summaryrefslogtreecommitdiff
path: root/src/monkeysphere-host
blob: 5007cac3b6f503d1dc9324740cdc8a4ffc5df04e (plain)
  1. #!/usr/bin/env bash
  2. # monkeysphere-host: Monkeysphere host admin tool
  3. #
  4. # The monkeysphere scripts are written by:
  5. # Jameson Rollins <jrollins@finestructure.net>
  6. # Jamie McClelland <jm@mayfirst.org>
  7. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  8. # Micah Anderson <micah@riseup.net>
  9. #
  10. # They are Copyright 2008-2010, and are all released under the GPL,
  11. # version 3 or later.
  12. ########################################################################
  13. set -e
  14. # set the pipefail option so pipelines fail on first command failure
  15. set -o pipefail
  16. PGRM=$(basename $0)
  17. SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
  18. export SYSSHAREDIR
  19. . "${SYSSHAREDIR}/defaultenv"
  20. . "${SYSSHAREDIR}/common"
  21. SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
  22. export SYSDATADIR
  23. # sharedir for host functions
  24. MHSHAREDIR="${SYSSHAREDIR}/mh"
  25. # datadir for host functions
  26. MHDATADIR="${SYSDATADIR}/host"
  27. # host pub key files
  28. HOST_KEY_FILE="${SYSDATADIR}/host_keys.pub.pgp"
  29. # UTC date in ISO 8601 format if needed
  30. DATE=$(date -u '+%FT%T')
  31. # unset some environment variables that could screw things up
  32. unset GREP_OPTIONS
  33. ########################################################################
  34. # FUNCTIONS
  35. ########################################################################
  36. usage() {
  37. cat <<EOF >&2
  38. usage: $PGRM <subcommand> [options] [args]
  39. Monkeysphere host admin tool.
  40. subcommands:
  41. import-key (i) FILE SERVICENAME import PEM-encoded key from file
  42. show-keys (s) [KEYID ...] output host key information
  43. publish-keys (p) [KEYID ...] publish key(s) to keyserver
  44. set-expire (e) EXPIRE [KEYID] set key expiration
  45. add-servicename (n+) SERVICENAME [KEYID]
  46. add a service name to key
  47. revoke-servicename (n-) SERVICENAME [KEYID]
  48. revoke a service name from key
  49. add-revoker (r+) REVOKER_KEYID|FILE [KEYID]
  50. add a revoker to key
  51. revoke-key [KEYID] generate and/or publish revocation
  52. certificate for key
  53. version (v) show version number
  54. help (h,?) this help
  55. See ${PGRM}(8) for more info.
  56. EOF
  57. }
  58. # function to interact with the gpg keyring
  59. gpg_host() {
  60. GNUPGHOME="$GNUPGHOME_HOST" gpg --no-greeting --quiet --no-tty "$@"
  61. }
  62. # list the info about the a key, in colon format, to stdout
  63. gpg_host_list_keys() {
  64. if [ "$1" ] ; then
  65. gpg_host --list-keys --with-colons --fixed-list-mode \
  66. --with-fingerprint --with-fingerprint \
  67. "$1"
  68. else
  69. gpg_host --list-keys --with-colons --fixed-list-mode \
  70. --with-fingerprint --with-fingerprint
  71. fi
  72. }
  73. # edit key scripts, takes scripts on stdin, and keyID as first input
  74. gpg_host_edit() {
  75. gpg_host --command-fd 0 --edit-key "$@"
  76. }
  77. # export the monkeysphere OpenPGP pub key file
  78. update_pgp_pub_file() {
  79. log debug "updating openpgp public key file '$HOST_KEY_FILE'..."
  80. gpg_host --export --armor --export-options export-minimal \
  81. $(gpg_host --list-secret-keys --with-colons --fingerprint | grep ^fpr | cut -f10 -d:) \
  82. > "$HOST_KEY_FILE"
  83. }
  84. # check that the service name is well formed. we assume that the
  85. # service name refers to a host; DNS labels for host names are limited
  86. # to a very small range of characters (see RFC 1912, section 2.1).
  87. # FIXME: i'm failing to check here for label components that are
  88. # all-number (e.g. ssh://666.666), which are technically not allowed
  89. # (though some exist on the 'net, apparently)
  90. check_service_name() {
  91. local name="$1"
  92. local errs=""
  93. local scheme
  94. local port
  95. local assigned_ports
  96. [ -n "$name" ] || \
  97. failure "You must supply a service name to check"
  98. printf '%s' "$name" | perl -n -e '($str = $_) =~ s/\s//g ; exit !(lc($str) eq $_);' || \
  99. failure "Not a valid service name: '$name'
  100. Service names should be canonicalized to all lower-case,
  101. with no whitespace"
  102. [[ "$name" =~ ^[a-z0-9./:-]+$ ]] || \
  103. failure "Not a valid service name: '$name'
  104. Service names should contain only lower-case ASCII letters
  105. numbers, dots (.), hyphens (-), slashes (/), and a colon (:).
  106. If you are using non-ASCII characters (e.g. IDN), you should
  107. use the canonicalized ASCII (NAMEPREP -> Punycode) representation
  108. (see RFC 3490)."
  109. [[ "$name" =~ \. ]] || \
  110. failure "Not a valid service name: '$name'
  111. Service names should use fully-qualified domain names (FQDN), but the
  112. domain name you chose appears to only have the local part. For
  113. example: don't use 'ssh://foo' ; use 'ssh://foo.example.com' instead."
  114. [[ "$name" =~ ^[a-z]([a-z0-9-]*[a-z0-9])?://[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.|((\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+))(:[1-9][0-9]{0,4})?$ ]] || \
  115. failure "Not a valid service name: '$name'
  116. Service names look like <scheme>://full.example.com[:<portnumber>],
  117. where <scheme> is something like ssh or https, and <portnumber> is
  118. a decimal number (supplied only if the service is on a non-standard
  119. port)."
  120. scheme=$(cut -f1 -d: <<<"$name")
  121. port=$(cut -f3 -d: <<<"$name")
  122. # check that the scheme name is found in the system services
  123. # database
  124. available_=$(get_port_for_service "$scheme") || \
  125. log error "Error looking up service scheme named '%s'" "$scheme"
  126. # FIXME: if the service isn't found, or does not have a port, what
  127. # should we do? at the moment, we're just warning.
  128. if [ -n "$port" ]; then
  129. # check that the port number is a legitimate port number (> 0, < 65536)
  130. [ "$port" -gt 0 ] && [ "$port" -lt 65536 ] || \
  131. failure "The given port number should be greater than 0 and
  132. less than 65536. '$port' is not OK"
  133. # if the port number is given, and the scheme is in the services
  134. # database, check that the port number does *not* match the
  135. # default port.
  136. if (printf '%s' "$assigned_ports" | grep -q -F -x "$port" ) ; then
  137. failure $(printf "The scheme %s uses port number %d by default.
  138. You should leave off the port number if it is the default" "$scheme" "$port")
  139. fi
  140. fi
  141. }
  142. # fail if host key not present
  143. check_no_keys() {
  144. [ -s "$HOST_KEY_FILE" ] \
  145. || failure "You don't appear to have a Monkeysphere host key on this server.
  146. Please run 'monkeysphere-host import-key' import a key."
  147. }
  148. # key input to functions, outputs full fingerprint of specified key if
  149. # found
  150. check_key_input() {
  151. local keyID="$1"
  152. # array of fingerprints
  153. local fprs=($(list_primary_fingerprints <"$HOST_KEY_FILE"))
  154. case ${#fprs[@]} in
  155. 0)
  156. failure "You don't appear to have any Monkeysphere host keys.
  157. Please run 'monkeysphere-host import-key' to import a key."
  158. ;;
  159. 1)
  160. :
  161. ;;
  162. *)
  163. if [ -z "$keyID" ] ; then
  164. failure "Your host keyring contains multiple keys.
  165. Please specify one to act on (see 'monkeysphere-host show-keys')."
  166. fi
  167. ;;
  168. esac
  169. printf '%s\n' "${fprs[@]}" | grep "${keyID}$" \
  170. || failure "Host key '$keyID' not found."
  171. }
  172. # return 0 if user ID was found.
  173. # return 1 if user ID not found.
  174. check_key_userid() {
  175. local keyID="$1"
  176. local userID="$2"
  177. local tmpuidMatch
  178. # match to only "unknown" user IDs (host has no need for ultimate trust)
  179. tmpuidMatch="uid:-:$(echo $userID | gpg_escape)"
  180. # See whether the requsted user ID is present
  181. gpg_host_list_keys "$keyID" | cut -f1,2,10 -d: | \
  182. grep -q -x -F "$tmpuidMatch" 2>/dev/null
  183. }
  184. prompt_userid_exists() {
  185. local userID="$1"
  186. local gpgOut
  187. local fingerprint
  188. if gpgOut=$(gpg_host_list_keys "=${userID}" 2>/dev/null) ; then
  189. fingerprint=$(echo "$gpgOut" | grep '^fpr:' | cut -d: -f10)
  190. if [ "$PROMPT" != "false" ] ; then
  191. printf "Service name '%s' is already being used by key '%s'.\nAre you sure you want to use it again? (y/N) " "$fingerprint" "$userID" >&2
  192. read OK; OK=${OK:=N}
  193. if [ "${OK/y/Y}" != 'Y' ] ; then
  194. failure "Service name not added."
  195. fi
  196. else
  197. log info "Key '%s' is already using the service name '%s'." "$fingerprint" "$userID" >&2
  198. fi
  199. fi
  200. }
  201. # run command looped over keys
  202. multi_key() {
  203. local cmd="$1"
  204. shift
  205. local keys=$@
  206. local i=0
  207. local fprs=($(list_primary_fingerprints <"$HOST_KEY_FILE"))
  208. local key
  209. check_no_keys
  210. if [[ -z "$1" || "$1" == '--all' ]] ; then
  211. keys="${fprs[@]}"
  212. fi
  213. for key in $keys ; do
  214. if (( i++ > 0 )) ; then
  215. echo "##############################"
  216. fi
  217. eval "$cmd" "$key"
  218. done
  219. }
  220. # show info about the a key
  221. show_key() {
  222. local id="$1"
  223. local GNUPGHOME
  224. local fingerprint
  225. local tmpssh
  226. local revokers
  227. # tmp gpghome dir
  228. export GNUPGHOME=$(msmktempdir)
  229. # trap to remove tmp dir if break
  230. trap "rm -rf $GNUPGHOME" EXIT
  231. # import the host key into the tmp dir
  232. gpg --quiet --import <"$HOST_KEY_FILE"
  233. # get the gpg fingerprint
  234. if gpg --quiet --list-keys \
  235. --with-colons --with-fingerprint "$id" \
  236. | grep '^fpr:' | cut -d: -f10 > "$GNUPGHOME"/fingerprint ; then
  237. fingerprint=$(cat "$GNUPGHOME"/fingerprint)
  238. else
  239. failure "ID '$id' not found."
  240. fi
  241. # create the ssh key
  242. tmpssh="$GNUPGHOME"/ssh_host_key_rsa_pub
  243. gpg --export "$fingerprint" 2>/dev/null \
  244. | openpgp2ssh 2>/dev/null >"$tmpssh"
  245. # list the host key info
  246. # FIXME: make no-show-keyring work so we don't have to do the grep'ing
  247. # FIXME: can we show uid validity somehow?
  248. gpg --list-keys --list-options show-unusable-uids "$fingerprint" 2>/dev/null \
  249. | grep -v "^${GNUPGHOME}/pubring.gpg$" \
  250. | egrep -v '^-+$'
  251. # list revokers, if there are any
  252. revokers=$(gpg --list-keys --with-colons --fixed-list-mode "$fingerprint" \
  253. | awk -F: '/^rvk:/{ print $10 }' )
  254. if [ "$revokers" ] ; then
  255. echo "The following keys are allowed to revoke this host key:"
  256. for key in $revokers ; do
  257. echo "revoker: $key"
  258. done
  259. echo
  260. fi
  261. # list the pgp fingerprint
  262. echo "OpenPGP fingerprint: $fingerprint"
  263. # list the ssh fingerprint
  264. echo -n "ssh fingerprint: "
  265. ssh-keygen -l -f "$tmpssh" | awk '{ print $1, $2, $4 }'
  266. # remove the tmp file
  267. trap - EXIT
  268. rm -rf "$GNUPGHOME"
  269. }
  270. ########################################################################
  271. # MAIN
  272. ########################################################################
  273. # load configuration file
  274. [ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] \
  275. && . "$MONKEYSPHERE_HOST_CONFIG"
  276. # set empty config variable with ones from the environment, or with
  277. # defaults
  278. LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=$LOG_LEVEL}
  279. KEYSERVER=${MONKEYSPHERE_KEYSERVER:=$KEYSERVER}
  280. CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=$CHECK_KEYSERVER}
  281. MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=$MONKEYSPHERE_USER}
  282. MONKEYSPHERE_GROUP=$(get_primary_group "$MONKEYSPHERE_USER")
  283. PROMPT=${MONKEYSPHERE_PROMPT:=$PROMPT}
  284. # other variables
  285. GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"}
  286. LOG_PREFIX=${MONKEYSPHERE_LOG_PREFIX:='ms: '}
  287. # export variables needed in su invocation
  288. export DATE
  289. export LOG_LEVEL
  290. export KEYSERVER
  291. export CHECK_KEYSERVER
  292. export MONKEYSPHERE_USER
  293. export MONKEYSPHERE_GROUP
  294. export PROMPT
  295. export GNUPGHOME_HOST
  296. export GNUPGHOME
  297. export HOST_FINGERPRINT
  298. export LOG_PREFIX
  299. if [ "$#" -eq 0 ] ; then
  300. usage
  301. failure "Please supply a subcommand."
  302. fi
  303. # get subcommand
  304. COMMAND="$1"
  305. shift
  306. case $COMMAND in
  307. 'import-key'|'i')
  308. source "${MHSHAREDIR}/import_key"
  309. import_key "$@"
  310. ;;
  311. 'show-keys'|'show-key'|'show'|'s')
  312. multi_key show_key "$@"
  313. ;;
  314. 'set-expire'|'extend-key'|'e')
  315. source "${MHSHAREDIR}/set_expire"
  316. set_expire "$@"
  317. ;;
  318. 'add-servicename'|'add-hostname'|'add-name'|'n+')
  319. source "${MHSHAREDIR}/add_name"
  320. add_name "$@"
  321. ;;
  322. 'revoke-servicename'|'revoke-hostname'|'revoke-name'|'n-')
  323. source "${MHSHAREDIR}/revoke_name"
  324. revoke_name "$@"
  325. ;;
  326. 'add-revoker'|'r+')
  327. source "${MHSHAREDIR}/add_revoker"
  328. add_revoker "$@"
  329. ;;
  330. 'revoke-key')
  331. source "${MHSHAREDIR}/revoke_key"
  332. revoke_key "$@"
  333. ;;
  334. 'publish-keys'|'publish-key'|'publish'|'p')
  335. source "${MHSHAREDIR}/publish_key"
  336. multi_key publish_key "$@"
  337. ;;
  338. 'diagnostics'|'d')
  339. source "${MHSHAREDIR}/diagnostics"
  340. diagnostics
  341. ;;
  342. 'update-pgp-pub-file')
  343. update_pgp_pub_file
  344. ;;
  345. 'version'|'v')
  346. version
  347. ;;
  348. '--help'|'help'|'-h'|'h'|'?')
  349. usage
  350. ;;
  351. *)
  352. failure "Unknown command: '$COMMAND'
  353. Try '$PGRM help' for usage."
  354. ;;
  355. esac