summaryrefslogtreecommitdiff
path: root/src/share/mh/revoke_hostname
blob: 06b5810f886f99800a1cac53109917db66cdf64b (plain)
  1. # -*-shell-script-*-
  2. # This should be sourced by bash (though we welcome changes to make it POSIX sh compliant)
  3. # Monkeysphere host revoke-hostname subcommand
  4. #
  5. # The monkeysphere scripts are written by:
  6. # Jameson Rollins <jrollins@finestructure.net>
  7. # Jamie McClelland <jm@mayfirst.org>
  8. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  9. #
  10. # They are Copyright 2008-2009, and are all released under the GPL,
  11. # version 3 or later.
  12. # revoke hostname user ID from host key
  13. revoke_hostname() {
  14. local userID
  15. local fingerprint
  16. local tmpuidMatch
  17. local line
  18. local uidIndex
  19. local message
  20. local revuidCommand
  21. if [ -z "$1" ] ; then
  22. failure "You must specify a hostname to revoke."
  23. fi
  24. echo "WARNING: There is a known bug in this function."
  25. echo "This function has been known to occasionally revoke the wrong user ID."
  26. echo "Please see the following bug report for more information:"
  27. echo "http://web.monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/"
  28. read -p "Are you sure you would like to proceed? (y/N) " OK; OK=${OK:=N}
  29. if [ ${OK/y/Y} != 'Y' ] ; then
  30. failure "aborting."
  31. fi
  32. userID="ssh://${1}"
  33. fingerprint=$(fingerprint_host_key)
  34. # match to only ultimately trusted user IDs
  35. tmpuidMatch="u:$(echo $userID | gpg_escape)"
  36. # find the index of the requsted user ID
  37. # NOTE: this is based on circumstantial evidence that the order of
  38. # this output is the appropriate index
  39. if line=$(gpg_host --list-keys --with-colons --fixed-list-mode "0x${fingerprint}!" \
  40. | egrep '^(uid|uat):' | cut -f2,10 -d: | grep -n -x -F "$tmpuidMatch") ; then
  41. uidIndex=${line%%:*}
  42. else
  43. failure "No non-revoked user ID '$userID' is found."
  44. fi
  45. echo "The following host key user ID will be revoked:"
  46. echo " $userID"
  47. read -p "Are you sure you would like to revoke this user ID? (y/N) " OK; OK=${OK:=N}
  48. if [ ${OK/y/Y} != 'Y' ] ; then
  49. failure "User ID not revoked."
  50. fi
  51. message="Hostname removed by monkeysphere-server $DATE"
  52. # edit-key script command to revoke user ID
  53. revuidCommand=$(cat <<EOF
  54. $uidIndex
  55. revuid
  56. y
  57. 4
  58. $message
  59. y
  60. save
  61. EOF
  62. )
  63. # execute edit-key script
  64. if echo "$revuidCommand" | \
  65. gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
  66. show_key
  67. echo
  68. echo "NOTE: User ID revoked, but revocation not published."
  69. echo "Run '$PGRM publish-key' to publish the revocation."
  70. else
  71. failure "Problem revoking user ID."
  72. fi
  73. }