Added info log output when a new key is added to known_hosts file.

[monkeysphere.git] / src / common

diff --git a/src/common b/src/common
index ef70ef6c0909bec4807f9b8c65511fe0ebdc5d61..efee9bd69bc1c2389937b1fd66077b887a94a81d 100644 (file)
--- a/src/common
+++ b/src/common
@@ -24,7 +24,7 @@ export SYSCONFIGDIR
 
 # failure function.  exits with code 255, unless specified otherwise.
 failure() {
-    echo "$1" >&2
+    [ "$1" ] && echo "$1" >&2
     exit ${2:-'255'}
 }
 
@@ -393,8 +393,9 @@ test_gpg_expire() {
 # check that a file is properly owned, and that all it's parent
 # directories are not group/other writable
 check_key_file_permissions() {
-    local user
+    local uname
     local path
+    local stat
     local access
     local gAccess
     local oAccess
@@ -404,30 +405,36 @@ check_key_file_permissions() {
        [ "$1" = "w" ]
     }
 
-    user="$1"
+    uname="$1"
     path="$2"
 
-    # return 0 is path does not exist
-    [ -e "$path" ] || return 0
+    # return 255 if cannot stat file
+    if ! stat=$(ls -ld "$path" 2>/dev/null) ; then
+        log error "could not stat path '$path'."
+       return 255
+    fi
 
-    owner=$(ls -l "$path" | awk '{ print $3 }')
-    gAccess=$(ls -l "$path" | cut -c6)
-    oAccess=$(ls -l "$path" | cut -c9)
+    owner=$(echo "$stat" | awk '{ print $3 }')
+    gAccess=$(echo "$stat" | cut -c6)
+    oAccess=$(echo "$stat" | cut -c9)
 
-    # check owner
-    if [ "$owner" != "$user" -a "$owner" != 'root' ] ; then
+    # return 1 if path has invalid owner
+    if [ "$owner" != "$uname" -a "$owner" != 'root' ] ; then
+       log error "improper ownership on path '$path'."
        return 1
     fi
 
-    # check group/other writability
+    # return 2 if path has group or other writability
     if is_write "$gAccess" || is_write "$oAccess" ; then
+       log error "improper group or other writability on path '$path'."
        return 2
     fi
 
+    # return zero if all clear, or go to next path
     if [ "$path" = '/' ] ; then
        return 0
     else
-       check_key_file_permissions $(dirname "$path")
+       check_key_file_permissions "$uname" $(dirname "$path")
     fi
 }
 
@@ -515,7 +522,7 @@ gpg_fetch_userid() {
 
     userID="$1"
 
-    log info " checking keyserver $KEYSERVER... "
+    log verbose " checking keyserver $KEYSERVER... "
     echo 1,2,3,4,5 | \
        gpg --quiet --batch --with-colons \
        --command-fd 0 --keyserver "$KEYSERVER" \
@@ -608,17 +615,17 @@ process_user_id() {
 
                # if overall key is not valid, skip
                if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
-                   log error "  - unacceptable primary key validity ($validity)."
+                   log debug "  - unacceptable primary key validity ($validity)."
                    continue
                fi
                # if overall key is disabled, skip
                if check_capability "$usage" 'D' ; then
-                   log error "  - key disabled."
+                   log debug "  - key disabled."
                    continue
                fi
                # if overall key capability is not ok, skip
                if ! check_capability "$usage" $requiredPubCapability ; then
-                   log error "  - unacceptable primary key capability ($usage)."
+                   log debug "  - unacceptable primary key capability ($usage)."
                    continue
                fi
 
@@ -632,7 +639,7 @@ process_user_id() {
                ;;
            'uid') # user ids
                if [ "$lastKey" != pub ] ; then
-                   log error " - got a user ID after a sub key?!  user IDs should only follow primary keys!"
+                   log verbose " - got a user ID after a sub key?!  user IDs should only follow primary keys!"
                    continue
                fi
                # if an acceptable user ID was already found, skip
@@ -660,9 +667,9 @@ process_user_id() {
                        echo "0:${sshKey}"
                    fi
                else
-                   log error "  - unacceptable primary key."
+                   log debug "  - unacceptable primary key."
                    if [ -z "$sshKey" ] ; then
-                       log error "   ! primary key could not be translated (not RSA or DSA?)."
+                       log error "    ! primary key could not be translated (not RSA or DSA?)."
                    else
                        echo "1:${sshKey}"
                    fi
@@ -716,7 +723,7 @@ process_user_id() {
                        echo "0:${sshKey}"
                    fi
                else
-                   log error "  - unacceptable sub key."
+                   log debug "  - unacceptable sub key."
                    if [ -z "$sshKey" ] ; then
                        log error "    ! sub key could not be translated (not RSA or DSA?)."
                    else
@@ -735,6 +742,7 @@ process_user_id() {
 process_host_known_hosts() {
     local host
     local userID
+    local noKey=
     local nKeys
     local nKeysOK
     local ok
@@ -761,8 +769,9 @@ process_host_known_hosts() {
             continue
         fi
 
-       # remove the old host key line, and note if removed
-       remove_line "$KNOWN_HOSTS" "$sshKey"
+       # remove any old host key line, and note if removed nothing is
+       # removed
+       remove_line "$KNOWN_HOSTS" "$sshKey" || noKey=true
 
        # if key OK, add new host line
        if [ "$ok" -eq '0' ] ; then
@@ -781,6 +790,11 @@ process_host_known_hosts() {
            else
                ssh2known_hosts "$host" "$sshKey" >> "$KNOWN_HOSTS"
            fi
+
+           # log if this is a new key to the known_hosts file
+           if [ "$noKey" ] ; then
+               log info "* new key for $host added to known_hosts file."
+           fi
        fi
     done
 
@@ -845,7 +859,7 @@ update_known_hosts() {
 
     # note if the known_hosts file was updated
     if [ "$(file_hash "$KNOWN_HOSTS")" != "$fileCheck" ] ; then
-       log verbose "known_hosts file updated."
+       log debug "known_hosts file updated."
     fi
 
     # if an acceptable host was found, return 0
@@ -868,12 +882,12 @@ update_known_hosts() {
 process_known_hosts() {
     local hosts
 
-    log verbose "processing known_hosts file..."
+    log debug "processing known_hosts file..."
 
     hosts=$(meat "$KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | tr , ' ' | tr '\n' ' ')
 
     if [ -z "$hosts" ] ; then
-       log error "no hosts to process."
+       log debug "no hosts to process."
        return
     fi
 
@@ -988,7 +1002,7 @@ update_authorized_keys() {
 
     # note if the authorized_keys file was updated
     if [ "$(file_hash "$AUTHORIZED_KEYS")" != "$fileCheck" ] ; then
-       log verbose "authorized_keys file updated."
+       log debug "authorized_keys file updated."
     fi
 
     # if an acceptable id was found, return 0
@@ -1015,10 +1029,10 @@ process_authorized_user_ids() {
 
     authorizedUserIDs="$1"
 
-    log verbose "processing authorized_user_ids file..."
+    log debug "processing authorized_user_ids file..."
 
     if ! meat "$authorizedUserIDs" > /dev/null ; then
-       log error "no user IDs to process."
+       log debug " no user IDs to process."
        return
     fi