summaryrefslogtreecommitdiff
path: root/src/monkeysphere-server
blob: 98b60c035b89f4bf98e7a2aca1b9cc56fcea2fc3 (plain)
  1. #!/bin/bash
  2. # monkeysphere-server: MonkeySphere server admin tool
  3. #
  4. # The monkeysphere scripts are written by:
  5. # Jameson Rollins <jrollins@fifthhorseman.net>
  6. #
  7. # They are Copyright 2008, and are all released under the GPL, version 3
  8. # or later.
  9. ########################################################################
  10. PGRM=$(basename $0)
  11. SHARE=${MONKEYSPHERE_SHARE:="/usr/share/monkeysphere"}
  12. export SHARE
  13. . "${SHARE}/common" || exit 1
  14. VARLIB="/var/lib/monkeysphere"
  15. export VARLIB
  16. # date in UTF format if needed
  17. DATE=$(date -u '+%FT%T')
  18. # unset some environment variables that could screw things up
  19. unset GREP_OPTIONS
  20. # default return code
  21. RETURN=0
  22. ########################################################################
  23. # FUNCTIONS
  24. ########################################################################
  25. usage() {
  26. cat <<EOF
  27. usage: $PGRM <subcommand> [options] [args]
  28. MonkeySphere server admin tool.
  29. subcommands:
  30. update-users (u) [USER]... update user authorized_keys files
  31. gen-key (g) [HOSTNAME] generate gpg key for the server
  32. -l|--length BITS key length in bits (2048)
  33. -e|--expire EXPIRE date to expire
  34. -r|--revoker FINGERPRINT add a revoker
  35. show-fingerprint (f) show server's host key fingerprint
  36. publish-key (p) publish server's host key to keyserver
  37. diagnostics (d) report on the server's monkeysphere status
  38. add-identity-certifier (a) KEYID import and tsign a certification key
  39. -n|--domain DOMAIN limit ID certifications to IDs in DOMAIN ()
  40. -t|--trust TRUST trust level of certifier (full)
  41. -d|--depth DEPTH trust depth for certifier (1)
  42. remove-identity-certifier (r) KEYID remove a certification key
  43. list-identity-certifiers (l) list certification keys
  44. gpg-authentication-cmd CMD gnupg-authentication command
  45. help (h,?) this help
  46. EOF
  47. }
  48. su_monkeysphere_user() {
  49. su --preserve-environment "$MONKEYSPHERE_USER" -- -c "$@"
  50. }
  51. # function to interact with the host gnupg keyring
  52. gpg_host() {
  53. local returnCode
  54. GNUPGHOME="$GNUPGHOME_HOST"
  55. export GNUPGHOME
  56. # NOTE: we supress this warning because we need the monkeysphere
  57. # user to be able to read the host pubring. we realize this might
  58. # be problematic, but it's the simplest solution, without too much
  59. # loss of security.
  60. gpg --no-permission-warning "$@"
  61. returnCode="$?"
  62. # always reset the permissions on the host pubring so that the
  63. # monkeysphere user can read the trust signatures
  64. chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_HOST}/pubring.gpg"
  65. chmod g+r "${GNUPGHOME_HOST}/pubring.gpg"
  66. return "$returnCode"
  67. }
  68. # function to interact with the authentication gnupg keyring
  69. # FIXME: this function requires basically accepts only a single
  70. # argument because of problems with quote expansion. this needs to be
  71. # fixed/improved.
  72. gpg_authentication() {
  73. GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
  74. export GNUPGHOME
  75. su_monkeysphere_user "gpg $@"
  76. }
  77. # update authorized_keys for users
  78. update_users() {
  79. if [ "$1" ] ; then
  80. # get users from command line
  81. unames="$@"
  82. else
  83. # or just look at all users if none specified
  84. unames=$(getent passwd | cut -d: -f1)
  85. fi
  86. # set mode
  87. MODE="authorized_keys"
  88. # set gnupg home
  89. GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
  90. # check to see if the gpg trust database has been initialized
  91. if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
  92. failure "GNUPG trust database uninitialized. Please see MONKEYSPHERE-SERVER(8)."
  93. fi
  94. # make sure the authorized_keys directory exists
  95. mkdir -p "${VARLIB}/authorized_keys"
  96. # loop over users
  97. for uname in $unames ; do
  98. # check all specified users exist
  99. if ! getent passwd "$uname" >/dev/null ; then
  100. log "----- unknown user '$uname' -----"
  101. continue
  102. fi
  103. # set authorized_user_ids and raw authorized_keys variables,
  104. # translating ssh-style path variables
  105. authorizedUserIDs=$(translate_ssh_variables "$uname" "$AUTHORIZED_USER_IDS")
  106. rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS")
  107. # if neither is found, skip user
  108. if [ ! -s "$authorizedUserIDs" ] ; then
  109. if [ "$rawAuthorizedKeys" = '-' -o ! -s "$rawAuthorizedKeys" ] ; then
  110. continue
  111. fi
  112. fi
  113. log "----- user: $uname -----"
  114. # exit if the authorized_user_ids file is empty
  115. if ! check_key_file_permissions "$uname" "$AUTHORIZED_USER_IDS" ; then
  116. log "Improper permissions on authorized_user_ids file path."
  117. continue
  118. fi
  119. # check permissions on the authorized_keys file path
  120. if ! check_key_file_permissions "$uname" "$RAW_AUTHORIZED_KEYS" ; then
  121. log "Improper permissions on authorized_keys file path path."
  122. continue
  123. fi
  124. # make temporary directory
  125. TMPDIR=$(mktemp -d)
  126. # trap to delete temporary directory on exit
  127. trap "rm -rf $TMPDIR" EXIT
  128. # create temporary authorized_user_ids file
  129. TMP_AUTHORIZED_USER_IDS="${TMPDIR}/authorized_user_ids"
  130. touch "$TMP_AUTHORIZED_USER_IDS"
  131. # create temporary authorized_keys file
  132. AUTHORIZED_KEYS="${TMPDIR}/authorized_keys"
  133. touch "$AUTHORIZED_KEYS"
  134. # set restrictive permissions on the temporary files
  135. # FIXME: is there a better way to do this?
  136. chmod 0700 "$TMPDIR"
  137. chmod 0600 "$AUTHORIZED_KEYS"
  138. chmod 0600 "$TMP_AUTHORIZED_USER_IDS"
  139. chown -R "$MONKEYSPHERE_USER" "$TMPDIR"
  140. # if the authorized_user_ids file exists...
  141. if [ -s "$authorizedUserIDs" ] ; then
  142. # copy user authorized_user_ids file to temporary
  143. # location
  144. cat "$authorizedUserIDs" > "$TMP_AUTHORIZED_USER_IDS"
  145. # export needed variables
  146. export AUTHORIZED_KEYS
  147. export TMP_AUTHORIZED_USER_IDS
  148. # process authorized_user_ids file, as monkeysphere
  149. # user
  150. su_monkeysphere_user \
  151. ". ${SHARE}/common; process_authorized_user_ids $TMP_AUTHORIZED_USER_IDS"
  152. RETURN="$?"
  153. fi
  154. # add user-controlled authorized_keys file path if specified
  155. if [ "$rawAuthorizedKeys" != '-' -a -s "$rawAuthorizedKeys" ] ; then
  156. log -n "adding raw authorized_keys file... "
  157. cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
  158. loge "done."
  159. fi
  160. # openssh appears to check the contents of the
  161. # authorized_keys file as the user in question, so the
  162. # file must be readable by that user at least.
  163. # FIXME: is there a better way to do this?
  164. chown root "$AUTHORIZED_KEYS"
  165. chgrp $(getent passwd "$uname" | cut -f4 -d:) "$AUTHORIZED_KEYS"
  166. chmod g+r "$AUTHORIZED_KEYS"
  167. # move the resulting authorized_keys file into place
  168. mv -f "$AUTHORIZED_KEYS" "${VARLIB}/authorized_keys/${uname}"
  169. # destroy temporary directory
  170. rm -rf "$TMPDIR"
  171. done
  172. }
  173. # generate server gpg key
  174. gen_key() {
  175. local keyType
  176. local keyLength
  177. local keyUsage
  178. local keyExpire
  179. local revoker
  180. local hostName
  181. local userID
  182. local keyParameters
  183. local fingerprint
  184. # set default key parameter values
  185. keyType="RSA"
  186. keyLength="2048"
  187. keyUsage="auth"
  188. keyExpire=
  189. revoker=
  190. # get options
  191. TEMP=$(getopt -o l:e:r: -l length:,expire:,revoker: -n "$PGRM" -- "$@")
  192. if [ $? != 0 ] ; then
  193. exit 1
  194. fi
  195. # Note the quotes around `$TEMP': they are essential!
  196. eval set -- "$TEMP"
  197. while true ; do
  198. case "$1" in
  199. -l|--length)
  200. keyLength="$2"
  201. shift 2
  202. ;;
  203. -e|--expire)
  204. keyExpire="$2"
  205. shift 2
  206. ;;
  207. -r|--revoker)
  208. revoker="$2"
  209. shift 2
  210. ;;
  211. --)
  212. shift
  213. ;;
  214. *)
  215. break
  216. ;;
  217. esac
  218. done
  219. hostName=${1:-$(hostname --fqdn)}
  220. userID="ssh://${hostName}"
  221. # check for presense of key with user ID
  222. if gpg_host --list-key ="$userID" > /dev/null 2>&1 ; then
  223. failure "Key for '$userID' already exists"
  224. fi
  225. # prompt about key expiration if not specified
  226. if [ -z "$keyExpire" ] ; then
  227. cat <<EOF
  228. Please specify how long the key should be valid.
  229. 0 = key does not expire
  230. <n> = key expires in n days
  231. <n>w = key expires in n weeks
  232. <n>m = key expires in n months
  233. <n>y = key expires in n years
  234. EOF
  235. while [ -z "$keyExpire" ] ; do
  236. read -p "Key is valid for? (0) " keyExpire
  237. if ! test_gpg_expire ${keyExpire:=0} ; then
  238. echo "invalid value"
  239. unset keyExpire
  240. fi
  241. done
  242. elif ! test_gpg_expire "$keyExpire" ; then
  243. failure "invalid key expiration value '$keyExpire'."
  244. fi
  245. # set key parameters
  246. keyParameters=$(cat <<EOF
  247. Key-Type: $keyType
  248. Key-Length: $keyLength
  249. Key-Usage: $keyUsage
  250. Name-Real: $userID
  251. Expire-Date: $keyExpire
  252. EOF
  253. )
  254. # add the revoker field if specified
  255. # FIXME: the "1:" below assumes that $REVOKER's key is an RSA key.
  256. # FIXME: key is marked "sensitive"? is this appropriate?
  257. if [ "$revoker" ] ; then
  258. keyParameters="${keyParameters}"$(cat <<EOF
  259. Revoker: 1:$revoker sensitive
  260. EOF
  261. )
  262. fi
  263. echo "The following key parameters will be used for the host private key:"
  264. echo "$keyParameters"
  265. read -p "Generate key? (Y/n) " OK; OK=${OK:=Y}
  266. if [ ${OK/y/Y} != 'Y' ] ; then
  267. failure "aborting."
  268. fi
  269. # add commit command
  270. keyParameters="${keyParameters}"$(cat <<EOF
  271. %commit
  272. %echo done
  273. EOF
  274. )
  275. log "generating server key..."
  276. echo "$keyParameters" | gpg_host --batch --gen-key
  277. # output the server fingerprint
  278. fingerprint_server_key "=${userID}"
  279. # find the key fingerprint of the server primary key
  280. fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
  281. grep '^fpr:' | head -1 | cut -d: -f10)
  282. # export host ownertrust to authentication keyring
  283. log "setting ultimate owner trust for server key..."
  284. echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
  285. # translate the private key to ssh format, and export to a file
  286. # for sshs usage.
  287. # NOTE: assumes that the primary key is the proper key to use
  288. (umask 077 && \
  289. gpg_host --export-secret-key "$fingerprint" | \
  290. openpgp2ssh "$fingerprint" > "${VARLIB}/ssh_host_rsa_key")
  291. log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key"
  292. }
  293. # gpg output key fingerprint
  294. fingerprint_server_key() {
  295. gpg_host --fingerprint --list-secret-keys
  296. }
  297. # publish server key to keyserver
  298. publish_server_key() {
  299. read -p "Really publish key to $KEYSERVER? (y/N) " OK; OK=${OK:=N}
  300. if [ ${OK/y/Y} != 'Y' ] ; then
  301. failure "aborting."
  302. fi
  303. # publish host key
  304. # FIXME: need to figure out better way to identify host key
  305. # dummy command so as not to publish fakes keys during testing
  306. # eventually:
  307. #gpg_authentication "--keyserver $KEYSERVER --send-keys $(hostname -f)"
  308. echo "NOT PUBLISHED (to avoid permanent publication errors during monkeysphere development)."
  309. echo "The following command should publish the key:"
  310. echo "monkeysphere-server gpg-authentication-cmd '--keyserver $KEYSERVER --send-keys $(hostname -f)'"
  311. exit 255
  312. }
  313. diagnostics() {
  314. # * check on the status and validity of the key and public certificates
  315. local seckey
  316. local keysfound
  317. local keyexp
  318. local curdate
  319. local warnwindow
  320. local warndate
  321. seckey=$(gpg_host --list-secret-keys --with-colons --fixed-list-mode)
  322. keysfound=$(echo "$seckey" | grep -c ^sec:)
  323. curdate=$(date +%s)
  324. # warn when anything is 2 months away from expiration
  325. warnwindow='2 months'
  326. warndate=$(date +%s -d "$warnwindow")
  327. if (( "$keysfound" < 1 )); then
  328. echo "No host key found!"
  329. echo "Recommendation: run 'monkeysphere-server gen-key'"
  330. else
  331. if (( "$keysfound" > 1 )); then
  332. echo "more than one host key found?"
  333. else
  334. # check for key expiration:
  335. keyexp=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
  336. if (( "$keyexp" < "$curdate" )); then
  337. echo "Host key is expired!"
  338. # FIXME: recommend a way to resolve this other than re-keying?
  339. elif (( "$keyexp" < "$warndate" )); then
  340. echo "Host key expires in less than $warnwindow"
  341. # FIXME: recommend a way to resolve this?
  342. fi
  343. # and weirdnesses:
  344. if (( $(echo "$seckey" | grep ^sec: | cut -f6 -d:) > "$curdate" )); then
  345. echo "Host key was created in the future(?!). Is your clock correct?"
  346. echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
  347. fi
  348. # check for UserID expiration:
  349. echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
  350. while IFS=: read create expire uid ; do
  351. # FIXME: should we be doing any checking on the form
  352. # of the User ID? Should we be unmangling it somehow?
  353. if [ "$create" ] && (( "$create" > "$curdate" )); then
  354. echo "User ID '$uid' was created in the future(?!). Is your clock correct?"
  355. echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
  356. fi
  357. if [ "$expire" ] ; then
  358. if (( "$expire" < "$curdate" )); then
  359. echo "User ID '$uid' is expired!"
  360. # FIXME: recommend a way to resolve this
  361. elif (( "$expire" < "$warndate" )); then
  362. echo "User ID '$uid' expires in less than $warnwindow"
  363. # FIXME: recommend a way to resolve this
  364. fi
  365. fi
  366. done
  367. # FIXME: verify that the host key is properly published to the
  368. # keyservers
  369. # FIXME: check that there are valid, non-expired certifying signatures
  370. # attached to the host key
  371. # FIXME: propose adding a revoker to the host key if none exist (do we
  372. # have a way to do that after key generation?)
  373. # Ensure that the ssh_host_rsa_key file is present and non-empty:
  374. if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
  375. echo "The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty!"
  376. else
  377. if [ $(stat -c "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
  378. echo "Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600 !"
  379. fi
  380. # propose changes needed for sshd_config (if any)
  381. if ! grep -q "^HostKey ${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
  382. echo "/etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
  383. echo "Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
  384. fi
  385. fi
  386. fi
  387. fi
  388. # FIXME: look at the ownership/privileges of the various keyrings,
  389. # directories housing them, etc (what should those values be? can
  390. # we make them as minimal as possible?)
  391. # FIXME: look to see that the ownertrust rules are set properly on the
  392. # authentication keyring
  393. # FIXME: make sure that at least one identity certifier exists
  394. }
  395. # retrieve key from web of trust, import it into the host keyring, and
  396. # ltsign the key in the host keyring so that it may certify other keys
  397. add_certifier() {
  398. local domain
  399. local trust
  400. local depth
  401. local keyID
  402. local fingerprint
  403. local ltsignCommand
  404. local trustval
  405. # set default values for trust depth and domain
  406. domain=
  407. trust=full
  408. depth=1
  409. # get options
  410. TEMP=$(getopt -o n:t:d: -l domain:,trust:,depth: -n "$PGRM" -- "$@")
  411. if [ $? != 0 ] ; then
  412. exit 1
  413. fi
  414. # Note the quotes around `$TEMP': they are essential!
  415. eval set -- "$TEMP"
  416. while true ; do
  417. case "$1" in
  418. -n|--domain)
  419. domain="$2"
  420. shift 2
  421. ;;
  422. -t|--trust)
  423. trust="$2"
  424. shift 2
  425. ;;
  426. -d|--depth)
  427. depth="$2"
  428. shift 2
  429. ;;
  430. --)
  431. shift
  432. ;;
  433. *)
  434. break
  435. ;;
  436. esac
  437. done
  438. keyID="$1"
  439. if [ -z "$keyID" ] ; then
  440. failure "You must specify the key ID of a key to add."
  441. fi
  442. export keyID
  443. # get the key from the key server
  444. gpg_authentication "--keyserver $KEYSERVER --recv-key '$keyID'"
  445. # get the full fingerprint of a key ID
  446. fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint $keyID" | \
  447. grep '^fpr:' | grep "$keyID" | cut -d: -f10)
  448. echo "key found:"
  449. gpg_authentication "--fingerprint $fingerprint"
  450. echo "Are you sure you want to add this key as a certifier of"
  451. read -p "users on this system? (y/N) " OK; OK=${OK:-N}
  452. if [ "${OK/y/Y}" != 'Y' ] ; then
  453. failure "aborting."
  454. fi
  455. # export the key to the host keyring
  456. gpg_authentication "--export $keyID" | gpg_host --import
  457. if [ "$trust" == marginal ]; then
  458. trustval=1
  459. elif [ "$trust" == full ]; then
  460. trustval=2
  461. else
  462. failure "trust value requested ('$trust') was unclear (only 'marginal' or 'full' are supported)"
  463. fi
  464. # ltsign command
  465. # NOTE: *all* user IDs will be ltsigned
  466. ltsignCommand=$(cat <<EOF
  467. ltsign
  468. y
  469. $trustval
  470. $depth
  471. $domain
  472. y
  473. save
  474. EOF
  475. )
  476. # ltsign the key
  477. echo "$ltsignCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
  478. # update the trustdb for the authentication keyring
  479. gpg_authentication "--check-trustdb"
  480. }
  481. # delete a certifiers key from the host keyring
  482. remove_certifier() {
  483. local keyID
  484. local fingerprint
  485. keyID="$1"
  486. if [ -z "$keyID" ] ; then
  487. failure "You must specify the key ID of a key to remove."
  488. fi
  489. # delete the requested key (with prompting)
  490. gpg_host --delete-key "$keyID"
  491. # update the trustdb for the authentication keyring
  492. gpg_authentication "--check-trustdb"
  493. }
  494. # list the host certifiers
  495. list_certifiers() {
  496. gpg_host --list-keys
  497. }
  498. # issue command to gpg-authentication keyring
  499. gpg_authentication_cmd() {
  500. gpg_authentication "$@"
  501. }
  502. ########################################################################
  503. # MAIN
  504. ########################################################################
  505. # unset variables that should be defined only in config file
  506. unset KEYSERVER
  507. unset AUTHORIZED_USER_IDS
  508. unset RAW_AUTHORIZED_KEYS
  509. unset MONKEYSPHERE_USER
  510. # load configuration file
  511. [ -e ${MONKEYSPHERE_SERVER_CONFIG:="${ETC}/monkeysphere-server.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG"
  512. # set empty config variable with ones from the environment, or with
  513. # defaults
  514. KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="subkeys.pgp.net"}}
  515. AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:=${AUTHORIZED_USER_IDS:="%h/.config/monkeysphere/authorized_user_ids"}}
  516. RAW_AUTHORIZED_KEYS=${MONKEYSPHERE_RAW_AUTHORIZED_KEYS:=${RAW_AUTHORIZED_KEYS:="%h/.ssh/authorized_keys"}}
  517. MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkeysphere"}}
  518. # other variables
  519. CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"}
  520. REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
  521. GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${VARLIB}/gnupg-host"}
  522. GNUPGHOME_AUTHENTICATION=${MONKEYSPHERE_GNUPGHOME_AUTHENTICATION:="${VARLIB}/gnupg-authentication"}
  523. # export variables needed in su invocation
  524. export DATE
  525. export MODE
  526. export MONKEYSPHERE_USER
  527. export KEYSERVER
  528. export CHECK_KEYSERVER
  529. export REQUIRED_USER_KEY_CAPABILITY
  530. export GNUPGHOME_HOST
  531. export GNUPGHOME_AUTHENTICATION
  532. export GNUPGHOME
  533. # get subcommand
  534. COMMAND="$1"
  535. [ "$COMMAND" ] || failure "Type '$PGRM help' for usage."
  536. shift
  537. case $COMMAND in
  538. 'update-users'|'update-user'|'u')
  539. update_users "$@"
  540. ;;
  541. 'gen-key'|'g')
  542. gen_key "$@"
  543. ;;
  544. 'show-fingerprint'|'f')
  545. fingerprint_server_key
  546. ;;
  547. 'publish-key'|'p')
  548. publish_server_key
  549. ;;
  550. 'diagnostics'|'d')
  551. diagnostics
  552. ;;
  553. 'add-identity-certifier'|'add-certifier'|'a')
  554. add_certifier "$1"
  555. ;;
  556. 'remove-identity-certifier'|'remove-certifier'|'r')
  557. remove_certifier "$1"
  558. ;;
  559. 'list-identity-certifiers'|'list-certifiers'|'list-certifier'|'l')
  560. list_certifiers "$@"
  561. ;;
  562. 'gpg-authentication-cmd')
  563. gpg_authentication_cmd "$@"
  564. ;;
  565. 'help'|'h'|'?')
  566. usage
  567. ;;
  568. *)
  569. failure "Unknown command: '$COMMAND'
  570. Type '$PGRM help' for usage."
  571. ;;
  572. esac
  573. exit "$RETURN"