From: Jameson Graef Rollins <jrollins@phys.columbia.edu>
Date: Sat, 26 Jul 2008 00:09:02 +0000 (-0700)
Subject: Fix how ownertrust is set for host key in authentication keyring.
X-Git-Tag: monkeysphere_0.5-1~15^2~1
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=3395f4669a79bc3233fd3f1e14d988416d7ba2f7;p=monkeysphere.git

Fix how ownertrust is set for host key in authentication keyring.
Update TODO, removing completed tasks.
---

diff --git a/doc/TODO b/doc/TODO
index e50da4d..0d72b25 100644
--- a/doc/TODO
+++ b/doc/TODO
@@ -78,28 +78,15 @@ File bug against ssh-keygen about how "-R" option removes comments
 File bug against ssh-keygen to see if we can get it to write to hash a
    known_hosts file to/from stdout/stdin.
 
-Add environment variables sections to man pages.
-
-Environment variable scoping.
-
-Move environment variable precedence before conf file.
-
 When using ssh-proxycommand, if only host keys found are expired or
    revoked, then output loud warning with prompt, or fail hard.
 
-Update monkeysphere-ssh-proxycommand man page with new keyserver
-   checking policy info.
-
 File bug against seahorse about how, when creating new primary keys,
    it presents option for "RSA (sign only)" but then creates an "esca"
    key.
 
 File bug against enigmail about lack of ability to create subkeys.
 
-Privilege separation: monkeysphere user to handle authn keyring and
-   generate authorized_keys file (which would be moved into place by
-   root).  Host keyring would be owned by root.
-
 Test and document what happens when any filesystem that the
    monkeysphere-server relies on and modifies (/tmp, /etc, and /var?)
    fills up.
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 4d7acc6..19b457f 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -342,6 +342,10 @@ EOF
     fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
 	grep '^fpr:' | head -1 | cut -d: -f10)
 
+    # export host ownertrust to authentication keyring
+    log "setting ultimate owner trust for server key..."
+    echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
+
     # translate the private key to ssh format, and export to a file
     # for sshs usage.
     # NOTE: assumes that the primary key is the proper key to use
@@ -429,9 +433,6 @@ add_certifier() {
     fi
     export keyID
 
-    # export host ownertrust to authentication keyring
-    gpg_host --export-ownertrust | gpg_authentication "--import-ownertrust"
-
     # get the key from the key server
     gpg_authentication "--keyserver $KEYSERVER --recv-key '$keyID'"
 
@@ -470,7 +471,7 @@ $domain
 y
 save
 EOF
-)
+	)
 
     # ltsign the key
     echo "$ltsignCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"