add start of add/revoke-hostname functions. revocation needs to be

implemented.

diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8
index 74e9a10109b8353945fec28f3c5c7458eb75a9d0..8e7278bd4273cefa51757f874e148d2b8547cd56 100644 (file)
--- a/man/man8/monkeysphere-server.8
+++ b/man/man8/monkeysphere-server.8
@@ -44,9 +44,21 @@ specified with the `-e' or `--expire' option (prompt otherwise).  A
 key revoker fingerprint can be specified with the `-r' or `--revoker'
 option.  `g' may be used in place of `gen-key'.
 .TP
-.B show-fingerprint
-Show the fingerprint for the host's OpenPGP key.  `f' may be used in place of
-`show-fingerprint'.
+.B add-hostname HOSTNAME
+Add a hostname user ID to the server host key.  `n+' may be used in
+place of `add-hostname'.
+.TP
+.B revoke-hostname HOSTNAME
+Revoke a hostname user ID from the server host key.  `n-' may be used
+in place of `revoke-hostname'.
+.TP
+.B show-key
+Output gpg information about host's OpenPGP key.  `s' may be used in
+place of `show-key'.
+.TP
+.B fingerprint
+Output just the fingerprint for the host's OpenPGP key.  `f' may be
+used in place of `fingerprint'.
 .TP
 .B publish-key
 Publish the host's OpenPGP key to the keyserver.  `p' may be used in

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 21973dd2993c0819618d452499ad12c6de6f1d5a..598c3f7444593d06f67f82e10a517928e62a5db3 100755 (executable)
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -39,11 +39,14 @@ MonkeySphere server admin tool.
 subcommands:
  update-users (u) [USER]...          update user authorized_keys files
 
- gen-key (g) [HOSTNAME]              generate gpg key for the server
+ gen-key (g) [NAME[:PORT]]           generate gpg key for the server
    -l|--length BITS                    key length in bits (2048)
    -e|--expire EXPIRE                  date to expire
    -r|--revoker FINGERPRINT            add a revoker
- show-fingerprint (f)                show server host key fingerprint
+ add-hostname (n+) NAME[:PORT]       add hostname user ID to server key
+ revoke-hostname (n-) NAME[:PORT]    revoke hostname user ID
+ show-key (s)                        output all server host key information
+ fingerprint (f)                     output just the key fingerprint
  publish-key (p)                     publish server host key to keyserver
  diagnostics (d)                     report on server monkeysphere status
 
@@ -97,6 +100,17 @@ gpg_authentication() {
     su_monkeysphere_user "gpg $@"
 }
 
+# output key information
+show_server_key() {
+    gpg_host --list-secret-keys --fingerprint
+}
+
+# output just key fingerprint
+fingerprint_server_key() {
+    gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode | \
+       grep '^fpr:' | head -1 | cut -d: -f10
+}
+
 # update authorized_keys for users
 update_users() {
     if [ "$1" ] ; then
@@ -339,9 +353,8 @@ EOF
     # output the server fingerprint
     fingerprint_server_key "=${userID}"
 
-    # find the key fingerprint of the server primary key
-    fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
-       grep '^fpr:' | head -1 | cut -d: -f10)
+    # find the key fingerprint of the newly generated key
+    fingerprint=$(fingerprint_server_key)
 
     # export host ownertrust to authentication keyring
     log "setting ultimate owner trust for server key..."
@@ -356,9 +369,47 @@ EOF
     log "Private SSH host key output to file: ${VARLIB}/ssh_host_rsa_key"
 }
 
-# gpg output key fingerprint
-fingerprint_server_key() {
-    gpg_host --fingerprint --list-secret-keys
+# add hostname user ID to server key
+add_hostname() {
+    if [ -z "$1" ] ; then
+       failure "You must specify a hostname to add."
+    fi
+
+    userID="ssh://${1}"
+
+    if [ "$(gpg_host --list-key "=${userID}")" ] ; then
+       failure "Host userID '$userID' already exists."
+    fi
+
+    fingerprint=$(fingerprint_server_key)
+
+    adduidCommand=$(cat <<EOF
+adduid
+$userID
+
+
+O
+save
+EOF
+       )
+
+    # add uid
+    echo "$adduidCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
+
+    echo "NOTE: new host userID has not been published."
+    echo "Use '$PGRM publish-key' to publish these changes."
+}
+
+# revoke hostname user ID to server key
+revoke_hostname() {
+    if [ -z "$1" ] ; then
+       failure "You must specify a hostname to revoke."
+    fi
+
+    failure "Sorry, not yet implemented."
+
+    echo "NOTE: host userID revokation has not been published."
+    echo "Use '$PGRM publish-key' to publish these changes."
 }
 
 # publish server key to keyserver
@@ -392,7 +443,7 @@ diagnostics() {
     local fingerprint
     local badhostkeys
 
-    seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
+    seckey=$(fingerprint_server_key)
     keysfound=$(echo "$seckey" | grep -c ^sec:)
     curdate=$(date +%s)
     # warn when anything is 2 months away from expiration
@@ -500,8 +551,6 @@ diagnostics() {
        echo "$badauthorizedkeys"
        echo " - Recommendation: remove the above AuthorizedKeysFile lines from /etc/ssh/sshd_config"
     fi
-
-
 }
 
 # retrieve key from web of trust, import it into the host keyring, and
@@ -684,11 +733,23 @@ case $COMMAND in
        gen_key "$@"
        ;;
 
-    'show-fingerprint'|'f')
+    'add-hostname'|'add-name'|'n+')
+       add_hostname "$@"
+       ;;
+
+    'revoke-hostname'|'revoke-name'|'n-')
+       revoke_hostname "$@"
+       ;;
+
+    'show-key'|'show'|'s')
+       show_server_key
+       ;;
+
+    'show-fingerprint'|'fingerprint'|'f')
        fingerprint_server_key
        ;;
 
-    'publish-key'|'p')
+    'publish-key'|'publish'|'p')
        publish_server_key
        ;;
 
@@ -697,11 +758,11 @@ case $COMMAND in
        ;;
 
     'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
-       add_certifier "$1"
+       add_certifier "$@"
        ;;
 
     'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
-       remove_certifier "$1"
+       remove_certifier "$@"
        ;;
 
     'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')