2 # This should be sourced by bash (though we welcome changes to make it POSIX sh compliant)
4 # Monkeysphere host diagnostics subcommand
6 # The monkeysphere scripts are written by:
7 # Jameson Rollins <jrollins@finestructure.net>
8 # Jamie McClelland <jm@mayfirst.org>
9 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
11 # They are Copyright 2008-2009, and are all released under the GPL,
14 # check on the status and validity of the key and public certificates
32 seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
33 keysfound=$(echo "$seckey" | grep -c ^sec:)
35 # warn when anything is 2 months away from expiration
37 warndate=$(advance_date $warnwindow +%s)
39 if ! id monkeysphere >/dev/null ; then
40 echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell."
41 problemsfound=$(($problemsfound+1))
44 if ! [ -d "$SYSDATADIR" ] ; then
45 echo "! no $SYSDATADIR directory found. Please create it."
46 problemsfound=$(($problemsfound+1))
49 echo "Checking host GPG key..."
50 if (( "$keysfound" < 1 )); then
51 echo "! No host key found."
52 echo " - Recommendation: run 'monkeysphere-host import-key'"
53 problemsfound=$(($problemsfound+1))
54 elif (( "$keysfound" > 1 )); then
55 echo "! More than one host key found?"
56 # FIXME: recommend a way to resolve this
57 problemsfound=$(($problemsfound+1))
59 create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
60 expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
61 fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
62 # check for key expiration:
63 if [ "$expire" ]; then
64 if (( "$expire" < "$curdate" )); then
65 echo "! Host key is expired."
66 echo " - Recommendation: extend lifetime of key with 'monkeysphere-host set-expire'"
67 problemsfound=$(($problemsfound+1))
68 elif (( "$expire" < "$warndate" )); then
69 echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
70 echo " - Recommendation: extend lifetime of key with 'monkeysphere-host set-expire'"
71 problemsfound=$(($problemsfound+1))
76 if [ "$create" ] && (( "$create" > "$curdate" )); then
77 echo "! Host key was created in the future(?!). Is your clock correct?"
78 echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
79 problemsfound=$(($problemsfound+1))
82 # check for UserID expiration:
83 echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
84 while IFS=: read create expire uid ; do
85 # FIXME: should we be doing any checking on the form
86 # of the User ID? Should we be unmangling it somehow?
88 if [ "$create" ] && (( "$create" > "$curdate" )); then
89 echo "! User ID '$uid' was created in the future(?!). Is your clock correct?"
90 echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
91 problemsfound=$(($problemsfound+1))
93 if [ "$expire" ] ; then
94 if (( "$expire" < "$curdate" )); then
95 echo "! User ID '$uid' is expired."
96 # FIXME: recommend a way to resolve this
97 problemsfound=$(($problemsfound+1))
98 elif (( "$expire" < "$warndate" )); then
99 echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
100 # FIXME: recommend a way to resolve this
101 problemsfound=$(($problemsfound+1))
106 # FIXME: verify that the host key is properly published to the
107 # keyservers (do this with the non-privileged user)
109 # FIXME: check that there are valid, non-expired certifying signatures
110 # attached to the host key after fetching from the public keyserver
111 # (do this with the non-privileged user as well)
113 # FIXME: propose adding a revoker to the host key if none exist (do we
114 # have a way to do that after key generation?)
116 # FIXME: test (with ssh-keyscan?) that the running ssh
117 # daemon is actually offering the monkeysphere host key.
121 # FIXME: look at the ownership/privileges of the various keyrings,
122 # directories housing them, etc (what should those values be? can
123 # we make them as minimal as possible?)
126 if [ "$problemsfound" -gt 0 ]; then
127 echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:"
128 echo " monkeysphere-host diagnostics"
130 echo "Everything seems to be in order!"