' | cut -d: -f10 > "$GNUPGHOME"/fingerprint ; then
- fingerprint=$(cat "$GNUPGHOME"/fingerprint)
- else
- failure "ID '$id' not found."
- fi
- # create the ssh key
- tmpssh="$GNUPGHOME"/ssh_host_key_rsa_pub
- gpg --export "$fingerprint" 2>/dev/null \
- | openpgp2ssh 2>/dev/null >"$tmpssh"
- # list the host key info
- # FIXME: make no-show-keyring work so we don't have to do the grep'ing
- # FIXME: can we show uid validity somehow?
- gpg --list-keys --list-options show-unusable-uids "$fingerprint" 2>/dev/null \
- | grep -v "^${GNUPGHOME}/pubring.gpg$" \
- | egrep -v '^-+$'
- # list revokers, if there are any
- revokers=$(gpg --list-keys --with-colons --fixed-list-mode "$fingerprint" \
- | awk -F: '/^rvk:/{ print $10 }' )
- if [ "$revokers" ] ; then
- echo "The following keys are allowed to revoke this host key:"
- for key in $revokers ; do
- echo "revoker: $key"
- done
- echo
- fi
- # list the pgp fingerprint
- echo "OpenPGP fingerprint: $fingerprint"
- # list the ssh fingerprint
- echo -n "ssh fingerprint: "
- ssh-keygen -l -f "$tmpssh" | awk '{ print $1, $2, $4 }'
- # remove the tmp file
- trap - EXIT
- rm -rf "$GNUPGHOME"
- }
- ########################################################################
- # MAIN
- ########################################################################
- # load configuration file
- [ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] \
- && . "$MONKEYSPHERE_HOST_CONFIG"
- # set empty config variable with ones from the environment, or with
- # defaults
- LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=$LOG_LEVEL}
- KEYSERVER=${MONKEYSPHERE_KEYSERVER:=$KEYSERVER}
- CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=$CHECK_KEYSERVER}
- MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=$MONKEYSPHERE_USER}
- MONKEYSPHERE_GROUP=$(get_primary_group "$MONKEYSPHERE_USER")
- PROMPT=${MONKEYSPHERE_PROMPT:=$PROMPT}
- # other variables
- GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"}
- LOG_PREFIX=${MONKEYSPHERE_LOG_PREFIX:='ms: '}
- # export variables needed in su invocation
- export DATE
- export LOG_LEVEL
- export KEYSERVER
- export CHECK_KEYSERVER
- export MONKEYSPHERE_USER
- export MONKEYSPHERE_GROUP
- export PROMPT
- export GNUPGHOME_HOST
- export GNUPGHOME
- export HOST_FINGERPRINT
- export LOG_PREFIX
- if [ "$#" -eq 0 ] ; then
- usage
- failure "Please supply a subcommand."
- fi
- # get subcommand
- COMMAND="$1"
- shift
- case $COMMAND in
- 'import-key'|'i')
- source "${MHSHAREDIR}/import_key"
- import_key "$@"
- ;;
- 'show-keys'|'show-key'|'show'|'s')
- multi_key show_key "$@"
- ;;
- 'set-expire'|'extend-key'|'e')
- source "${MHSHAREDIR}/set_expire"
- set_expire "$@"
- ;;
- 'add-servicename'|'add-hostname'|'add-name'|'n+')
- source "${MHSHAREDIR}/add_name"
- add_name "$@"
- ;;
- 'revoke-servicename'|'revoke-hostname'|'revoke-name'|'n-')
- source "${MHSHAREDIR}/revoke_name"
- revoke_name "$@"
- ;;
- 'add-revoker'|'r+')
- source "${MHSHAREDIR}/add_revoker"
- add_revoker "$@"
- ;;
- 'revoke-key')
- source "${MHSHAREDIR}/revoke_key"
- revoke_key "$@"
- ;;
- 'publish-keys'|'publish-key'|'publish'|'p')
- source "${MHSHAREDIR}/publish_key"
- multi_key publish_key "$@"
- ;;
- 'diagnostics'|'d')
- source "${MHSHAREDIR}/diagnostics"
- diagnostics
- ;;
- 'update-pgp-pub-file')
- update_pgp_pub_file
- ;;
- 'version'|'v')
- version
- ;;
- '--help'|'help'|'-h'|'h'|'?')
- usage
- ;;
- *)
- failure "Unknown command: '$COMMAND'
- Try '$PGRM help' for usage."
- ;;
- esac
|