### COMMON VARIABLES
# managed directories
-ETC="/etc/monkeysphere"
-export ETC
+SYSCONFIGDIR=${MONKEYSPHERE_SYSCONFIGDIR:-"/etc/monkeysphere"}
+export SYSCONFIGDIR
########################################################################
### UTILITY FUNCTIONS
# failure function. exits with code 255, unless specified otherwise.
failure() {
- echo "$1" >&2
+ [ "$1" ] && echo "$1" >&2
exit ${2:-'255'}
}
esac
}
+
+# for portability, between gnu date and BSD date.
+# arguments should be: number longunits format
+
+# e.g. advance_date 20 seconds +%F
+advance_date() {
+ local gnutry
+ local number="$1"
+ local longunits="$2"
+ local format="$3"
+ local shortunits
+
+ # try things the GNU way first
+ if date -d "$number $longunits" "$format" >/dev/null 2>&1; then
+ date -d "$number $longunits" "$format"
+ else
+ # otherwise, convert to (a limited version of) BSD date syntax:
+ case "$longunits" in
+ years)
+ shortunits=y
+ ;;
+ months)
+ shortunits=m
+ ;;
+ weeks)
+ shortunits=w
+ ;;
+ days)
+ shortunits=d
+ ;;
+ hours)
+ shortunits=H
+ ;;
+ minutes)
+ shortunits=M
+ ;;
+ seconds)
+ shortunits=S
+ ;;
+ *)
+ # this is a longshot, and will likely fail; oh well.
+ shortunits="$longunits"
+ esac
+ date "-v+${number}${shortunits}" "$format"
+ fi
+}
+
+
# check that characters are in a string (in an AND fashion).
# used for checking key capability
# check_capability capability a [b...]
# check that a file is properly owned, and that all it's parent
# directories are not group/other writable
check_key_file_permissions() {
- local user
+ local uname
local path
+ local stat
local access
local gAccess
local oAccess
- # function to check that an octal corresponds to writability
+ # function to check that the given permission corresponds to writability
is_write() {
- [ "$1" -eq 2 -o "$1" -eq 3 -o "$1" -eq 6 -o "$1" -eq 7 ]
+ [ "$1" = "w" ]
}
- user="$1"
+ uname="$1"
path="$2"
- # return 0 is path does not exist
- [ -e "$path" ] || return 0
+ # return 255 if cannot stat file
+ if ! stat=$(ls -ld "$path" 2>/dev/null) ; then
+ log error "could not stat path '$path'."
+ return 255
+ fi
- owner=$(stat --format '%U' "$path")
- access=$(stat --format '%a' "$path")
- gAccess=$(echo "$access" | cut -c2)
- oAccess=$(echo "$access" | cut -c3)
+ owner=$(echo "$stat" | awk '{ print $3 }')
+ gAccess=$(echo "$stat" | cut -c6)
+ oAccess=$(echo "$stat" | cut -c9)
- # check owner
- if [ "$owner" != "$user" -a "$owner" != 'root' ] ; then
+ # return 1 if path has invalid owner
+ if [ "$owner" != "$uname" -a "$owner" != 'root' ] ; then
+ log error "improper ownership on path '$path'."
return 1
fi
- # check group/other writability
+ # return 2 if path has group or other writability
if is_write "$gAccess" || is_write "$oAccess" ; then
+ log error "improper group or other writability on path '$path'."
return 2
fi
+ # return zero if all clear, or go to next path
if [ "$path" = '/' ] ; then
return 0
else
- check_key_file_permissions $(dirname "$path")
+ check_key_file_permissions "$uname" $(dirname "$path")
fi
}
userID="$1"
- log info " checking keyserver $KEYSERVER... "
+ log verbose " checking keyserver $KEYSERVER... "
echo 1,2,3,4,5 | \
gpg --quiet --batch --with-colons \
--command-fd 0 --keyserver "$KEYSERVER" \
# if overall key is not valid, skip
if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
- log error " - unacceptable primary key validity ($validity)."
+ log debug " - unacceptable primary key validity ($validity)."
continue
fi
# if overall key is disabled, skip
if check_capability "$usage" 'D' ; then
- log error " - key disabled."
+ log debug " - key disabled."
continue
fi
# if overall key capability is not ok, skip
if ! check_capability "$usage" $requiredPubCapability ; then
- log error " - unacceptable primary key capability ($usage)."
+ log debug " - unacceptable primary key capability ($usage)."
continue
fi
;;
'uid') # user ids
if [ "$lastKey" != pub ] ; then
- log error " - got a user ID after a sub key?! user IDs should only follow primary keys!"
+ log verbose " ! got a user ID after a sub key?! user IDs should only follow primary keys!"
continue
fi
# if an acceptable user ID was already found, skip
if [ "$validity" = 'u' -o "$validity" = 'f' ] ; then
# mark user ID acceptable
uidOK=true
+ else
+ log debug " - unacceptable user ID validity ($validity)."
fi
else
continue
echo "0:${sshKey}"
fi
else
- log error " - unacceptable primary key."
+ log debug " - unacceptable primary key."
if [ -z "$sshKey" ] ; then
- log error " ! primary key could not be translated (not RSA or DSA?)."
+ log error " ! primary key could not be translated (not RSA or DSA?)."
else
echo "1:${sshKey}"
fi
# if sub key validity is not ok, skip
if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
+ log debug " - unacceptable sub key validity ($validity)."
continue
fi
# if sub key capability is not ok, skip
if ! check_capability "$usage" $requiredCapability ; then
+ log debug " - unacceptable sub key capability ($usage)."
continue
fi
echo "0:${sshKey}"
fi
else
- log error " - unacceptable sub key."
+ log debug " - unacceptable sub key."
if [ -z "$sshKey" ] ; then
log error " ! sub key could not be translated (not RSA or DSA?)."
else
process_host_known_hosts() {
local host
local userID
+ local noKey=
local nKeys
local nKeysOK
local ok
continue
fi
- # remove the old host key line, and note if removed
- remove_line "$KNOWN_HOSTS" "$sshKey"
+ # remove any old host key line, and note if removed nothing is
+ # removed
+ remove_line "$KNOWN_HOSTS" "$sshKey" || noKey=true
# if key OK, add new host line
if [ "$ok" -eq '0' ] ; then
else
ssh2known_hosts "$host" "$sshKey" >> "$KNOWN_HOSTS"
fi
+
+ # log if this is a new key to the known_hosts file
+ if [ "$noKey" ] ; then
+ log info "* new key for $host added to known_hosts file."
+ fi
fi
done
# note if the known_hosts file was updated
if [ "$(file_hash "$KNOWN_HOSTS")" != "$fileCheck" ] ; then
- log verbose "known_hosts file updated."
+ log debug "known_hosts file updated."
fi
# if an acceptable host was found, return 0
process_known_hosts() {
local hosts
- log verbose "processing known_hosts file..."
+ log debug "processing known_hosts file..."
hosts=$(meat "$KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | tr , ' ' | tr '\n' ' ')
if [ -z "$hosts" ] ; then
- log error "no hosts to process."
+ log debug "no hosts to process."
return
fi
# note if the authorized_keys file was updated
if [ "$(file_hash "$AUTHORIZED_KEYS")" != "$fileCheck" ] ; then
- log verbose "authorized_keys file updated."
+ log debug "authorized_keys file updated."
fi
# if an acceptable id was found, return 0
authorizedUserIDs="$1"
- log verbose "processing authorized_user_ids file..."
+ log debug "processing authorized_user_ids file..."
if ! meat "$authorizedUserIDs" > /dev/null ; then
- log error "no user IDs to process."
+ log debug " no user IDs to process."
return
fi
projects / monkeysphere.git / blobdiff