diff options
Diffstat (limited to 'lib/leap_cli/commands')
| -rw-r--r-- | lib/leap_cli/commands/compile.rb | 50 | ||||
| -rw-r--r-- | lib/leap_cli/commands/user.rb | 30 |
2 files changed, 59 insertions, 21 deletions
diff --git a/lib/leap_cli/commands/compile.rb b/lib/leap_cli/commands/compile.rb index 8ef7c6b..11e6e35 100644 --- a/lib/leap_cli/commands/compile.rb +++ b/lib/leap_cli/commands/compile.rb @@ -33,11 +33,61 @@ module LeapCli end def update_compiled_ssh_configs + generate_monitor_ssh_keys update_authorized_keys update_known_hosts end ## + ## SSH + ## + + # + # generates a ssh key pair that is used only by remote monitors + # to connect to nodes and run certain allowed commands. + # + # every node has the public monitor key added to their authorized + # keys, and every monitor node has a copy of the private monitor key. + # + def generate_monitor_ssh_keys + priv_key_file = :monitor_priv_key + pub_key_file = :monitor_pub_key + unless file_exists?(priv_key_file, pub_key_file) + cmd = %(ssh-keygen -N '' -C 'monitor' -t ecdsa -b 521 -f '%s') % path(priv_key_file) + assert_run! cmd + if file_exists?(priv_key_file, pub_key_file) + log :created, path(priv_key_file) + log :created, path(pub_key_file) + else + log :failed, 'to create monitor ssh keys' + end + end + end + + # + # Compiles the authorized keys file, which gets installed on every during init. + # Afterwards, puppet installs an authorized keys file that is generated differently + # (see authorized_keys() in macros.rb) + # + def update_authorized_keys + buffer = StringIO.new + keys = Dir.glob(path([:user_ssh, '*'])) + if keys.empty? + bail! "You must have at least one public SSH user key configured in order to proceed. See `leap help add-user`." + end + keys.sort.each do |keyfile| + ssh_type, ssh_key = File.read(keyfile).strip.split(" ") + buffer << ssh_type + buffer << " " + buffer << ssh_key + buffer << " " + buffer << Path.relative_path(keyfile) + buffer << "\n" + end + write_file!(:authorized_keys, buffer.string) + end + + ## ## ZONE FILE ## diff --git a/lib/leap_cli/commands/user.rb b/lib/leap_cli/commands/user.rb index f96d527..d7c21db 100644 --- a/lib/leap_cli/commands/user.rb +++ b/lib/leap_cli/commands/user.rb @@ -24,8 +24,15 @@ module LeapCli c.action do |global_options,options,args| username = args.first - if !username.any? && !options[:self] - help! "Either 'username' or --self is required." + if !username.any? + if options[:self] + username ||= `whoami`.strip + else + help! "Either USERNAME argument or --self flag is required." + end + end + if Leap::Platform.reserved_usernames.include? username + bail! %(The username "#{username}" is reserved. Sorry, pick another.) end ssh_pub_key = nil @@ -39,7 +46,6 @@ module LeapCli end if options[:self] - username ||= `whoami`.strip ssh_pub_key ||= pick_ssh_key.to_s pgp_pub_key ||= pick_pgp_key end @@ -118,23 +124,5 @@ module LeapCli return `gpg --armor --export-options export-minimal --export #{key_id}`.strip end - def update_authorized_keys - buffer = StringIO.new - keys = Dir.glob(path([:user_ssh, '*'])) - if keys.empty? - bail! "You must have at least one public SSH user key configured in order to proceed. See `leap help add-user`." - end - keys.sort.each do |keyfile| - ssh_type, ssh_key = File.read(keyfile).strip.split(" ") - buffer << ssh_type - buffer << " " - buffer << ssh_key - buffer << " " - buffer << Path.relative_path(keyfile) - buffer << "\n" - end - write_file!(:authorized_keys, buffer.string) - end - end end
\ No newline at end of file |