-r|--revoker FINGERPRINT add a revoker
show-fingerprint (f) show server's host key fingerprint
publish-key (p) publish server's host key to keyserver
+ diagnostics (d) report on the server's monkeysphere status
add-identity-certifier (a) KEYID import and tsign a certification key
-n|--domain DOMAIN limit ID certifications to IDs in DOMAIN ()
log "----- user: $uname -----"
+ # exit if the authorized_user_ids file is empty
if ! check_key_file_permissions "$uname" "$AUTHORIZED_USER_IDS" ; then
- log "Improper permissions on authorized_user_ids file."
+ log "Improper permissions on authorized_user_ids file path."
continue
fi
+ # check permissions on the authorized_keys file path
if ! check_key_file_permissions "$uname" "$RAW_AUTHORIZED_KEYS" ; then
- log "Improper permissions on authorized_keys file."
+ log "Improper permissions on authorized_keys file path path."
continue
fi
chgrp $(getent passwd "$uname" | cut -f4 -d:) "$AUTHORIZED_KEYS"
chmod g+r "$AUTHORIZED_KEYS"
- # if the resulting authorized_keys file is not empty, move
- # it into place
+ # move the resulting authorized_keys file into place
mv -f "$AUTHORIZED_KEYS" "${VARLIB}/authorized_keys/${uname}"
# destroy temporary directory
fingerprint=$(gpg_host --list-key --with-colons --with-fingerprint "=${userID}" | \
grep '^fpr:' | head -1 | cut -d: -f10)
+ # export host ownertrust to authentication keyring
+ log "setting ultimate owner trust for server key..."
+ echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
+
# translate the private key to ssh format, and export to a file
# for sshs usage.
# NOTE: assumes that the primary key is the proper key to use
exit 255
}
+diagnostics() {
+# * check on the status and validity of the key and public certificates
+ local seckey
+ local keysfound
+ local keyexp
+ local curdate
+ local warnwindow
+ local warndate
+
+ seckey=$(gpg_host --list-secret-keys --with-colons --fixed-list-mode)
+ keysfound=$(echo "$seckey" | grep -c ^sec:)
+ curdate=$(date +%s)
+ # warn when anything is 2 months away from expiration
+ warnwindow='2 months'
+ warndate=$(date +%s -d "$warnwindow")
+
+ if (( "$keysfound" < 1 )); then
+ echo "No host key found!"
+ echo "Recommendation: run 'monkeysphere-server gen-key'"
+ else
+ if (( "$keysfound" > 1 )); then
+ echo "more than one host key found?"
+ else
+ # check for key expiration:
+ keyexp=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
+ if (( "$keyexp" < "$curdate" )); then
+ echo "Host key is expired!"
+ # FIXME: recommend a way to resolve this other than re-keying?
+ elif (( "$keyexp" < "$warndate" )); then
+ echo "Host key expires in less than $warnwindow"
+ # FIXME: recommend a way to resolve this?
+ fi
+ # and weirdnesses:
+ if (( $(echo "$seckey" | grep ^sec: | cut -f6 -d:) > "$curdate" )); then
+ echo "Host key was created in the future(?!). Is your clock correct?"
+ echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+ fi
+
+ # check for UserID expiration:
+ echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
+ while IFS=: read create expire uid ; do
+ # FIXME: should we be doing any checking on the form
+ # of the User ID? Should we be unmangling it somehow?
+ if [ "$create" ] && (( "$create" > "$curdate" )); then
+ echo "User ID '$uid' was created in the future(?!). Is your clock correct?"
+ echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+ fi
+ if [ "$expire" ] ; then
+ if (( "$expire" < "$curdate" )); then
+ echo "User ID '$uid' is expired!"
+ # FIXME: recommend a way to resolve this
+ elif (( "$expire" < "$warndate" )); then
+ echo "User ID '$uid' expires in less than $warnwindow"
+ # FIXME: recommend a way to resolve this
+ fi
+ fi
+ done
+
+# FIXME: verify that the host key is properly published to the
+# keyservers
+
+# FIXME: check that there are valid, non-expired certifying signatures
+# attached to the host key
+
+# FIXME: propose adding a revoker to the host key if none exist (do we
+# have a way to do that after key generation?)
+
+# Ensure that the ssh_host_rsa_key file is present and non-empty:
+ if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
+ echo "The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty!"
+ else
+ if [ $(stat -c "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
+ echo "Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600 !"
+ fi
+
+ # propose changes needed for sshd_config (if any)
+ if ! grep -q "^HostKey ${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
+ echo "/etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
+ echo "Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
+ fi
+ fi
+ fi
+ fi
+
+# FIXME: look at the ownership/privileges of the various keyrings,
+# directories housing them, etc (what should those values be? can
+# we make them as minimal as possible?)
+
+# FIXME: look to see that the ownertrust rules are set properly on the
+# authentication keyring
+
+# FIXME: make sure that at least one identity certifier exists
+
+}
+
# retrieve key from web of trust, import it into the host keyring, and
# ltsign the key in the host keyring so that it may certify other keys
add_certifier() {
fi
export keyID
- # export host ownertrust to authentication keyring
- gpg_host --export-ownertrust | gpg_authentication "--import-ownertrust"
-
# get the key from the key server
gpg_authentication "--keyserver $KEYSERVER --recv-key '$keyID'"
y
save
EOF
-)
+ )
# ltsign the key
echo "$ltsignCommand" | gpg_host --quiet --command-fd 0 --edit-key "$fingerprint"
publish_server_key
;;
+ 'diagnostics'|'d')
+ diagnostics
+ ;;
+
'add-identity-certifier'|'add-certifier'|'a')
add_certifier "$1"
;;
projects / monkeysphere.git / blobdiff