-diagnostics() {
-# * check on the status and validity of the key and public certificates
- local seckey
- local keysfound
- local curdate
- local warnwindow
- local warndate
- local create
- local expire
- local uid
- local fingerprint
- local badhostkeys
- local sshd_config
- local problemsfound=0
-
- # FIXME: what's the correct, cross-platform answer?
- sshd_config=/etc/ssh/sshd_config
- seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
- keysfound=$(echo "$seckey" | grep -c ^sec:)
- curdate=$(date +%s)
- # warn when anything is 2 months away from expiration
- warnwindow='2 months'
- warndate=$(advance_date $warnwindow +%s)
-
- if ! id monkeysphere >/dev/null ; then
- echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell."
- problemsfound=$(($problemsfound+1))
- fi
-
- if ! [ -d "$SYSDATADIR" ] ; then
- echo "! no $SYSDATADIR directory found. Please create it."
- problemsfound=$(($problemsfound+1))
- fi
-
- echo "Checking host GPG key..."
- if (( "$keysfound" < 1 )); then
- echo "! No host key found."
- echo " - Recommendation: run 'monkeysphere-server gen-key'"
- problemsfound=$(($problemsfound+1))
- elif (( "$keysfound" > 1 )); then
- echo "! More than one host key found?"
- # FIXME: recommend a way to resolve this
- problemsfound=$(($problemsfound+1))
- else
- create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
- expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
- fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
- # check for key expiration:
- if [ "$expire" ]; then
- if (( "$expire" < "$curdate" )); then
- echo "! Host key is expired."
- echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
- problemsfound=$(($problemsfound+1))
- elif (( "$expire" < "$warndate" )); then
- echo "! Host key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
- echo " - Recommendation: extend lifetime of key with 'monkeysphere-server extend-key'"
- problemsfound=$(($problemsfound+1))
- fi
- fi
-
- # and weirdnesses:
- if [ "$create" ] && (( "$create" > "$curdate" )); then
- echo "! Host key was created in the future(?!). Is your clock correct?"
- echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
- problemsfound=$(($problemsfound+1))
- fi
-
- # check for UserID expiration:
- echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
- while IFS=: read create expire uid ; do
- # FIXME: should we be doing any checking on the form
- # of the User ID? Should we be unmangling it somehow?
-
- if [ "$create" ] && (( "$create" > "$curdate" )); then
- echo "! User ID '$uid' was created in the future(?!). Is your clock correct?"
- echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
- problemsfound=$(($problemsfound+1))
- fi
- if [ "$expire" ] ; then
- if (( "$expire" < "$curdate" )); then
- echo "! User ID '$uid' is expired."
- # FIXME: recommend a way to resolve this
- problemsfound=$(($problemsfound+1))
- elif (( "$expire" < "$warndate" )); then
- echo "! User ID '$uid' expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
- # FIXME: recommend a way to resolve this
- problemsfound=$(($problemsfound+1))
- fi
- fi
+# show info about the host key
+show_key() {
+ local GNUPGHOME
+ local TMPSSH
+ local revokers
+
+ # tmp gpghome dir
+ export GNUPGHOME=$(msmktempdir)
+
+ # trap to remove tmp dir if break
+ trap "rm -rf $GNUPGHOME" EXIT
+
+ # import the host key into the tmp dir
+ gpg --quiet --import <"$HOST_KEY_FILE"
+
+ # create the ssh key
+ TMPSSH="$GNUPGHOME"/ssh_host_key_rsa_pub
+ gpg --export | openpgp2ssh 2>/dev/null >"$TMPSSH"
+
+ # get the gpg fingerprint
+ HOST_FINGERPRINT=$(gpg --quiet --list-keys --with-colons --with-fingerprint \
+ | grep '^fpr:' | cut -d: -f10 )
+
+ # list the host key info
+ # FIXME: make no-show-keyring work so we don't have to do the grep'ing
+ # FIXME: can we show uid validity somehow?
+ gpg --list-keys --fingerprint \
+ --list-options show-unusable-uids 2>/dev/null \
+ | grep -v "^${GNUPGHOME}/pubring.gpg$" \
+ | egrep -v '^-+$'
+
+ # list revokers, if there are any
+ revokers=$(gpg --list-keys --with-colons --fixed-list-mode \
+ | awk -F: '/^rvk:/{ print $10 }' )
+ if [ "$revokers" ] ; then
+ echo "The following keys are allowed to revoke this host key:"
+ for key in $revokers ; do
+ echo "revoker: $key"