2 # This should be sourced by bash (though we welcome changes to make it POSIX sh compliant)
4 # Monkeysphere host diagnostics subcommand
6 # The monkeysphere scripts are written by:
7 # Jameson Rollins <jrollins@finestructure.net>
8 # Jamie McClelland <jm@mayfirst.org>
9 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
11 # They are Copyright 2008-2009, and are all released under the GPL,
14 # check on the status and validity of the key and public certificates
30 if ! [ -d "$SYSDATADIR" ] ; then
31 echo "! no $SYSDATADIR directory found. Please create it."
35 if ! [ -f "$HOST_KEY_FILE" ] ; then
36 echo "No host key gpg pub file found!"
37 echo " - Recommendation: run 'monkeysphere-host import-key'"
41 # load the host key fingerprint
44 seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
45 keysfound=$(echo "$seckey" | grep -c ^sec:)
47 # warn when anything is 2 months away from expiration
49 warndate=$(advance_date $warnwindow +%s)
51 if ! id monkeysphere >/dev/null ; then
52 echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell."
53 problemsfound=$(($problemsfound+1))
56 echo "Checking host GPG key..."
57 if (( "$keysfound" < 1 )); then
58 echo "! No host key found. The monkeysphere-host data directory is corrupt?!?!"
59 echo " - Recommendation: purge the MHDATADIR ($MHDATADIR) and rerun 'monkeysphere-host import-key'"
60 problemsfound=$(($problemsfound+1))
61 elif (( "$keysfound" > 1 )); then
62 echo "! More than one host key found?"
63 # FIXME: recommend a way to resolve this
64 problemsfound=$(($problemsfound+1))
66 create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
67 expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
68 fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
69 # check for key expiration:
70 if [ "$expire" ]; then
71 if (( "$expire" < "$curdate" )); then
72 echo "! Host key is expired."
73 echo " - Recommendation: extend lifetime of key with 'monkeysphere-host set-expire'"
74 problemsfound=$(($problemsfound+1))
75 elif (( "$expire" < "$warndate" )); then
76 echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
77 echo " - Recommendation: extend lifetime of key with 'monkeysphere-host set-expire'"
78 problemsfound=$(($problemsfound+1))
83 if [ "$create" ] && (( "$create" > "$curdate" )); then
84 echo "! Host key was created in the future(?!). Is your clock correct?"
85 echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
86 problemsfound=$(($problemsfound+1))
89 # check for UserID expiration:
90 echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
91 while IFS=: read create expire uid ; do
92 # FIXME: should we be doing any checking on the form
93 # of the User ID? Should we be unmangling it somehow?
95 if [ "$create" ] && (( "$create" > "$curdate" )); then
96 echo "! User ID '$uid' was created in the future(?!). Is your clock correct?"
97 echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
98 problemsfound=$(($problemsfound+1))
100 if [ "$expire" ] ; then
101 if (( "$expire" < "$curdate" )); then
102 echo "! User ID '$uid' is expired."
103 # FIXME: recommend a way to resolve this
104 problemsfound=$(($problemsfound+1))
105 elif (( "$expire" < "$warndate" )); then
106 echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
107 # FIXME: recommend a way to resolve this
108 problemsfound=$(($problemsfound+1))
113 # FIXME: verify that the host key is properly published to the
114 # keyservers (do this with the non-privileged user)
116 # FIXME: check that there are valid, non-expired certifying signatures
117 # attached to the host key after fetching from the public keyserver
118 # (do this with the non-privileged user as well)
120 # FIXME: propose adding a revoker to the host key if none exist (do we
121 # have a way to do that after key generation?)
123 # FIXME: test (with ssh-keyscan?) that the running ssh
124 # daemon is actually offering the monkeysphere host key.
128 # FIXME: look at the ownership/privileges of the various keyrings,
129 # directories housing them, etc (what should those values be? can
130 # we make them as minimal as possible?)
132 # report on any cruft from old monkeysphere version
135 if [ "$problemsfound" -gt 0 ]; then
136 echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:"
137 echo " monkeysphere-host diagnostics"
139 echo "Everything seems to be in order!"