Merge remote-tracking branch 'vireo/master' into merge

Conflicts:
	.gitignore
	manifests/init.pp

11 files changed, 200 insertions, 9 deletions

diff --git a/.gitignore b/.gitignore
index 1377554..d38c149 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 *.swp
+*~
diff --git a/README b/README
new file mode 100644
index 0000000..569e512
--- /dev/null
+++ b/README
@@ -0,0 +1,28 @@
+puppet module for monkeysphere
+
+for information about monkeysphere, see http://web.monkeysphere.info/
+
+To install the monkeypshere module:
+
+* storeconfigs should be enabled in your puppet server to use certain features.
+  see: http://projects.puppetlabs.com/projects/1/wiki/Using_Stored_Configuration#Configuring+basic+storeconfigs
+
+* in node definitions that should export a ssh host key via
+  monkeyshere, add:
+
+  include monkeysphere::sshserver
+
+* You can specify pgpids of identity certifiers:
+
+  identity_certifier { "A3AE44A4":
+    ensure => present
+  }
+
+A host can be configured as a host you would use to sign the gpg keys by placing:
+
+  include monkeysphere::signer
+
+into the node definition. ON this host, a file will be placed in
+/var/lib/puppet/modules/monkeysphere/hosts for each host configured as a
+sshserver.  Each file will contin the gpg id, the gpg fingerprint, and
+the ssh fingerprint of the sshserver.
diff --git a/files/etc/cron.d/update-monkeysphere-auth b/files/etc/cron.d/update-monkeysphere-auth
new file mode 100644
index 0000000..06bb5ae
--- /dev/null
+++ b/files/etc/cron.d/update-monkeysphere-auth
@@ -0,0 +1 @@
+*/5 * * * * root /usr/sbin/monkeysphere-authentication update-users
diff --git a/lib/facter/monkeysphere.rb b/lib/facter/monkeysphere.rb
new file mode 100644
index 0000000..1d7d68e
--- /dev/null
+++ b/lib/facter/monkeysphere.rb
@@ -0,0 +1,42 @@
+has_hostkey = false
+pgp_fingerprint = ' '
+pgp_id = ' '
+ssh_fingerprint = ' '
+
+if File.exist?('/usr/sbin/monkeysphere-host')
+
+  sk = %x{/usr/sbin/monkeysphere-host show-keys}
+  if $? == 0
+    has_hostkey = true
+    sk.lines.each do |line|
+      m = line.match('^OpenPGP fingerprint:(.*)$')
+      if m
+        pgp_fingerprint = m[1].strip
+      end
+      m = line.match('^uid (.*)$')
+      if m
+        pgp_id = m[1].strip
+      end
+      m = line.match('^ssh fingerprint:(.*)$')
+      if m
+        ssh_fingerprint = m[1].strip
+      end
+    end
+  end
+end
+
+Facter.add("monkeysphere_has_hostkey") do
+  setcode{ has_hostkey }
+end
+
+Facter.add("monkeysphere_pgp_fp") do
+  setcode{ pgp_fingerprint }
+end
+
+Facter.add("monkeysphere_pgp_id") do
+  setcode{ pgp_id }
+end
+
+Facter.add("monkeysphere_ssh_fp") do
+  setcode{ ssh_fingerprint }
+end
diff --git a/lib/puppet/provider/identify_certifier/monkeysphere.rb b/lib/puppet/provider/identify_certifier/monkeysphere.rb
new file mode 100644
index 0000000..49ea6e6
--- /dev/null
+++ b/lib/puppet/provider/identify_certifier/monkeysphere.rb
@@ -0,0 +1,57 @@
+##
+
+
+require 'puppet/provider/package'
+require "open3"
+
+Puppet::Type.type(:identity_certifier).provide(:monkeysphere,
+                                               :parent => Puppet::Provider::Package) do
+
+  commands :monkeysphereauth => "/usr/sbin/monkeysphere-authentication"
+
+  desc "asdf"
+  
+  # retrieve the current set of mysql users
+  def self.instances
+    ids = []
+
+    cmd = "#{command(:monkeysphereauth)} list-id-certifiers"
+    execpipe(cmd) do |process|
+      process.each do |line|
+        m = line.match( "^[0-9A-Z]{32}([0-9A-Z]{8}):" )
+        if m
+          ids << new( { :ensure => :present, :pgpid => m.group(1) } )
+        end
+      end
+    end
+    return ids
+  end
+
+  def create
+    Open3.popen3("monkeysphere-authentication add-id-certifier #{resource[:pgpid]}") do |i, o, e|
+      i.puts( "Y" )
+      o.readlines()
+    end
+  end
+  
+  def destroy
+    Open3.popen3("monkeysphere-authentication remove-id-certifier #{resource[:pgpid]}") do |i, o, e|
+      i.puts( "Y" )
+      o.readlines()
+    end
+  end
+  
+  def exists?
+
+    cil = %x{/usr/sbin/monkeysphere-authentication list-id-certifiers}
+    if $? == 0
+      cil.lines.each do |line|
+        m = line.match( '^[0-9A-Z]*' + resource[:pgpid] + ':' )
+        if m
+          return true
+        end
+      end
+    end
+    return false
+  end
+end
diff --git a/lib/puppet/type/identity_certifier.rb b/lib/puppet/type/identity_certifier.rb
new file mode 100644
index 0000000..cc8295f
--- /dev/null
+++ b/lib/puppet/type/identity_certifier.rb
@@ -0,0 +1,10 @@
+Puppet::Type.newtype(:identity_certifier) do
+  @doc = "Manage monkeysphere identity-certifiers"
+  
+  ensurable
+  newparam(:pgpid) do
+    desc "The pgp id of the certifier"
+    isnamevar
+  end
+
+end
diff --git a/manifests/init.pp b/manifests/init.pp
index ca73120..853aed7 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -20,11 +20,14 @@
 # Class for monkeysphere management
 #
 class monkeysphere(
-  $ssh_port = '',
-  $publish_key = false
+  $ssh_port       = '',
+  $publish_key    = false,
+  $ensure_version = 'installed'
 ) {
   # The needed packages
-  package { monkeysphere: ensure => installed, }
+  package{'monkeysphere':
+    ensure => $ensure_version,
+  }
 
   $port = $monkeysphere::ssh_port ? {
     ''      => '',
@@ -33,12 +36,14 @@ class monkeysphere(
 
   $key = "ssh://${::fqdn}${port}"
 
-  file { "/usr/local/sbin/monkeysphere-check-key":
-    ensure  => present,
-    owner   => root,
-    group   => root,
-    mode    => 0755,
-    content => "#!/bin/bash\n/usr/bin/gpg --homedir /var/lib/monkeysphere/host --list-keys '=${key}' &> /dev/null || false",
+  common::module_dir { [ "monkeysphere", "monkeysphere/hosts", "monkeysphere/plugins" ]: }
+  file {
+    '/usr/local/sbin/monkeysphere-check-key':
+      ensure  => present,
+      owner   => root,
+      group   => root,
+      mode    => 0755,
+      content => "#!/bin/bash\n/usr/bin/gpg --homedir /var/lib/monkeysphere/host --list-keys '=${key}' &> /dev/null || false",
   }
 
   # Server host key publication
diff --git a/manifests/signer.pp b/manifests/signer.pp
new file mode 100644
index 0000000..350b4be
--- /dev/null
+++ b/manifests/signer.pp
@@ -0,0 +1,4 @@
+class monkeysphere::signer inherits monkeysphere
+{
+  File <<| tag == 'monkeysphere-host' |>>
+}
diff --git a/manifests/sshserver.pp b/manifests/sshserver.pp
new file mode 100644
index 0000000..966e136
--- /dev/null
+++ b/manifests/sshserver.pp
@@ -0,0 +1,29 @@
+class monkeysphere::sshserver inherits monkeysphere
+{
+
+  exec {"import.hostkey":
+    command => "/usr/sbin/monkeysphere-host import-key /etc/ssh/ssh_host_rsa_key ssh://${fqdn} && echo Y | /usr/sbin/monkeysphere-host publish-key",
+    unless => "/usr/sbin/monkeysphere-host show-key",
+    user => root,
+    require => [ Package[ "monkeysphere" ] ],
+  }
+
+  if $monkeysphere_has_hostkey {
+    @@file { "/var/lib/puppet/modules/monkeysphere/hosts/${fqdn}":
+      ensure => present,
+      content => template("monkeysphere/host.erb" ),
+      require => [ Package[ "monkeysphere" ] ],
+      tag => 'monkeysphere-host',
+    }
+  }
+
+  file { "/etc/cron.d/update-monkeysphere-auth":
+    ensure => present,
+    source => "puppet:///modules/monkeysphere/etc/cron.d/update-monkeysphere-auth",
+    require => [ Package[ "monkeysphere" ] ],
+    mode => 0644,
+    owner => root,
+    group => root,
+  }
+
+}
diff --git a/manifests/sshserverdanger.pp b/manifests/sshserverdanger.pp
new file mode 100644
index 0000000..7d7f12c
--- /dev/null
+++ b/manifests/sshserverdanger.pp
@@ -0,0 +1,11 @@
+class monkeysphere::sshserverdanger  inherits monkeysphere::sshserver 
+{
+  augeas { "sshd_config":
+    context => "/files/etc/ssh/sshd_config",
+    changes => [
+                "set AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u"
+                ],
+    notify => Service[ "ssh" ],
+  }
+
+}
diff --git a/templates/host.erb b/templates/host.erb
new file mode 100644
index 0000000..6412663
--- /dev/null
+++ b/templates/host.erb
@@ -0,0 +1,3 @@
+uid <%= monkeysphere_pgp_id %>
+host_key <%= monkeysphere_ssh_fp %>
+fingerprint <%= monkeysphere_pgp_fp %>