summaryrefslogtreecommitdiff
path: root/src/monkeysphere-server
blob: 0b63e5cefb476f637642ba46ee4bec58bb6c8600 (plain)
  1. #!/usr/bin/env bash
  2. # monkeysphere-server: MonkeySphere server admin tool
  3. #
  4. # The monkeysphere scripts are written by:
  5. # Jameson Rollins <jrollins@fifthhorseman.net>
  6. # Jamie McClelland <jm@mayfirst.org>
  7. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  8. #
  9. # They are Copyright 2008, and are all released under the GPL, version 3
  10. # or later.
  11. ########################################################################
  12. PGRM=$(basename $0)
  13. SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
  14. export SYSSHAREDIR
  15. . "${SYSSHAREDIR}/common" || exit 1
  16. SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
  17. export SYSDATADIR
  18. # monkeysphere temp directory, in sysdatadir to enable atomic moves of
  19. # authorized_keys files
  20. MSTMPDIR="${SYSDATADIR}/tmp"
  21. export MSTMPDIR
  22. # UTC date in ISO 8601 format if needed
  23. DATE=$(date -u '+%FT%T')
  24. # unset some environment variables that could screw things up
  25. unset GREP_OPTIONS
  26. # default return code
  27. RETURN=0
  28. ########################################################################
  29. # FUNCTIONS
  30. ########################################################################
  31. usage() {
  32. cat <<EOF >&2
  33. usage: $PGRM <subcommand> [options] [args]
  34. Monkeysphere server admin tool.
  35. subcommands:
  36. update-users (u) [USER]... update user authorized_keys files
  37. gen-key (g) [NAME[:PORT]] generate gpg key for the server
  38. --length (-l) BITS key length in bits (2048)
  39. --expire (-e) EXPIRE date to expire
  40. --revoker (-r) FINGERPRINT add a revoker
  41. extend-key (e) EXPIRE extend expiration to EXPIRE
  42. add-hostname (n+) NAME[:PORT] add hostname user ID to server key
  43. revoke-hostname (n-) NAME[:PORT] revoke hostname user ID
  44. show-key (s) output all server host key information
  45. publish-key (p) publish server host key to keyserver
  46. diagnostics (d) report on server monkeysphere status
  47. add-id-certifier (c+) KEYID import and tsign a certification key
  48. --domain (-n) DOMAIN limit ID certifications to DOMAIN
  49. --trust (-t) TRUST trust level of certifier (full)
  50. --depth (-d) DEPTH trust depth for certifier (1)
  51. remove-id-certifier (c-) KEYID remove a certification key
  52. list-id-certifiers (c) list certification keys
  53. gpg-authentication-cmd CMD gnupg-authentication command
  54. help (h,?) this help
  55. EOF
  56. }
  57. # function to run command as monkeysphere user
  58. su_monkeysphere_user() {
  59. # if the current user is the monkeysphere user, then just eval
  60. # command
  61. if [ $(id -un) = "$MONKEYSPHERE_USER" ] ; then
  62. eval "$@"
  63. # otherwise su command as monkeysphere user
  64. else
  65. su "$MONKEYSPHERE_USER" -c "$@"
  66. fi
  67. }
  68. # function to interact with the host gnupg keyring
  69. gpg_host() {
  70. local returnCode
  71. GNUPGHOME="$GNUPGHOME_HOST"
  72. export GNUPGHOME
  73. # NOTE: we supress this warning because we need the monkeysphere
  74. # user to be able to read the host pubring. we realize this might
  75. # be problematic, but it's the simplest solution, without too much
  76. # loss of security.
  77. gpg --no-permission-warning "$@"
  78. returnCode="$?"
  79. # always reset the permissions on the host pubring so that the
  80. # monkeysphere user can read the trust signatures
  81. chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_HOST}/pubring.gpg"
  82. chmod g+r "${GNUPGHOME_HOST}/pubring.gpg"
  83. return "$returnCode"
  84. }
  85. # function to interact with the authentication gnupg keyring
  86. # FIXME: this function requires basically accepts only a single
  87. # argument because of problems with quote expansion. this needs to be
  88. # fixed/improved.
  89. gpg_authentication() {
  90. GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
  91. export GNUPGHOME
  92. su_monkeysphere_user "gpg $@"
  93. }
  94. # output just key fingerprint
  95. fingerprint_server_key() {
  96. gpg_host --list-secret-keys --fingerprint \
  97. --with-colons --fixed-list-mode 2> /dev/null | \
  98. grep '^fpr:' | head -1 | cut -d: -f10
  99. }
  100. # output key information
  101. show_server_key() {
  102. local fingerprint
  103. local tmpkey
  104. fingerprint=$(fingerprint_server_key)
  105. gpg_authentication "--fingerprint --list-key --list-options show-unusable-uids $fingerprint"
  106. # dumping to a file named ' ' so that the ssh-keygen output
  107. # doesn't claim any potentially bogus hostname(s):
  108. tmpkey=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
  109. gpg_authentication "--export $fingerprint" | openpgp2ssh "$fingerprint" 2>/dev/null > "$tmpkey/ "
  110. echo -n "ssh fingerprint: "
  111. (cd "$tmpkey" && ssh-keygen -l -f ' ' | awk '{ print $2 }')
  112. rm -rf "$tmpkey"
  113. echo -n "OpenPGP fingerprint: "
  114. echo "$fingerprint"
  115. }
  116. # update authorized_keys for users
  117. update_users() {
  118. if [ "$1" ] ; then
  119. # get users from command line
  120. unames="$@"
  121. else
  122. # or just look at all users if none specified
  123. unames=$(getent passwd | cut -d: -f1)
  124. fi
  125. RETCODE=0
  126. # set mode
  127. MODE="authorized_keys"
  128. # set gnupg home
  129. GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
  130. # check to see if the gpg trust database has been initialized
  131. if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
  132. failure "GNUPG trust database uninitialized. Please see MONKEYSPHERE-SERVER(8)."
  133. fi
  134. # make sure the authorized_keys directory exists
  135. mkdir -p "${SYSDATADIR}/authorized_keys"
  136. # loop over users
  137. for uname in $unames ; do
  138. # check all specified users exist
  139. if ! id "$uname" >/dev/null ; then
  140. log error "----- unknown user '$uname' -----"
  141. continue
  142. fi
  143. log verbose "----- user: $uname -----"
  144. # make temporary directory
  145. TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX)
  146. # trap to delete temporary directory on exit
  147. trap "rm -rf $TMPLOC" EXIT
  148. # create temporary authorized_user_ids file
  149. TMP_AUTHORIZED_USER_IDS="${TMPLOC}/authorized_user_ids"
  150. touch "$TMP_AUTHORIZED_USER_IDS"
  151. # create temporary authorized_keys file
  152. AUTHORIZED_KEYS="${TMPLOC}/authorized_keys"
  153. touch "$AUTHORIZED_KEYS"
  154. # set restrictive permissions on the temporary files
  155. # FIXME: is there a better way to do this?
  156. chmod 0700 "$TMPLOC"
  157. chmod 0600 "$AUTHORIZED_KEYS"
  158. chmod 0600 "$TMP_AUTHORIZED_USER_IDS"
  159. chown -R "$MONKEYSPHERE_USER" "$TMPLOC"
  160. # process authorized_user_ids file
  161. log debug "checking for authorized_user_ids..."
  162. # translating ssh-style path variables
  163. authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
  164. if [ -s "$authorizedUserIDs" ] ; then
  165. # check permissions on the authorized_user_ids file path
  166. if check_key_file_permissions "$uname" "$authorizedUserIDs" ; then
  167. # copy user authorized_user_ids file to temporary
  168. # location
  169. cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
  170. # export needed variables
  171. export AUTHORIZED_KEYS
  172. export TMP_AUTHORIZED_USER_IDS
  173. # process authorized_user_ids file, as monkeysphere
  174. # user
  175. su_monkeysphere_user \
  176. ". ${SYSSHAREDIR}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
  177. RETURN="$?"
  178. else
  179. log debug "not processing authorized_user_ids."
  180. fi
  181. else
  182. log debug "empty or absent authorized_user_ids file."
  183. fi
  184. # add user-controlled authorized_keys file if specified
  185. # translate ssh-style path variables
  186. rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
  187. if [ "$rawAuthorizedKeys" ] ; then
  188. log debug "checking for raw authorized_keys..."
  189. if [ -s "$rawAuthorizedKeys" ] ; then
  190. # check permissions on the authorized_keys file path
  191. if check_key_file_permissions "$uname" "$rawAuthorizedKeys" ; then
  192. log verbose "adding raw authorized_keys file... "
  193. cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
  194. else
  195. log debug "not adding raw authorized_keys file."
  196. fi
  197. else
  198. log debug "empty or absent authorized_keys file."
  199. fi
  200. fi
  201. # move the new authorized_keys file into place
  202. if [ -s "$AUTHORIZED_KEYS" ] ; then
  203. # openssh appears to check the contents of the
  204. # authorized_keys file as the user in question, so the
  205. # file must be readable by that user at least.
  206. # but in general, we don't want the user tampering with
  207. # this file directly, so we'll adopt this approach: Own
  208. # the file by the monkeysphere-server invoker (usually
  209. # root, but should be the same uid that sshd is launched
  210. # as); change the group of the file so that members of the
  211. # user's group can read it.
  212. # FIXME: is there a better way to do this?
  213. chown $(whoami) "$AUTHORIZED_KEYS" && \
  214. chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \
  215. chmod g+r "$AUTHORIZED_KEYS" && \
  216. mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \
  217. {
  218. log error "Failed to install authorized_keys for '$uname'!"
  219. rm -f "${SYSDATADIR}/authorized_keys/${uname}"
  220. # indicate that there has been a failure:
  221. RETURN=1
  222. }
  223. else
  224. rm -f "${SYSDATADIR}/authorized_keys/${uname}"
  225. fi
  226. # unset the trap
  227. trap - EXIT
  228. # destroy temporary directory
  229. rm -rf "$TMPLOC"
  230. done
  231. }
  232. # generate server gpg key
  233. gen_key() {
  234. local keyType
  235. local keyLength
  236. local keyUsage
  237. local keyExpire
  238. local revoker
  239. local hostName
  240. local userID
  241. local keyParameters
  242. local fingerprint
  243. # set default key parameter values
  244. keyType="RSA"
  245. keyLength="2048"
  246. keyUsage="auth"
  247. keyExpire=
  248. revoker=
  249. # get options
  250. TEMP=$(PATH="/usr/local/bin:$PATH" getopt -o e:l:r -l expire:,length:,revoker: -n "$PGRM" -- "$@") || failure "getopt failed! Does your getopt support GNU-style long options?"
  251. if [ $? != 0 ] ; then
  252. exit 1
  253. fi
  254. # Note the quotes around `$TEMP': they are essential!
  255. eval set -- "$TEMP"
  256. while true ; do
  257. case "$1" in
  258. -l|--length)
  259. keyLength="$2"
  260. shift 2
  261. ;;
  262. -e|--expire)
  263. keyExpire="$2"
  264. shift 2
  265. ;;
  266. -r|--revoker)
  267. revoker="$2"
  268. shift 2
  269. ;;
  270. --)
  271. shift
  272. ;;
  273. *)
  274. break
  275. ;;
  276. esac
  277. done
  278. hostName=${1:-$(hostname -f)}
  279. userID="ssh://${hostName}"
  280. # check for presense of key with user ID
  281. if gpg_host --list-key ="$userID" > /dev/null 2>&1 ; then
  282. failure "Key for '$userID' already exists"
  283. fi
  284. # prompt about key expiration if not specified
  285. keyExpire=$(get_gpg_expiration "$keyExpire")
  286. # set key parameters
  287. keyParameters=$(cat <<EOF
  288. Key-Type: $keyType
  289. Key-Length: $keyLength
  290. Key-Usage: $keyUsage
  291. Name-Real: $userID
  292. Expire-Date: $keyExpire
  293. EOF
  294. )
  295. # add the revoker field if specified
  296. # FIXME: the "1:" below assumes that $REVOKER's key is an RSA key.
  297. # FIXME: key is marked "sensitive"? is this appropriate?
  298. if [ "$revoker" ] ; then
  299. keyParameters="${keyParameters}"$(cat <<EOF
  300. Revoker: 1:$revoker sensitive
  301. EOF
  302. )
  303. fi
  304. echo "The following key parameters will be used for the host private key:"
  305. echo "$keyParameters"
  306. read -p "Generate key? (Y/n) " OK; OK=${OK:=Y}
  307. if [ ${OK/y/Y} != 'Y' ] ; then
  308. failure "aborting."
  309. fi
  310. # add commit command
  311. keyParameters="${keyParameters}"$(cat <<EOF
  312. %commit
  313. %echo done
  314. EOF
  315. )
  316. log verbose "generating server key..."
  317. echo "$keyParameters" | gpg_host --batch --gen-key
  318. # output the server fingerprint
  319. fingerprint_server_key "=${userID}"
  320. # find the key fingerprint of the newly generated key
  321. fingerprint=$(fingerprint_server_key)
  322. # export host ownertrust to authentication keyring
  323. log verbose "setting ultimate owner trust for server key..."
  324. echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
  325. # translate the private key to ssh format, and export to a file
  326. # for sshs usage.
  327. # NOTE: assumes that the primary key is the proper key to use
  328. (umask 077 && \
  329. gpg_host --export-secret-key "$fingerprint" | \
  330. openpgp2ssh "$fingerprint" > "${SYSDATADIR}/ssh_host_rsa_key")
  331. log info "private SSH host key output to file: ${SYSDATADIR}/ssh_host_rsa_key"
  332. }
  333. # extend the lifetime of a host key:
  334. extend_key() {
  335. local fpr=$(fingerprint_server_key)
  336. local extendTo="$1"
  337. if [ -z "$fpr" ] ; then
  338. failure "You don't appear to have a MonkeySphere host key on this server. Try 'monkeysphere-server gen-key' first."
  339. fi
  340. # get the new expiration date
  341. extendTo=$(get_gpg_expiration "$extendTo")
  342. gpg_host --quiet --command-fd 0 --edit-key "$fpr" <<EOF
  343. expire
  344. $extendTo
  345. save
  346. EOF
  347. echo
  348. echo "NOTE: Host key expiration date adjusted, but not yet published."
  349. echo "Run '$PGRM publish-key' to publish the new expiration date."
  350. }
  351. # add hostname user ID to server key
  352. add_hostname() {
  353. local userID
  354. local fingerprint
  355. local tmpuidMatch
  356. local line
  357. local adduidCommand
  358. if [ -z "$1" ] ; then
  359. failure "You must specify a hostname to add."
  360. fi
  361. userID="ssh://${1}"
  362. fingerprint=$(fingerprint_server_key)
  363. # match to only ultimately trusted user IDs
  364. tmpuidMatch="u:$(echo $userID | gpg_escape)"
  365. # find the index of the requsted user ID
  366. # NOTE: this is based on circumstantial evidence that the order of
  367. # this output is the appropriate index
  368. if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \
  369. | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then
  370. failure "Host userID '$userID' already exists."
  371. fi
  372. echo "The following user ID will be added to the host key:"
  373. echo " $userID"
  374. read -p "Are you sure you would like to add this user ID? (y/N) " OK; OK=${OK:=N}
  375. if [ ${OK/y/Y} != 'Y' ] ; then
  376. failure "User ID not added."
  377. fi
  378. # edit-key script command to add user ID
  379. adduidCommand=$(cat <<EOF
  380. adduid
  381. $userID
  382. save
  383. EOF
  384. )
  385. # execute edit-key script
  386. if echo "$adduidCommand" | \
  387. gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
  388. # update the trustdb for the authentication keyring
  389. gpg_authentication "--check-trustdb"
  390. show_server_key
  391. echo
  392. echo "NOTE: User ID added to key, but key not published."
  393. echo "Run '$PGRM publish-key' to publish the new user ID."
  394. else
  395. failure "Problem adding user ID."
  396. fi
  397. }
  398. # revoke hostname user ID to server key
  399. revoke_hostname() {
  400. local userID
  401. local fingerprint
  402. local tmpuidMatch
  403. local line
  404. local uidIndex
  405. local message
  406. local revuidCommand
  407. if [ -z "$1" ] ; then
  408. failure "You must specify a hostname to revoke."
  409. fi
  410. echo "WARNING: There is a known bug in this function."
  411. echo "This function has been known to occasionally revoke the wrong user ID."
  412. echo "Please see the following bug report for more information:"
  413. echo "http://web.monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/"
  414. read -p "Are you sure you would like to proceed? (y/N) " OK; OK=${OK:=N}
  415. if [ ${OK/y/Y} != 'Y' ] ; then
  416. failure "aborting."
  417. fi
  418. userID="ssh://${1}"
  419. fingerprint=$(fingerprint_server_key)
  420. # match to only ultimately trusted user IDs
  421. tmpuidMatch="u:$(echo $userID | gpg_escape)"
  422. # find the index of the requsted user ID
  423. # NOTE: this is based on circumstantial evidence that the order of
  424. # this output is the appropriate index
  425. if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \
  426. | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then
  427. uidIndex=${line%%:*}
  428. else
  429. failure "No non-revoked user ID '$userID' is found."
  430. fi
  431. echo "The following host key user ID will be revoked:"
  432. echo " $userID"
  433. read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N}
  434. if [ ${OK/y/Y} != 'Y' ] ; then
  435. failure "User ID not revoked."
  436. fi
  437. message="Hostname removed by monkeysphere-server $DATE"
  438. # edit-key script command to revoke user ID
  439. revuidCommand=$(cat <<EOF
  440. $uidIndex
  441. revuid
  442. y
  443. 4
  444. $message
  445. y
  446. save
  447. EOF
  448. )
  449. # execute edit-key script
  450. if echo "$revuidCommand" | \
  451. gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
  452. # update the trustdb for the authentication keyring
  453. gpg_authentication "--check-trustdb"
  454. show_server_key
  455. echo
  456. echo "NOTE: User ID revoked, but revocation not published."
  457. echo "Run '$PGRM publish-key' to publish the revocation."
  458. else
  459. failure "Problem revoking user ID."
  460. fi
  461. }
  462. # publish server key to keyserver
  463. publish_server_key() {
  464. read -p "Really publish host key to $KEYSERVER? (y/N) " OK; OK=${OK:=N}
  465. if [ ${OK/y/Y} != 'Y' ] ; then
  466. failure "key not published."
  467. fi
  468. # find the key fingerprint
  469. fingerprint=$(fingerprint_server_key)
  470. # publish host key
  471. gpg_authentication "--keyserver $KEYSERVER --send-keys '0x${fingerprint}!'"
  472. }
  473. diagnostics() {
  474. # * check on the status and validity of the key and public certificates
  475. local seckey
  476. local keysfound
  477. local curdate
  478. local warnwindow
  479. local warndate
  480. local create
  481. local expire
  482. local uid
  483. local fingerprint
  484. local badhostkeys
  485. local sshd_config
  486. local problemsfound=0
  487. # FIXME: what's the correct, cross-platform answer?
  488. sshd_config=/etc/ssh/sshd_config
  489. seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
  490. keysfound=$(echo "$seckey" | grep -c ^sec:)
  491. curdate=$(date +%s)
  492. # warn when anything is 2 months away from expiration
  493. warnwindow='2 months'
  494. warndate=$(advance_date $warnwindow +%s)
  495. if ! id monkeysphere >/dev/null ; then
  496. echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell."
  497. problemsfound=$(($problemsfound+1))
  498. fi
  499. if ! [ -d "$SYSDATADIR" ] ; then
  500. echo "! no $SYSDATADIR directory found. Please create it."
  501. problemsfound=$(($problemsfound+1))
  502. fi
  503. echo "Checking host GPG key..."
  504. if (( "$keysfound" < 1 )); then
  505. echo "! No host key found."
  506. echo " - Recommendation: run 'monkeysphere-server gen-key'"
  507. problemsfound=$(($problemsfound+1))
  508. elif (( "$keysfound" > 1 )); then
  509. echo "! More than one host key found?"
  510. # FIXME: recommend a way to resolve this
  511. problemsfound=$(($problemsfound+1))
  512. else
  513. create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
  514. expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
  515. fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
  516. # check for key expiration:
  517. if [ "$expire" ]; then
  518. if (( "$expire" < "$curdate" )); then
  519. echo "! Host key is expired."
  520. echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
  521. problemsfound=$(($problemsfound+1))
  522. elif (( "$expire" < "$warndate" )); then
  523. echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
  524. echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
  525. problemsfound=$(($problemsfound+1))
  526. fi
  527. fi
  528. # and weirdnesses:
  529. if [ "$create" ] && (( "$create" > "$curdate" )); then
  530. echo "! Host key was created in the future(?!). Is your clock correct?"
  531. echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
  532. problemsfound=$(($problemsfound+1))
  533. fi
  534. # check for UserID expiration:
  535. echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
  536. while IFS=: read create expire uid ; do
  537. # FIXME: should we be doing any checking on the form
  538. # of the User ID? Should we be unmangling it somehow?
  539. if [ "$create" ] && (( "$create" > "$curdate" )); then
  540. echo "! User ID '$uid' was created in the future(?!). Is your clock correct?"
  541. echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
  542. problemsfound=$(($problemsfound+1))
  543. fi
  544. if [ "$expire" ] ; then
  545. if (( "$expire" < "$curdate" )); then
  546. echo "! User ID '$uid' is expired."
  547. # FIXME: recommend a way to resolve this
  548. problemsfound=$(($problemsfound+1))
  549. elif (( "$expire" < "$warndate" )); then
  550. echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
  551. # FIXME: recommend a way to resolve this
  552. problemsfound=$(($problemsfound+1))
  553. fi
  554. fi
  555. done
  556. # FIXME: verify that the host key is properly published to the
  557. # keyservers (do this with the non-privileged user)
  558. # FIXME: check that there are valid, non-expired certifying signatures
  559. # attached to the host key after fetching from the public keyserver
  560. # (do this with the non-privileged user as well)
  561. # FIXME: propose adding a revoker to the host key if none exist (do we
  562. # have a way to do that after key generation?)
  563. # Ensure that the ssh_host_rsa_key file is present and non-empty:
  564. echo
  565. echo "Checking host SSH key..."
  566. if [ ! -s "${SYSDATADIR}/ssh_host_rsa_key" ] ; then
  567. echo "! The host key as prepared for SSH (${SYSDATADIR}/ssh_host_rsa_key) is missing or empty."
  568. problemsfound=$(($problemsfound+1))
  569. else
  570. if [ $(ls -l "${SYSDATADIR}/ssh_host_rsa_key" | cut -f1 -d\ ) != '-rw-------' ] ; then
  571. echo "! Permissions seem wrong for ${SYSDATADIR}/ssh_host_rsa_key -- should be 0600."
  572. problemsfound=$(($problemsfound+1))
  573. fi
  574. # propose changes needed for sshd_config (if any)
  575. if ! grep -q "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$" "$sshd_config"; then
  576. echo "! $sshd_config does not point to the monkeysphere host key (${SYSDATADIR}/ssh_host_rsa_key)."
  577. echo " - Recommendation: add a line to $sshd_config: 'HostKey ${SYSDATADIR}/ssh_host_rsa_key'"
  578. problemsfound=$(($problemsfound+1))
  579. fi
  580. if badhostkeys=$(grep -i '^HostKey' "$sshd_config" | grep -v "^HostKey[[:space:]]\+${SYSDATADIR}/ssh_host_rsa_key$") ; then
  581. echo "! $sshd_config refers to some non-monkeysphere host keys:"
  582. echo "$badhostkeys"
  583. echo " - Recommendation: remove the above HostKey lines from $sshd_config"
  584. problemsfound=$(($problemsfound+1))
  585. fi
  586. fi
  587. fi
  588. # FIXME: look at the ownership/privileges of the various keyrings,
  589. # directories housing them, etc (what should those values be? can
  590. # we make them as minimal as possible?)
  591. # FIXME: look to see that the ownertrust rules are set properly on the
  592. # authentication keyring
  593. # FIXME: make sure that at least one identity certifier exists
  594. # FIXME: look at the timestamps on the monkeysphere-generated
  595. # authorized_keys files -- warn if they seem out-of-date.
  596. # FIXME: check for a cronjob that updates monkeysphere-generated
  597. # authorized_keys?
  598. echo
  599. echo "Checking for MonkeySphere-enabled public-key authentication for users ..."
  600. # Ensure that User ID authentication is enabled:
  601. if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$" "$sshd_config"; then
  602. echo "! $sshd_config does not point to monkeysphere authorized keys."
  603. echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${SYSDATADIR}/authorized_keys/%u'"
  604. problemsfound=$(($problemsfound+1))
  605. fi
  606. if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -v "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$") ; then
  607. echo "! $sshd_config refers to non-monkeysphere authorized_keys files:"
  608. echo "$badauthorizedkeys"
  609. echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config"
  610. problemsfound=$(($problemsfound+1))
  611. fi
  612. if [ "$problemsfound" -gt 0 ]; then
  613. echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:"
  614. echo " monkeysphere-server diagnostics"
  615. else
  616. echo "Everything seems to be in order!"
  617. fi
  618. }
  619. # retrieve key from web of trust, import it into the host keyring, and
  620. # ltsign the key in the host keyring so that it may certify other keys
  621. add_certifier() {
  622. local domain
  623. local trust
  624. local depth
  625. local keyID
  626. local fingerprint
  627. local ltsignCommand
  628. local trustval
  629. # set default values for trust depth and domain
  630. domain=
  631. trust=full
  632. depth=1
  633. # get options
  634. TEMP=$(PATH="/usr/local/bin:$PATH" getopt -o n:t:d: -l domain:,trust:,depth: -n "$PGRM" -- "$@") || failure "getopt failed! Does your getopt support GNU-style long options?"
  635. if [ $? != 0 ] ; then
  636. exit 1
  637. fi
  638. # Note the quotes around `$TEMP': they are essential!
  639. eval set -- "$TEMP"
  640. while true ; do
  641. case "$1" in
  642. -n|--domain)
  643. domain="$2"
  644. shift 2
  645. ;;
  646. -t|--trust)
  647. trust="$2"
  648. shift 2
  649. ;;
  650. -d|--depth)
  651. depth="$2"
  652. shift 2
  653. ;;
  654. --)
  655. shift
  656. ;;
  657. *)
  658. break
  659. ;;
  660. esac
  661. done
  662. keyID="$1"
  663. if [ -z "$keyID" ] ; then
  664. failure "You must specify the key ID of a key to add, or specify a file to read the key from."
  665. fi
  666. if [ -f "$keyID" ] ; then
  667. echo "Reading key from file '$keyID':"
  668. importinfo=$(gpg_authentication "--import" < "$keyID" 2>&1) || failure "could not read key from '$keyID'"
  669. # FIXME: if this is tried when the key database is not
  670. # up-to-date, i got these errors (using set -x):
  671. # ++ su -m monkeysphere -c '\''gpg --import'\''
  672. # Warning: using insecure memory!
  673. # gpg: key D21739E9: public key "Daniel Kahn Gillmor <dkg@fifthhorseman.net>" imported
  674. # gpg: Total number processed: 1
  675. # gpg: imported: 1 (RSA: 1)
  676. # gpg: can'\''t create `/var/monkeysphere/gnupg-host/pubring.gpg.tmp'\'': Permission denied
  677. # gpg: failed to rebuild keyring cache: Permission denied
  678. # gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
  679. # gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
  680. # gpg: next trustdb check due at 2009-01-10'
  681. # + failure 'could not read key from '\''/root/dkg.gpg'\'''
  682. # + echo 'could not read key from '\''/root/dkg.gpg'\'''
  683. keyID=$(echo "$importinfo" | grep '^gpg: key ' | cut -f2 -d: | cut -f3 -d\ )
  684. if [ -z "$keyID" ] || [ $(echo "$keyID" | wc -l) -ne 1 ] ; then
  685. failure "Expected there to be a single gpg key in the file."
  686. fi
  687. else
  688. # get the key from the key server
  689. gpg_authentication "--keyserver $KEYSERVER --recv-key '0x${keyID}!'" || failure "Could not receive a key with this ID from the '$KEYSERVER' keyserver."
  690. fi
  691. export keyID
  692. # get the full fingerprint of a key ID
  693. fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint 0x${keyID}!" | \
  694. grep '^fpr:' | grep "$keyID" | cut -d: -f10)
  695. if [ -z "$fingerprint" ] ; then
  696. failure "Key '$keyID' not found."
  697. fi
  698. echo
  699. echo "key found:"
  700. gpg_authentication "--fingerprint 0x${fingerprint}!"
  701. echo "Are you sure you want to add the above key as a"
  702. read -p "certifier of users on this system? (y/N) " OK; OK=${OK:-N}
  703. if [ "${OK/y/Y}" != 'Y' ] ; then
  704. failure "Identity certifier not added."
  705. fi
  706. # export the key to the host keyring
  707. gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
  708. if [ "$trust" == marginal ]; then
  709. trustval=1
  710. elif [ "$trust" == full ]; then
  711. trustval=2
  712. else
  713. failure "Trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)."
  714. fi
  715. # ltsign command
  716. # NOTE: *all* user IDs will be ltsigned
  717. ltsignCommand=$(cat <<EOF
  718. ltsign
  719. y
  720. $trustval
  721. $depth
  722. $domain
  723. y
  724. save
  725. EOF
  726. )
  727. # ltsign the key
  728. if echo "$ltsignCommand" | \
  729. gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
  730. # update the trustdb for the authentication keyring
  731. gpg_authentication "--check-trustdb"
  732. echo
  733. echo "Identity certifier added."
  734. else
  735. failure "Problem adding identify certifier."
  736. fi
  737. }
  738. # delete a certifiers key from the host keyring
  739. remove_certifier() {
  740. local keyID
  741. local fingerprint
  742. keyID="$1"
  743. if [ -z "$keyID" ] ; then
  744. failure "You must specify the key ID of a key to remove."
  745. fi
  746. if gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then
  747. read -p "Really remove above listed identity certifier? (y/N) " OK; OK=${OK:-N}
  748. if [ "${OK/y/Y}" != 'Y' ] ; then
  749. failure "Identity certifier not removed."
  750. fi
  751. else
  752. failure
  753. fi
  754. # delete the requested key
  755. if gpg_authentication "--delete-key --batch --yes 0x${keyID}!" ; then
  756. # delete key from host keyring as well
  757. gpg_host --delete-key --batch --yes "0x${keyID}!"
  758. # update the trustdb for the authentication keyring
  759. gpg_authentication "--check-trustdb"
  760. echo
  761. echo "Identity certifier removed."
  762. else
  763. failure "Problem removing identity certifier."
  764. fi
  765. }
  766. # list the host certifiers
  767. list_certifiers() {
  768. local keys
  769. local key
  770. # find trusted keys in authentication keychain
  771. keys=$(gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \
  772. grep ^pub: | cut -d: -f2,5 | egrep '^(u|f):' | cut -d: -f2)
  773. # output keys
  774. for key in $keys ; do
  775. gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key"
  776. done
  777. }
  778. # issue command to gpg-authentication keyring
  779. gpg_authentication_cmd() {
  780. gpg_authentication "$@"
  781. }
  782. ########################################################################
  783. # MAIN
  784. ########################################################################
  785. # unset variables that should be defined only in config file
  786. unset KEYSERVER
  787. unset AUTHORIZED_USER_IDS
  788. unset RAW_AUTHORIZED_KEYS
  789. unset MONKEYSPHERE_USER
  790. # load configuration file
  791. [ -e ${MONKEYSPHERE_SERVER_CONFIG:="${SYSCONFIGDIR}/monkeysphere-server.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG"
  792. # set empty config variable with ones from the environment, or with
  793. # defaults
  794. LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=${LOG_LEVEL:="INFO"}}
  795. KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="pool.sks-keyservers.net"}}
  796. AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:=${AUTHORIZED_USER_IDS:="%h/.monkeysphere/authorized_user_ids"}}
  797. RAW_AUTHORIZED_KEYS=${MONKEYSPHERE_RAW_AUTHORIZED_KEYS:=${RAW_AUTHORIZED_KEYS:="%h/.ssh/authorized_keys"}}
  798. MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkeysphere"}}
  799. # other variables
  800. CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"}
  801. REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
  802. GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${SYSDATADIR}/gnupg-host"}
  803. GNUPGHOME_AUTHENTICATION=${MONKEYSPHERE_GNUPGHOME_AUTHENTICATION:="${SYSDATADIR}/gnupg-authentication"}
  804. # export variables needed in su invocation
  805. export DATE
  806. export MODE
  807. export MONKEYSPHERE_USER
  808. export LOG_LEVEL
  809. export KEYSERVER
  810. export CHECK_KEYSERVER
  811. export REQUIRED_USER_KEY_CAPABILITY
  812. export GNUPGHOME_HOST
  813. export GNUPGHOME_AUTHENTICATION
  814. export GNUPGHOME
  815. # get subcommand
  816. COMMAND="$1"
  817. [ "$COMMAND" ] || failure "Type '$PGRM help' for usage."
  818. shift
  819. case $COMMAND in
  820. 'update-users'|'update-user'|'u')
  821. update_users "$@"
  822. ;;
  823. 'gen-key'|'g')
  824. gen_key "$@"
  825. ;;
  826. 'extend-key'|'e')
  827. extend_key "$@"
  828. ;;
  829. 'add-hostname'|'add-name'|'n+')
  830. add_hostname "$@"
  831. ;;
  832. 'revoke-hostname'|'revoke-name'|'n-')
  833. revoke_hostname "$@"
  834. ;;
  835. 'show-key'|'show'|'s')
  836. show_server_key
  837. ;;
  838. 'publish-key'|'publish'|'p')
  839. publish_server_key
  840. ;;
  841. 'diagnostics'|'d')
  842. diagnostics
  843. ;;
  844. 'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
  845. add_certifier "$@"
  846. ;;
  847. 'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
  848. remove_certifier "$@"
  849. ;;
  850. 'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
  851. list_certifiers "$@"
  852. ;;
  853. 'gpg-authentication-cmd')
  854. gpg_authentication_cmd "$@"
  855. ;;
  856. '--help'|'help'|'-h'|'h'|'?')
  857. usage
  858. ;;
  859. *)
  860. failure "Unknown command: '$COMMAND'
  861. Type '$PGRM help' for usage."
  862. ;;
  863. esac
  864. exit "$RETURN"