summaryrefslogtreecommitdiff
path: root/src/monkeysphere-server
blob: 4c8ecdcfc48f991c8fd726e40c5fa7190882b75a (plain)
  1. #!/bin/bash
  2. # monkeysphere-server: MonkeySphere server admin tool
  3. #
  4. # The monkeysphere scripts are written by:
  5. # Jameson Rollins <jrollins@fifthhorseman.net>
  6. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  7. #
  8. # They are Copyright 2008, and are all released under the GPL, version 3
  9. # or later.
  10. ########################################################################
  11. PGRM=$(basename $0)
  12. SHARE=${MONKEYSPHERE_SHARE:="/usr/share/monkeysphere"}
  13. export SHARE
  14. . "${SHARE}/common" || exit 1
  15. VARLIB="/var/lib/monkeysphere"
  16. export VARLIB
  17. # date in UTF format if needed
  18. DATE=$(date -u '+%FT%T')
  19. # unset some environment variables that could screw things up
  20. unset GREP_OPTIONS
  21. # default return code
  22. RETURN=0
  23. ########################################################################
  24. # FUNCTIONS
  25. ########################################################################
  26. usage() {
  27. cat <<EOF
  28. usage: $PGRM <subcommand> [options] [args]
  29. MonkeySphere server admin tool.
  30. subcommands:
  31. update-users (u) [USER]... update user authorized_keys files
  32. gen-key (g) [NAME[:PORT]] generate gpg key for the server
  33. --length (-l) BITS key length in bits (2048)
  34. --expire (-e) EXPIRE date to expire
  35. --revoker (-r) FINGERPRINT add a revoker
  36. extend-key (e) EXPIRE extend expiration to EXPIRE
  37. add-hostname (n+) NAME[:PORT] add hostname user ID to server key
  38. revoke-hostname (n-) NAME[:PORT] revoke hostname user ID
  39. show-key (s) output all server host key information
  40. publish-key (p) publish server host key to keyserver
  41. diagnostics (d) report on server monkeysphere status
  42. add-id-certifier (c+) KEYID import and tsign a certification key
  43. --domain (-n) DOMAIN limit ID certifications to DOMAIN
  44. --trust (-t) TRUST trust level of certifier (full)
  45. --depth (-d) DEPTH trust depth for certifier (1)
  46. remove-id-certifier (c-) KEYID remove a certification key
  47. list-id-certifiers (c) list certification keys
  48. gpg-authentication-cmd CMD gnupg-authentication command
  49. help (h,?) this help
  50. EOF
  51. }
  52. su_monkeysphere_user() {
  53. su --preserve-environment "$MONKEYSPHERE_USER" -- -c "$@"
  54. }
  55. # function to interact with the host gnupg keyring
  56. gpg_host() {
  57. local returnCode
  58. GNUPGHOME="$GNUPGHOME_HOST"
  59. export GNUPGHOME
  60. # NOTE: we supress this warning because we need the monkeysphere
  61. # user to be able to read the host pubring. we realize this might
  62. # be problematic, but it's the simplest solution, without too much
  63. # loss of security.
  64. gpg --no-permission-warning "$@"
  65. returnCode="$?"
  66. # always reset the permissions on the host pubring so that the
  67. # monkeysphere user can read the trust signatures
  68. chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_HOST}/pubring.gpg"
  69. chmod g+r "${GNUPGHOME_HOST}/pubring.gpg"
  70. return "$returnCode"
  71. }
  72. # function to interact with the authentication gnupg keyring
  73. # FIXME: this function requires basically accepts only a single
  74. # argument because of problems with quote expansion. this needs to be
  75. # fixed/improved.
  76. gpg_authentication() {
  77. GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
  78. export GNUPGHOME
  79. su_monkeysphere_user "gpg $@"
  80. }
  81. # output just key fingerprint
  82. fingerprint_server_key() {
  83. gpg_host --list-secret-keys --fingerprint \
  84. --with-colons --fixed-list-mode 2> /dev/null | \
  85. grep '^fpr:' | head -1 | cut -d: -f10
  86. }
  87. # output key information
  88. show_server_key() {
  89. local fingerprint
  90. local tmpkey
  91. fingerprint=$(fingerprint_server_key)
  92. gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprint"
  93. # dumping to a file named ' ' so that the ssh-keygen output
  94. # doesn't claim any potentially bogus hostname(s):
  95. tmpkey=$(mktemp -d)
  96. gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ "
  97. echo -n "ssh fingerprint: "
  98. (cd "$tmpkey" && ssh-keygen -l -f ' ' | awk '{ print $2 }')
  99. rm -rf "$tmpkey"
  100. echo -n "OpenPGP fingerprint: "
  101. echo "$fingerprint"
  102. }
  103. # update authorized_keys for users
  104. update_users() {
  105. if [ "$1" ] ; then
  106. # get users from command line
  107. unames="$@"
  108. else
  109. # or just look at all users if none specified
  110. unames=$(getent passwd | cut -d: -f1)
  111. fi
  112. # set mode
  113. MODE="authorized_keys"
  114. # set gnupg home
  115. GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
  116. # check to see if the gpg trust database has been initialized
  117. if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
  118. failure "GNUPG trust database uninitialized. Please see MONKEYSPHERE-SERVER(8)."
  119. fi
  120. # make sure the authorized_keys directory exists
  121. mkdir -p "${VARLIB}/authorized_keys"
  122. # loop over users
  123. for uname in $unames ; do
  124. # check all specified users exist
  125. if ! getent passwd "$uname" >/dev/null ; then
  126. log "----- unknown user '$uname' -----"
  127. continue
  128. fi
  129. # set authorized_user_ids and raw authorized_keys variables,
  130. # translating ssh-style path variables
  131. authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
  132. rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
  133. # if neither is found, skip user
  134. if [ ! -s "$authorizedUserIDs" ] ; then
  135. if [ "$rawAuthorizedKeys" = '-' -o ! -s "$rawAuthorizedKeys" ] ; then
  136. continue
  137. fi
  138. fi
  139. log "----- user: $uname -----"
  140. # exit if the authorized_user_ids file is empty
  141. if ! check_key_file_permissions "$uname" "$AUTHORIZED_USER_IDS" ; then
  142. log "Improper permissions on authorized_user_ids file path."
  143. continue
  144. fi
  145. # check permissions on the authorized_keys file path
  146. if ! check_key_file_permissions "$uname" "$RAW_AUTHORIZED_KEYS" ; then
  147. log "Improper permissions on authorized_keys file path path."
  148. continue
  149. fi
  150. # make temporary directory
  151. TMPDIR=$(mktemp -d)
  152. # trap to delete temporary directory on exit
  153. trap "rm -rf $TMPDIR" EXIT
  154. # create temporary authorized_user_ids file
  155. TMP_AUTHORIZED_USER_IDS="${TMPDIR}/authorized_user_ids"
  156. touch "$TMP_AUTHORIZED_USER_IDS"
  157. # create temporary authorized_keys file
  158. AUTHORIZED_KEYS="${TMPDIR}/authorized_keys"
  159. touch "$AUTHORIZED_KEYS"
  160. # set restrictive permissions on the temporary files
  161. # FIXME: is there a better way to do this?
  162. chmod 0700 "$TMPDIR"
  163. chmod 0600 "$AUTHORIZED_KEYS"
  164. chmod 0600 "$TMP_AUTHORIZED_USER_IDS"
  165. chown -R "$MONKEYSPHERE_USER" "$TMPDIR"
  166. # if the authorized_user_ids file exists...
  167. if [ -s "$authorizedUserIDs" ] ; then
  168. # copy user authorized_user_ids file to temporary
  169. # location
  170. cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
  171. # export needed variables
  172. export AUTHORIZED_KEYS
  173. export TMP_AUTHORIZED_USER_IDS
  174. # process authorized_user_ids file, as monkeysphere
  175. # user
  176. su_monkeysphere_user \
  177. ". ${SHARE}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
  178. RETURN="$?"
  179. fi
  180. # add user-controlled authorized_keys file path if specified
  181. if [ "$rawAuthorizedKeys" != '-' -a -s "$rawAuthorizedKeys" ] ; then
  182. log -n "adding raw authorized_keys file... "
  183. cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
  184. loge "done."
  185. fi
  186. # openssh appears to check the contents of the
  187. # authorized_keys file as the user in question, so the
  188. # file must be readable by that user at least.
  189. # FIXME: is there a better way to do this?
  190. chown root "$AUTHORIZED_KEYS"
  191. chgrp $(getent passwd "$uname" | cut -f4 -d:) "$AUTHORIZED_KEYS"
  192. chmod g+r "$AUTHORIZED_KEYS"
  193. # move the resulting authorized_keys file into place
  194. mv -f "$AUTHORIZED_KEYS" "${VARLIB}/authorized_keys/${uname}"
  195. # destroy temporary directory
  196. rm -rf "$TMPDIR"
  197. done
  198. }
  199. # generate server gpg key
  200. gen_key() {
  201. local keyType
  202. local keyLength
  203. local keyUsage
  204. local keyExpire
  205. local revoker
  206. local hostName
  207. local userID
  208. local keyParameters
  209. local fingerprint
  210. # set default key parameter values
  211. keyType="RSA"
  212. keyLength="2048"
  213. keyUsage="auth"
  214. keyExpire=
  215. revoker=
  216. # get options
  217. TEMP=$(getopt -o e:l:r -l expire:,length:,revoker: -n "$PGRM" -- "$@")
  218. if [ $? != 0 ] ; then
  219. exit 1
  220. fi
  221. # Note the quotes around `$TEMP': they are essential!
  222. eval set -- "$TEMP"
  223. while true ; do
  224. case "$1" in
  225. -l|--length)
  226. keyLength="$2"
  227. shift 2
  228. ;;
  229. -e|--expire)
  230. keyExpire="$2"
  231. shift 2
  232. ;;
  233. -r|--revoker)
  234. revoker="$2"
  235. shift 2
  236. ;;
  237. --)
  238. shift
  239. ;;
  240. *)
  241. break
  242. ;;
  243. esac
  244. done
  245. hostName=${1:-$(hostname --fqdn)}
  246. userID="ssh://${hostName}"
  247. # check for presense of key with user ID
  248. if gpg_host --list-key ="$userID" > /dev/null 2>&1 ; then
  249. failure "Key for '$userID' already exists"
  250. fi
  251. # prompt about key expiration if not specified
  252. keyExpire=$(get_gpg_expiration "$keyExpire")
  253. # set key parameters
  254. keyParameters=$(cat <<EOF
  255. Key-Type: $keyType
  256. Key-Length: $keyLength
  257. Key-Usage: $keyUsage
  258. Name-Real: $userID
  259. Expire-Date: $keyExpire
  260. EOF
  261. )
  262. # add the revoker field if specified
  263. # FIXME: the "1:" below assumes that $REVOKER's key is an RSA key.
  264. # FIXME: key is marked "sensitive"? is this appropriate?
  265. if [ "$revoker" ] ; then
  266. keyParameters="${keyParameters}"$(cat <<EOF
  267. Revoker: 1:$revoker sensitive
  268. EOF
  269. )
  270. fi
  271. echo "The following key parameters will be used for the host private key:"
  272. echo "$keyParameters"
  273. read -p "Generate key? (Y/n) " OK; OK=${OK:=Y}
  274. if [ ${OK/y/Y} != 'Y' ] ; then
  275. failure "aborting."
  276. fi
  277. # add commit command
  278. keyParameters="${keyParameters}"$(cat <<EOF
  279. %commit
  280. %echo done
  281. EOF
  282. )
  283. log "generating server key..."
  284. echo "$keyParameters" | gpg_host --batch --gen-key
  285. # output the server fingerprint
  286. fingerprint_server_key "=${userID}"
  287. # find the key fingerprint of the newly generated key
  288. fingerprint=$(fingerprint_server_key)
  289. # export host ownertrust to authentication keyring
  290. log "setting ultimate owner trust for server key..."
  291. echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
  292. # translate the private key to ssh format, and export to a file
  293. # for sshs usage.
  294. # NOTE: assumes that the primary key is the proper key to use
  295. (umask 077 && \
  296. gpg_host --export-secret-key "$fingerprint" | \
  297. openpgp2ssh "$fingerprint" > "${VARLIB}/ssh_host_rsa_key")
  298. log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key"
  299. }
  300. # extend the lifetime of a host key:
  301. extend_key() {
  302. local fpr=$(fingerprint_server_key)
  303. local extendTo="$1"
  304. if [ -z "$fpr" ] ; then
  305. failure "You don't appear to have a MonkeySphere host key on this server. Try 'monkeysphere-server gen-key' first."
  306. fi
  307. # get the new expiration date
  308. extendTo=$(get_gpg_expiration "$extendTo")
  309. gpg_host --quiet --command-fd 0 --edit-key "$fpr" <<EOF
  310. expire
  311. $extendTo
  312. save
  313. EOF
  314. echo
  315. echo "NOTE: Host key expiration date adjusted, but not yet published."
  316. echo "Run '$PGRM publish-key' to publish the new expiration date."
  317. }
  318. # add hostname user ID to server key
  319. add_hostname() {
  320. local userID
  321. local fingerprint
  322. local tmpuidMatch
  323. local line
  324. local adduidCommand
  325. if [ -z "$1" ] ; then
  326. failure "You must specify a hostname to add."
  327. fi
  328. userID="ssh://${1}"
  329. fingerprint=$(fingerprint_server_key)
  330. # match to only ultimately trusted user IDs
  331. tmpuidMatch="u:$(echo $userID | gpg_escape)"
  332. # find the index of the requsted user ID
  333. # NOTE: this is based on circumstantial evidence that the order of
  334. # this output is the appropriate index
  335. if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \
  336. | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then
  337. failure "Host userID '$userID' already exists."
  338. fi
  339. echo "The following user ID will be added to the host key:"
  340. echo " $userID"
  341. read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N}
  342. if [ ${OK/y/Y} != 'Y' ] ; then
  343. failure "User ID not added."
  344. fi
  345. # edit-key script command to add user ID
  346. adduidCommand=$(cat <<EOF
  347. adduid
  348. $userID
  349. save
  350. EOF
  351. )
  352. # execute edit-key script
  353. if echo "$adduidCommand" | \
  354. gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
  355. # update the trustdb for the authentication keyring
  356. gpg_authentication "--check-trustdb"
  357. show_server_key
  358. echo
  359. echo "NOTE: User ID added to key, but key not published."
  360. echo "Run '$PGRM publish-key' to publish the new user ID."
  361. else
  362. failure "Problem adding user ID."
  363. fi
  364. }
  365. # revoke hostname user ID to server key
  366. revoke_hostname() {
  367. local userID
  368. local fingerprint
  369. local tmpuidMatch
  370. local line
  371. local uidIndex
  372. local message
  373. local revuidCommand
  374. if [ -z "$1" ] ; then
  375. failure "You must specify a hostname to revoke."
  376. fi
  377. echo "WARNING: There is a known bug in this function."
  378. echo "This function has been known to occasionally revoke the wrong user ID."
  379. echo "Please see the following bug report for more information:"
  380. echo "http://monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/"
  381. read -p "Are you sure you would like to proceed? (y/N) " OK; OK=${OK:=N}
  382. if [ ${OK/y/Y} != 'Y' ] ; then
  383. failure "aborting."
  384. fi
  385. userID="ssh://${1}"
  386. fingerprint=$(fingerprint_server_key)
  387. # match to only ultimately trusted user IDs
  388. tmpuidMatch="u:$(echo $userID | gpg_escape)"
  389. # find the index of the requsted user ID
  390. # NOTE: this is based on circumstantial evidence that the order of
  391. # this output is the appropriate index
  392. if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \
  393. | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then
  394. uidIndex=${line%%:*}
  395. else
  396. failure "No non-revoked user ID '$userID' is found."
  397. fi
  398. echo "The following host key user ID will be revoked:"
  399. echo " $userID"
  400. read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N}
  401. if [ ${OK/y/Y} != 'Y' ] ; then
  402. failure "User ID not revoked."
  403. fi
  404. message="Hostname removed by monkeysphere-server $DATE"
  405. # edit-key script command to revoke user ID
  406. revuidCommand=$(cat <<EOF
  407. $uidIndex
  408. revuid
  409. y
  410. 4
  411. $message
  412. y
  413. save
  414. EOF
  415. )
  416. # execute edit-key script
  417. if echo "$revuidCommand" | \
  418. gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
  419. # update the trustdb for the authentication keyring
  420. gpg_authentication "--check-trustdb"
  421. show_server_key
  422. echo
  423. echo "NOTE: User ID revoked, but revocation not published."
  424. echo "Run '$PGRM publish-key' to publish the revocation."
  425. else
  426. failure "Problem revoking user ID."
  427. fi
  428. }
  429. # publish server key to keyserver
  430. publish_server_key() {
  431. read -p "Really publish host key to $KEYSERVER? (y/N) " OK; OK=${OK:=N}
  432. if [ ${OK/y/Y} != 'Y' ] ; then
  433. failure "key not published."
  434. fi
  435. # find the key fingerprint
  436. fingerprint=$(fingerprint_server_key)
  437. # publish host key
  438. gpg_authentication "--keyserver $KEYSERVER --send-keys '0x${fingerprint}!'"
  439. }
  440. diagnostics() {
  441. # * check on the status and validity of the key and public certificates
  442. local seckey
  443. local keysfound
  444. local curdate
  445. local warnwindow
  446. local warndate
  447. local create
  448. local expire
  449. local uid
  450. local fingerprint
  451. local badhostkeys
  452. local sshd_config
  453. # FIXME: what's the correct, cross-platform answer?
  454. sshd_config=/etc/ssh/sshd_config
  455. seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
  456. keysfound=$(echo "$seckey" | grep -c ^sec:)
  457. curdate=$(date +%s)
  458. # warn when anything is 2 months away from expiration
  459. warnwindow='2 months'
  460. warndate=$(date +%s -d "$warnwindow")
  461. echo "Checking host GPG key..."
  462. if (( "$keysfound" < 1 )); then
  463. echo "! No host key found."
  464. echo " - Recommendation: run 'monkeysphere-server gen-key'"
  465. elif (( "$keysfound" > 1 )); then
  466. echo "! More than one host key found?"
  467. # FIXME: recommend a way to resolve this
  468. else
  469. create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
  470. expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
  471. fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
  472. # check for key expiration:
  473. if [ "$expire" ]; then
  474. if (( "$expire" < "$curdate" )); then
  475. echo "! Host key is expired."
  476. echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
  477. elif (( "$expire" < "$warndate" )); then
  478. echo "! Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
  479. echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
  480. fi
  481. fi
  482. # and weirdnesses:
  483. if [ "$create" ] && (( "$create" > "$curdate" )); then
  484. echo "! Host key was created in the future(?!). Is your clock correct?"
  485. echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
  486. fi
  487. # check for UserID expiration:
  488. echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
  489. while IFS=: read create expire uid ; do
  490. # FIXME: should we be doing any checking on the form
  491. # of the User ID? Should we be unmangling it somehow?
  492. if [ "$create" ] && (( "$create" > "$curdate" )); then
  493. echo "! User ID '$uid' was created in the future(?!). Is your clock correct?"
  494. echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
  495. fi
  496. if [ "$expire" ] ; then
  497. if (( "$expire" < "$curdate" )); then
  498. echo "! User ID '$uid' is expired."
  499. # FIXME: recommend a way to resolve this
  500. elif (( "$expire" < "$warndate" )); then
  501. echo "! User ID '$uid' expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
  502. # FIXME: recommend a way to resolve this
  503. fi
  504. fi
  505. done
  506. # FIXME: verify that the host key is properly published to the
  507. # keyservers (do this with the non-privileged user)
  508. # FIXME: check that there are valid, non-expired certifying signatures
  509. # attached to the host key after fetching from the public keyserver
  510. # (do this with the non-privileged user as well)
  511. # FIXME: propose adding a revoker to the host key if none exist (do we
  512. # have a way to do that after key generation?)
  513. # Ensure that the ssh_host_rsa_key file is present and non-empty:
  514. echo
  515. echo "Checking host SSH key..."
  516. if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
  517. echo "! The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty."
  518. else
  519. if [ $(stat -c '%a' "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
  520. echo "! Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600."
  521. fi
  522. # propose changes needed for sshd_config (if any)
  523. if ! grep -q "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$" "$sshd_config"; then
  524. echo "! $sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
  525. echo " - Recommendation: add a line to $sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
  526. fi
  527. if badhostkeys=$(grep -i '^HostKey' "$sshd_config" | grep -q -v "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$") ; then
  528. echo "! $sshd_config refers to some non-monkeysphere host keys:"
  529. echo "$badhostkeys"
  530. echo " - Recommendation: remove the above HostKey lines from $sshd_config"
  531. fi
  532. fi
  533. fi
  534. # FIXME: look at the ownership/privileges of the various keyrings,
  535. # directories housing them, etc (what should those values be? can
  536. # we make them as minimal as possible?)
  537. # FIXME: look to see that the ownertrust rules are set properly on the
  538. # authentication keyring
  539. # FIXME: make sure that at least one identity certifier exists
  540. echo
  541. echo "Checking for MonkeySphere-enabled public-key authentication for users ..."
  542. # Ensure that User ID authentication is enabled:
  543. if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$" "$sshd_config"; then
  544. echo "! $sshd_config does not point to monkeysphere authorized keys."
  545. echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${VARLIB}/authorized_keys/%u'"
  546. fi
  547. if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -q -v "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$") ; then
  548. echo "! $sshd_config refers to non-monkeysphere authorized_keys files:"
  549. echo "$badauthorizedkeys"
  550. echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config"
  551. fi
  552. }
  553. # retrieve key from web of trust, import it into the host keyring, and
  554. # ltsign the key in the host keyring so that it may certify other keys
  555. add_certifier() {
  556. local domain
  557. local trust
  558. local depth
  559. local keyID
  560. local fingerprint
  561. local ltsignCommand
  562. local trustval
  563. # set default values for trust depth and domain
  564. domain=
  565. trust=full
  566. depth=1
  567. # get options
  568. TEMP=$(getopt -o n:t:d: -l domain:,trust:,depth: -n "$PGRM" -- "$@")
  569. if [ $? != 0 ] ; then
  570. exit 1
  571. fi
  572. # Note the quotes around `$TEMP': they are essential!
  573. eval set -- "$TEMP"
  574. while true ; do
  575. case "$1" in
  576. -n|--domain)
  577. domain="$2"
  578. shift 2
  579. ;;
  580. -t|--trust)
  581. trust="$2"
  582. shift 2
  583. ;;
  584. -d|--depth)
  585. depth="$2"
  586. shift 2
  587. ;;
  588. --)
  589. shift
  590. ;;
  591. *)
  592. break
  593. ;;
  594. esac
  595. done
  596. keyID="$1"
  597. if [ -z "$keyID" ] ; then
  598. failure "You must specify the key ID of a key to add."
  599. fi
  600. export keyID
  601. # get the key from the key server
  602. gpg_authentication "--keyserver $KEYSERVER --recv-key '0x${keyID}!'"
  603. # get the full fingerprint of a key ID
  604. fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint 0x${keyID}!" | \
  605. grep '^fpr:' | grep "$keyID" | cut -d: -f10)
  606. if [ -z "$fingerprint" ] ; then
  607. failure "Key '$keyID' not found."
  608. fi
  609. echo
  610. echo "key found:"
  611. gpg_authentication "--fingerprint 0x${fingerprint}!"
  612. echo "Are you sure you want to add the above key as a"
  613. read -p "certifier of users on this system? (y/N) " OK; OK=${OK:-N}
  614. if [ "${OK/y/Y}" != 'Y' ] ; then
  615. failure "Identity certifier not added."
  616. fi
  617. # export the key to the host keyring
  618. gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
  619. if [ "$trust" == marginal ]; then
  620. trustval=1
  621. elif [ "$trust" == full ]; then
  622. trustval=2
  623. else
  624. failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)."
  625. fi
  626. # ltsign command
  627. # NOTE: *all* user IDs will be ltsigned
  628. ltsignCommand=$(cat <<EOF
  629. ltsign
  630. y
  631. $trustval
  632. $depth
  633. $domain
  634. y
  635. save
  636. EOF
  637. )
  638. # ltsign the key
  639. if echo "$ltsignCommand" | \
  640. gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
  641. # update the trustdb for the authentication keyring
  642. gpg_authentication "--check-trustdb"
  643. echo
  644. echo "Identity certifier added."
  645. else
  646. failure "Problem adding identify certifier."
  647. fi
  648. }
  649. # delete a certifiers key from the host keyring
  650. remove_certifier() {
  651. local keyID
  652. local fingerprint
  653. keyID="$1"
  654. if [ -z "$keyID" ] ; then
  655. failure "You must specify the key ID of a key to remove."
  656. fi
  657. if gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then
  658. read -p "Really remove above listed identity certifier? (y/N) " OK; OK=${OK:-N}
  659. if [ "${OK/y/Y}" != 'Y' ] ; then
  660. failure "Identity certifier not removed."
  661. fi
  662. else
  663. failure
  664. fi
  665. # delete the requested key
  666. if gpg_authentication "--delete-key --batch --yes 0x${keyID}!" ; then
  667. # delete key from host keyring as well
  668. gpg_host --delete-key --batch --yes "0x${keyID}!"
  669. # update the trustdb for the authentication keyring
  670. gpg_authentication "--check-trustdb"
  671. echo
  672. echo "Identity certifier removed."
  673. else
  674. failure "Problem removing identity certifier."
  675. fi
  676. }
  677. # list the host certifiers
  678. list_certifiers() {
  679. local keys
  680. local key
  681. # find trusted keys in authentication keychain
  682. keys=$(gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \
  683. grep ^pub: | cut -d: -f2,5 | egrep '^(u|f):' | cut -d: -f2)
  684. # output keys
  685. for key in $keys ; do
  686. gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key"
  687. done
  688. }
  689. # issue command to gpg-authentication keyring
  690. gpg_authentication_cmd() {
  691. gpg_authentication "$@"
  692. }
  693. ########################################################################
  694. # MAIN
  695. ########################################################################
  696. # unset variables that should be defined only in config file
  697. unset KEYSERVER
  698. unset AUTHORIZED_USER_IDS
  699. unset RAW_AUTHORIZED_KEYS
  700. unset MONKEYSPHERE_USER
  701. # load configuration file
  702. [ -e ${MONKEYSPHERE_SERVER_CONFIG:="${ETC}/monkeysphere-server.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG"
  703. # set empty config variable with ones from the environment, or with
  704. # defaults
  705. KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="subkeys.pgp.net"}}
  706. AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:=${AUTHORIZED_USER_IDS:="%h/.config/monkeysphere/authorized_user_ids"}}
  707. RAW_AUTHORIZED_KEYS=${MONKEYSPHERE_RAW_AUTHORIZED_KEYS:=${RAW_AUTHORIZED_KEYS:="%h/.ssh/authorized_keys"}}
  708. MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkeysphere"}}
  709. # other variables
  710. CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"}
  711. REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
  712. GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${VARLIB}/gnupg-host"}
  713. GNUPGHOME_AUTHENTICATION=${MONKEYSPHERE_GNUPGHOME_AUTHENTICATION:="${VARLIB}/gnupg-authentication"}
  714. # export variables needed in su invocation
  715. export DATE
  716. export MODE
  717. export MONKEYSPHERE_USER
  718. export KEYSERVER
  719. export CHECK_KEYSERVER
  720. export REQUIRED_USER_KEY_CAPABILITY
  721. export GNUPGHOME_HOST
  722. export GNUPGHOME_AUTHENTICATION
  723. export GNUPGHOME
  724. # get subcommand
  725. COMMAND="$1"
  726. [ "$COMMAND" ] || failure "Type '$PGRM help' for usage."
  727. shift
  728. case $COMMAND in
  729. 'update-users'|'update-user'|'u')
  730. update_users "$@"
  731. ;;
  732. 'gen-key'|'g')
  733. gen_key "$@"
  734. ;;
  735. 'extend-key'|'e')
  736. extend_key "$@"
  737. ;;
  738. 'add-hostname'|'add-name'|'n+')
  739. add_hostname "$@"
  740. ;;
  741. 'revoke-hostname'|'revoke-name'|'n-')
  742. revoke_hostname "$@"
  743. ;;
  744. 'show-key'|'show'|'s')
  745. show_server_key
  746. ;;
  747. 'publish-key'|'publish'|'p')
  748. publish_server_key
  749. ;;
  750. 'diagnostics'|'d')
  751. diagnostics
  752. ;;
  753. 'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
  754. add_certifier "$@"
  755. ;;
  756. 'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
  757. remove_certifier "$@"
  758. ;;
  759. 'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
  760. list_certifiers "$@"
  761. ;;
  762. 'gpg-authentication-cmd')
  763. gpg_authentication_cmd "$@"
  764. ;;
  765. '--help'|'help'|'-h'|'h'|'?')
  766. usage
  767. ;;
  768. *)
  769. failure "Unknown command: '$COMMAND'
  770. Type '$PGRM help' for usage."
  771. ;;
  772. esac
  773. exit "$RETURN"