3 # monkeysphere: Monkeysphere client tool
5 # The monkeysphere scripts are written by:
6 # Jameson Rollins <jrollins@finestructure.net>
7 # Jamie McClelland <jm@mayfirst.org>
8 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
9 # Micah Anderson <micah@riseup.net>
11 # They are Copyright 2008-2009, and are all released under the GPL, version 3
14 ########################################################################
19 SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"__SYSSHAREDIR_PREFIX__/share/monkeysphere"}
21 . "${SYSSHAREDIR}/defaultenv"
22 . "${SYSSHAREDIR}/common"
24 # sharedir for host functions
25 MSHAREDIR="${SYSSHAREDIR}/m"
27 # UTC date in ISO 8601 format if needed
28 DATE=$(date -u '+%FT%T')
30 # unset some environment variables that could screw things up
33 # set the file creation mask to be only owner rw
36 ########################################################################
38 ########################################################################
42 usage: $PGRM <subcommand> [options] [args]
43 Monkeysphere client tool.
46 update-known_hosts (k) [HOST]... update known_hosts file
47 update-authorized_keys (a) update authorized_keys file
48 ssh-proxycommand HOST [PORT] monkeysphere ssh ProxyCommand
49 --no-connect do not make TCP connection to host
50 subkey-to-ssh-agent (s) store authentication subkey in ssh-agent
52 keys-for-userid (u) USERID output valid ssh keys for given user id
53 sshfprs-for-userid USERID output ssh fingerprints for given user id
54 gen-subkey (g) [KEYID] generate an authentication subkey
55 --length (-l) BITS key length in bits (2048)
57 version (v) show version number
63 # user gpg command to define common options
65 LC_ALL=C gpg --no-greeting --quiet --no-tty "$@"
68 # output the ssh fingerprint of a gpg key
69 gpg_ssh_fingerprint() {
71 gpg_user --export "$keyid" --no-armor | "$SYSSHAREDIR/keytrans" openpgp2sshfpr "$keyid"
74 # take a secret key ID and check that only zero or one ID is provided,
75 # and that it corresponds to only a single secret key ID
76 check_gpg_sec_key_id() {
81 gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons 2>/dev/null | egrep '^sec:')
84 gpgSecOut=$(gpg_user --fixed-list-mode --list-secret-keys --with-colons "$1" | egrep '^sec:') || failure
87 failure "You must specify only a single primary key ID."
91 # check that only a single secret key was found
92 case $(echo "$gpgSecOut" | grep -c '^sec:') in
94 failure "No secret keys found. Create an OpenPGP key with the following command:
98 echo "$gpgSecOut" | cut -d: -f5
101 local seckeys=$(echo "$gpgSecOut" | cut -d: -f5)
102 failure "Multiple primary secret keys found:
104 Please specify which primary key to use."
109 # check that a valid authentication subkey does not already exist
110 check_gpg_authentication_subkey() {
120 # check that a valid authentication key does not already exist
122 for line in $(gpg_user --fixed-list-mode --list-keys --with-colons "$keyID") ; do
123 type=$(echo "$line" | cut -d: -f1)
124 validity=$(echo "$line" | cut -d: -f2)
125 usage=$(echo "$line" | cut -d: -f12)
128 if [ "$type" != 'pub' -a "$type" != 'sub' ] ; then
131 # check for authentication capability
132 if ! check_capability "$usage" 'a' ; then
135 # if authentication key is valid, prompt to continue
136 if [ "$validity" = 'u' ] ; then
137 echo "A valid authentication key already exists for primary key '$keyID'." 1>&2
138 if [ "$PROMPT" != "false" ] ; then
139 printf "Are you sure you would like to generate another one? (y/N) " >&2
141 if [ "${OK/y/Y}" != 'Y' ] ; then
152 ########################################################################
154 ########################################################################
156 # set unset default variables
157 GNUPGHOME=${GNUPGHOME:="${HOME}/.gnupg"}
158 KNOWN_HOSTS="${HOME}/.ssh/known_hosts"
159 HASH_KNOWN_HOSTS="false"
160 AUTHORIZED_KEYS="${HOME}/.ssh/authorized_keys"
162 # unset the check keyserver variable, since that needs to have
163 # different defaults for the different functions
164 unset CHECK_KEYSERVER
167 [ -r "${SYSCONFIGDIR}/monkeysphere.conf" ] \
168 && . "${SYSCONFIGDIR}/monkeysphere.conf"
170 # set monkeysphere home directory
171 MONKEYSPHERE_HOME=${MONKEYSPHERE_HOME:="${HOME}/.monkeysphere"}
172 mkdir -p -m 0700 "$MONKEYSPHERE_HOME"
175 [ -e ${MONKEYSPHERE_CONFIG:="${MONKEYSPHERE_HOME}/monkeysphere.conf"} ] \
176 && . "$MONKEYSPHERE_CONFIG"
178 # set empty config variables with ones from the environment
179 GNUPGHOME=${MONKEYSPHERE_GNUPGHOME:=$GNUPGHOME}
180 LOG_LEVEL=${MONKEYSPHERE_LOG_LEVEL:=$LOG_LEVEL}
181 KEYSERVER=${MONKEYSPHERE_KEYSERVER:=$KEYSERVER}
182 # if keyserver not specified in env or conf, then look in gpg.conf
183 if [ -z "$KEYSERVER" ] ; then
184 if [ -f "${GNUPGHOME}/gpg.conf" ] ; then
185 KEYSERVER=$(grep -e "^[[:space:]]*keyserver " "${GNUPGHOME}/gpg.conf" | tail -1 | awk '{ print $2 }')
188 PROMPT=${MONKEYSPHERE_PROMPT:=$PROMPT}
189 KNOWN_HOSTS=${MONKEYSPHERE_KNOWN_HOSTS:=$KNOWN_HOSTS}
190 HASH_KNOWN_HOSTS=${MONKEYSPHERE_HASH_KNOWN_HOSTS:=$HASH_KNOWN_HOSTS}
191 AUTHORIZED_KEYS=${MONKEYSPHERE_AUTHORIZED_KEYS:=$AUTHORIZED_KEYS}
192 STRICT_MODES=${MONKEYSPHERE_STRICT_MODES:=$STRICT_MODES}
194 # other variables not in config file
195 AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:="${MONKEYSPHERE_HOME}/authorized_user_ids"}
196 REQUIRED_HOST_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_HOST_KEY_CAPABILITY:="a"}
197 REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
198 # note that only using '=' instead of ':=' tests only if the variable
199 # in unset, not if it's "null"
200 LOG_PREFIX=${MONKEYSPHERE_LOG_PREFIX='ms: '}
202 # export GNUPGHOME and make sure gpg home exists with proper
205 mkdir -p -m 0700 "$GNUPGHOME"
209 if [ "$#" -eq 0 ] ; then
211 failure "Please supply a subcommand."
219 'update-known_hosts'|'update-known-hosts'|'k')
220 # whether or not to check keyservers
221 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
223 # if hosts are specified on the command line, process just
226 update_known_hosts "$@"
228 # otherwise, if no hosts are specified, process every host
229 # in the user's known_hosts file
235 'update-authorized_keys'|'update-authorized-keys'|'a')
236 # whether or not to check keyservers
237 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
239 # process authorized_user_ids file
240 process_authorized_user_ids "$AUTHORIZED_USER_IDS"
243 'import-subkey'|'import'|'i')
244 source "${MSHAREDIR}/import_subkey"
249 source "${MSHAREDIR}/gen_subkey"
253 'ssh-proxycommand'|'p')
254 source "${MSHAREDIR}/ssh_proxycommand"
255 ssh_proxycommand "$@"
258 'subkey-to-ssh-agent'|'s')
259 source "${MSHAREDIR}/subkey_to_ssh_agent"
260 subkey_to_ssh_agent "$@"
264 echo "Warning: 'sshfpr' is deprecated. Please use 'sshfprs-for-userid' instead." >&2
265 gpg_ssh_fingerprint "$@"
268 'keys-for-userid'|'u')
269 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
273 'sshfprs-for-userid')
274 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
275 keys_for_userid "$@" | "$SYSSHAREDIR/keytrans" sshfpr
279 echo "Warning: 'keys-from-userid' is deprecated. Please use 'keys-for-userid' instead." >&2
280 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
284 'version'|'--version'|'v')
288 'help'|'--help'|'-h'|'h'|'?')
293 failure "Unknown command: '$COMMAND'
294 Try '$PGRM help' for usage."