summaryrefslogtreecommitdiff
path: root/src/monkeysphere-host
blob: 2335f1a0f2a8ed350af4ad6af78ec3bcf7ccda39 (plain)
  1. #!/usr/bin/env bash
  2. # monkeysphere-host: Monkeysphere host admin tool
  3. #
  4. # The monkeysphere scripts are written by:
  5. # Jameson Rollins <jrollins@finestructure.net>
  6. # Jamie McClelland <jm@mayfirst.org>
  7. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  8. # Micah Anderson <micah@riseup.net>
  9. #
  10. # They are Copyright 2008-2010, and are all released under the GPL,
  11. # version 3 or later.
  12. ########################################################################
  13. set -e
  14. # set the pipefail option so pipelines fail on first command failure
  15. set -o pipefail
  16. PGRM=$(basename $0)
  17. SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
  18. export SYSSHAREDIR
  19. . "${SYSSHAREDIR}/defaultenv"
  20. . "${SYSSHAREDIR}/common"
  21. SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
  22. export SYSDATADIR
  23. # sharedir for host functions
  24. MHSHAREDIR="${SYSSHAREDIR}/mh"
  25. # datadir for host functions
  26. MHDATADIR="${SYSDATADIR}/host"
  27. # host pub key files
  28. HOST_KEY_FILE="${SYSDATADIR}/host_keys.pub.pgp"
  29. # UTC date in ISO 8601 format if needed
  30. DATE=$(date -u '+%FT%T')
  31. # unset some environment variables that could screw things up
  32. unset GREP_OPTIONS
  33. ########################################################################
  34. # FUNCTIONS
  35. ########################################################################
  36. usage() {
  37. cat <<EOF >&2
  38. usage: $PGRM <subcommand> [options] [args]
  39. Monkeysphere host admin tool.
  40. subcommands:
  41. import-key (i) FILE SERVICENAME import PEM-encoded key from file
  42. show-keys (s) [KEYID ...] output host key information
  43. publish-keys (p) [KEYID ...] publish key(s) to keyserver
  44. set-expire (e) EXPIRE [KEYID] set key expiration
  45. add-servicename (n+) SERVICENAME [KEYID]
  46. add a service name to key
  47. revoke-servicename (n-) SERVICENAME [KEYID]
  48. revoke a service name from key
  49. add-revoker (r+) REVOKER_KEYID|FILE [KEYID]
  50. add a revoker to key
  51. revoke-key [KEYID] generate and/or publish revocation
  52. certificate for key
  53. version (v) show version number
  54. help (h,?) this help
  55. See ${PGRM}(8) for more info.
  56. EOF
  57. }
  58. # function to interact with the gpg keyring
  59. gpg_host() {
  60. GNUPGHOME="$GNUPGHOME_HOST" gpg --no-greeting --quiet --no-tty "$@"
  61. }
  62. # list the info about the a key, in colon format, to stdout
  63. gpg_host_list_keys() {
  64. gpg_host --list-keys --with-colons --fixed-list-mode \
  65. --with-fingerprint --with-fingerprint \
  66. "$1"
  67. }
  68. # edit key scripts, takes scripts on stdin, and keyID as first input
  69. gpg_host_edit() {
  70. gpg_host --command-fd 0 --edit-key "$@"
  71. }
  72. # export the monkeysphere OpenPGP pub key file
  73. update_pgp_pub_file() {
  74. log debug "updating openpgp public key file '$HOST_KEY_FILE'..."
  75. gpg_host --export --armor --export-options export-minimal \
  76. $(gpg_host --list-secret-keys --with-colons --fingerprint | grep ^fpr | cut -f9 -d:) \
  77. > "$HOST_KEY_FILE"
  78. }
  79. host_fingerprints() {
  80. local fprs=($(<"$HOST_KEY_FILE" "$SYSSHAREDIR/keytrans" listfprs))
  81. log debug "host key fingerprints:"
  82. printf '%s\n' "${fprs[@]}" | log debug
  83. printf '%s\n' "${fprs[@]}"
  84. }
  85. # check that the service name is well formed
  86. check_service_name() {
  87. local name="$1"
  88. log error "FIX ME: check service name"
  89. }
  90. # fail if host key not present
  91. check_no_keys() {
  92. [ -s "$HOST_KEY_FILE" ] \
  93. || failure "You don't appear to have a Monkeysphere host key on this server.
  94. Please run 'monkeysphere-host import-key' import a key."
  95. }
  96. # key input to functions, outputs full fingerprint of specified key if
  97. # found
  98. check_key_input() {
  99. local keyID="$1"
  100. # array of fingerprints
  101. local fprs=($(host_fingerprints))
  102. case ${#fprs[@]} in
  103. 0)
  104. failure "You don't appear to have any Monkeysphere host keys.
  105. Please run 'monkeysphere-host import-key' to import a key."
  106. ;;
  107. 1)
  108. :
  109. ;;
  110. *)
  111. if [ -z "$keyID" ] ; then
  112. failure "Your host keyring contains multiple keys.
  113. Please specify one to act on (see 'monkeysphere-host show-key')."
  114. fi
  115. ;;
  116. esac
  117. printf '%s\n' "${fprs[@]}" | grep "${keyID}$" \
  118. || failure "Host key '$keyID' not found."
  119. }
  120. # return 0 if user ID was found.
  121. # return 1 if user ID not found.
  122. check_key_userid() {
  123. local keyID="$1"
  124. local userID="$2"
  125. local tmpuidMatch
  126. # match to only "unknown" user IDs (host has no need for ultimate trust)
  127. tmpuidMatch="uid:-:$(echo $userID | gpg_escape)"
  128. # See whether the requsted user ID is present
  129. gpg_host_list_keys "$keyID" | cut -f1,2,10 -d: | \
  130. grep -q -x -F "$tmpuidMatch" 2>/dev/null
  131. }
  132. # run command looped over keys
  133. multi_key() {
  134. local cmd="$1"
  135. shift
  136. local keys=$@
  137. local i=0
  138. local fprs=($(host_fingerprints))
  139. local key
  140. check_no_keys
  141. if [[ -z "$1" || "$1" == '--all' ]] ; then
  142. keys="${fprs[@]}"
  143. fi
  144. for key in $keys ; do
  145. if (( i++ > 0 )) ; then
  146. echo "##############################"
  147. fi
  148. eval "$cmd" "$key"
  149. done
  150. }
  151. # show info about the a key
  152. show_key() {
  153. local id="$1"
  154. local GNUPGHOME
  155. local fingerprint
  156. local tmpssh
  157. local revokers
  158. # tmp gpghome dir
  159. export GNUPGHOME=$(msmktempdir)
  160. # trap to remove tmp dir if break
  161. trap "rm -rf $GNUPGHOME" EXIT
  162. # import the host key into the tmp dir
  163. gpg --quiet --import <"$HOST_KEY_FILE"
  164. # get the gpg fingerprint
  165. if gpg --quiet --list-keys \
  166. --with-colons --with-fingerprint "$id" \
  167. | grep '^fpr:' | cut -d: -f10 > "$GNUPGHOME"/fingerprint ; then
  168. fingerprint=$(cat "$GNUPGHOME"/fingerprint)
  169. else
  170. failure "ID '$id' not found."
  171. fi
  172. # create the ssh key
  173. tmpssh="$GNUPGHOME"/ssh_host_key_rsa_pub
  174. gpg --export "$fingerprint" 2>/dev/null \
  175. | openpgp2ssh 2>/dev/null >"$tmpssh"
  176. # list the host key info
  177. # FIXME: make no-show-keyring work so we don't have to do the grep'ing
  178. # FIXME: can we show uid validity somehow?
  179. gpg --list-keys --list-options show-unusable-uids "$fingerprint" 2>/dev/null \
  180. | grep -v "^${GNUPGHOME}/pubring.gpg$" \
  181. | egrep -v '^-+$'
  182. # list revokers, if there are any
  183. revokers=$(gpg --list-keys --with-colons --fixed-list-mode "$fingerprint" \
  184. | awk -F: '/^rvk:/{ print $10 }' )
  185. if [ "$revokers" ] ; then
  186. echo "The following keys are allowed to revoke this host key:"
  187. for key in $revokers ; do
  188. echo "revoker: $key"
  189. done
  190. echo
  191. fi
  192. # list the pgp fingerprint
  193. echo "OpenPGP fingerprint: $fingerprint"
  194. # list the ssh fingerprint
  195. echo -n "ssh fingerprint: "
  196. ssh-keygen -l -f "$tmpssh" | awk '{ print $1, $2, $4 }'
  197. # remove the tmp file
  198. trap - EXIT
  199. rm -rf "$GNUPGHOME"
  200. }
  201. ########################################################################
  202. # MAIN
  203. ########################################################################
  204. # load configuration file
  205. [ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] \
  206. && . "$MONKEYSPHERE_HOST_CONFIG"
  207. # set empty config variable with ones from the environment, or with
  208. # defaults
  209. LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=$LOG_LEVEL}
  210. KEYSERVER=${MONKEYSPHERE_KEYSERVER:=$KEYSERVER}
  211. CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=$CHECK_KEYSERVER}
  212. MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=$MONKEYSPHERE_USER}
  213. MONKEYSPHERE_GROUP=$(get_primary_group "$MONKEYSPHERE_USER")
  214. PROMPT=${MONKEYSPHERE_PROMPT:=$PROMPT}
  215. # other variables
  216. GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${MHDATADIR}"}
  217. LOG_PREFIX=${MONKEYSPHERE_LOG_PREFIX:='ms: '}
  218. # export variables needed in su invocation
  219. export DATE
  220. export LOG_LEVEL
  221. export KEYSERVER
  222. export CHECK_KEYSERVER
  223. export MONKEYSPHERE_USER
  224. export MONKEYSPHERE_GROUP
  225. export PROMPT
  226. export GNUPGHOME_HOST
  227. export GNUPGHOME
  228. export HOST_FINGERPRINT
  229. export LOG_PREFIX
  230. if [ "$#" -eq 0 ] ; then
  231. usage
  232. failure "Please supply a subcommand."
  233. fi
  234. # get subcommand
  235. COMMAND="$1"
  236. shift
  237. case $COMMAND in
  238. 'import-key'|'i')
  239. source "${MHSHAREDIR}/import_key"
  240. import_key "$@"
  241. ;;
  242. 'show-keys'|'show-key'|'show'|'s')
  243. multi_key show_key "$@"
  244. ;;
  245. 'set-expire'|'extend-key'|'e')
  246. source "${MHSHAREDIR}/set_expire"
  247. set_expire "$@"
  248. ;;
  249. 'add-servicename'|'add-hostname'|'add-name'|'n+')
  250. source "${MHSHAREDIR}/add_name"
  251. add_name "$@"
  252. ;;
  253. 'revoke-servicename'|'revoke-hostname'|'revoke-name'|'n-')
  254. source "${MHSHAREDIR}/revoke_name"
  255. revoke_name "$@"
  256. ;;
  257. 'add-revoker'|'r+')
  258. source "${MHSHAREDIR}/add_revoker"
  259. add_revoker "$@"
  260. ;;
  261. 'revoke-key')
  262. source "${MHSHAREDIR}/revoke_key"
  263. revoke_key "$@"
  264. ;;
  265. 'publish-keys'|'publish-key'|'publish'|'p')
  266. source "${MHSHAREDIR}/publish_key"
  267. multi_key publish_key "$@"
  268. ;;
  269. 'diagnostics'|'d')
  270. source "${MHSHAREDIR}/diagnostics"
  271. diagnostics
  272. ;;
  273. 'update-pgp-pub-file')
  274. update_pgp_pub_file
  275. ;;
  276. 'version'|'v')
  277. version
  278. ;;
  279. '--help'|'help'|'-h'|'h'|'?')
  280. usage
  281. ;;
  282. *)
  283. failure "Unknown command: '$COMMAND'
  284. Try '$PGRM help' for usage."
  285. ;;
  286. esac