########################################################################
usage() {
-cat <<EOF
+ cat <<EOF
usage: $PGRM <subcommand> [options] [args]
MonkeySphere server admin tool.
gpg-authentication-cmd CMD gnupg-authentication command
- help (h,?) this help
+ -h|--help|help (h,?) this help
EOF
}
revoker=
# get options
- TEMP=$(getopt -o l:e:r: -l length:,expire:,revoker: -n "$PGRM" -- "$@")
+ TEMP=$(getopt -o e:l:r -l expire:,length:,revoker: -n "$PGRM" -- "$@")
if [ $? != 0 ] ; then
exit 1
local expire
local uid
local fingerprint
+ local badhostkeys
seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
keysfound=$(echo "$seckey" | grep -c ^sec:)
warnwindow='2 months'
warndate=$(date +%s -d "$warnwindow")
+ echo "Checking host GPG key..."
if (( "$keysfound" < 1 )); then
- echo "No host key found!"
- echo "Recommendation: run 'monkeysphere-server gen-key'"
+ echo "! No host key found."
+ echo " - Recommendation: run 'monkeysphere-server gen-key'"
+ elif (( "$keysfound" > 1 )); then
+ echo "! More than one host key found?"
+ # FIXME: recommend a way to resolve this
else
- if (( "$keysfound" > 1 )); then
- echo "more than one host key found?"
- else
- create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
- expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
- fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
+ create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
+ expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
+ fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
# check for key expiration:
- if [ "$expire" ]; then
- if (( "$expire" < "$curdate" )); then
- echo "Host key is expired!"
+ if [ "$expire" ]; then
+ if (( "$expire" < "$curdate" )); then
+ echo "! Host key is expired."
# FIXME: recommend a way to resolve this other than re-keying?
- elif (( "$expire" < "$warndate" )); then
- echo "Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
+ elif (( "$expire" < "$warndate" )); then
+ echo "! Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
# FIXME: recommend a way to resolve this?
- fi
fi
-
+ fi
+
# and weirdnesses:
- if [ "$create" ] && (( "$create" > "$curdate" )); then
- echo "Host key was created in the future(?!). Is your clock correct?"
- echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
- fi
+ if [ "$create" ] && (( "$create" > "$curdate" )); then
+ echo "! Host key was created in the future(?!). Is your clock correct?"
+ echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+ fi
# check for UserID expiration:
- echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
- while IFS=: read create expire uid ; do
- # FIXME: should we be doing any checking on the form
- # of the User ID? Should we be unmangling it somehow?
-
- if [ "$create" ] && (( "$create" > "$curdate" )); then
- echo "User ID '$uid' was created in the future(?!). Is your clock correct?"
- echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
- fi
- if [ "$expire" ] ; then
- if (( "$expire" < "$curdate" )); then
- echo "User ID '$uid' is expired!"
- # FIXME: recommend a way to resolve this
- elif (( "$expire" < "$warndate" )); then
- echo "User ID '$uid' expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
+ echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
+ while IFS=: read create expire uid ; do
+ # FIXME: should we be doing any checking on the form
+ # of the User ID? Should we be unmangling it somehow?
+
+ if [ "$create" ] && (( "$create" > "$curdate" )); then
+ echo "! User ID '$uid' was created in the future(?!). Is your clock correct?"
+ echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+ fi
+ if [ "$expire" ] ; then
+ if (( "$expire" < "$curdate" )); then
+ echo "! User ID '$uid' is expired."
# FIXME: recommend a way to resolve this
- fi
+ elif (( "$expire" < "$warndate" )); then
+ echo "! User ID '$uid' expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
+ # FIXME: recommend a way to resolve this
fi
- done
+ fi
+ done
# FIXME: verify that the host key is properly published to the
# keyservers (do this with the non-privileged user)
# FIXME: propose adding a revoker to the host key if none exist (do we
# have a way to do that after key generation?)
-# Ensure that the ssh_host_rsa_key file is present and non-empty:
- if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
- echo "The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty!"
- else
- if [ $(stat -c '%a' "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
- echo "Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600 !"
- fi
+ # Ensure that the ssh_host_rsa_key file is present and non-empty:
+ echo "Checking host SSH key..."
+ if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
+ echo "! The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty."
+ else
+ if [ $(stat -c '%a' "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
+ echo "! Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600."
+ fi
- # propose changes needed for sshd_config (if any)
- if ! grep -q "^HostKey ${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
- echo "/etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
- echo "Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
- fi
+ # propose changes needed for sshd_config (if any)
+ if ! grep -q "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
+ echo "! /etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
+ echo " - Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
+ fi
+ if badhostkeys=$(grep -i '^HostKey' | grep -q -v "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$") ; then
+ echo "! /etc/sshd_config refers to some non-monkeysphere host keys:"
+ echo "$badhostkeys"
+ echo " - Recommendation: remove the above HostKey lines from /etc/ssh/sshd_config"
fi
fi
fi
# FIXME: make sure that at least one identity certifier exists
+ echo "Checking for MonkeySphere-enabled public-key authentication for users ..."
+ # Ensure that User ID authentication is enabled:
+ if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$" /etc/ssh/sshd_config; then
+ echo "! /etc/ssh/sshd_config does not point to monkeysphere authorized keys."
+ echo " - Recommendation: add a line to /etc/ssh/sshd_config: 'AuthorizedKeysFile ${VARLIB}/authorized_keys/%u'"
+ fi
+ if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' | grep -q -v "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$") ; then
+ echo "! /etc/sshd_config refers to non-monkeysphere authorized_keys files:"
+ echo "$badauthorizedkeys"
+ echo " - Recommendation: remove the above AuthorizedKeysFile lines from /etc/ssh/sshd_config"
+ fi
+
+
}
# retrieve key from web of trust, import it into the host keyring, and
gpg_authentication_cmd "$@"
;;
- 'help'|'h'|'?')
+ '--help'|'help'|'-h'|'h'|'?')
usage
;;
projects / monkeysphere.git / blobdiff