MonkeySphere server admin tool.
subcommands:
- update-users (u) [USER]... update user authorized_keys files
-
- gen-key (g) [HOSTNAME] generate gpg key for the server
- -l|--length BITS key length in bits (2048)
- -e|--expire EXPIRE date to expire
- -r|--revoker FINGERPRINT add a revoker
- show-fingerprint (f) show server's host key fingerprint
- publish-key (p) publish server's host key to keyserver
- diagnostics (d) report on the server's monkeysphere status
-
- add-identity-certifier (a) KEYID import and tsign a certification key
- -n|--domain DOMAIN limit ID certifications to IDs in DOMAIN ()
- -t|--trust TRUST trust level of certifier (full)
- -d|--depth DEPTH trust depth for certifier (1)
- remove-identity-certifier (r) KEYID remove a certification key
- list-identity-certifiers (l) list certification keys
-
- gpg-authentication-cmd CMD gnupg-authentication command
-
- help (h,?) this help
-
+ update-users (u) [USER]... update user authorized_keys files
+
+ gen-key (g) [HOSTNAME] generate gpg key for the server
+ -l|--length BITS key length in bits (2048)
+ -e|--expire EXPIRE date to expire
+ -r|--revoker FINGERPRINT add a revoker
+ show-fingerprint (f) show server's host key fingerprint
+ publish-key (p) publish server's host key to keyserver
+ diagnostics (d) report on the server's monkeysphere status
+
+ add-identity-certifier (a) KEYID import and tsign a certification key
+ -n|--domain DOMAIN limit ID certifications to IDs in DOMAIN
+ -t|--trust TRUST trust level of certifier (full)
+ -d|--depth DEPTH trust depth for certifier (1)
+ remove-identity-certifier (r) KEYID remove a certification key
+ list-identity-certifiers (l) list certification keys
+
+ gpg-authentication-cmd CMD gnupg-authentication command
+
+ help (h,?) this help
EOF
}
# * check on the status and validity of the key and public certificates
local seckey
local keysfound
- local keyexp
local curdate
local warnwindow
local warndate
+ local create
+ local expire
+ local uid
+ local fingerprint
- seckey=$(gpg_host --list-secret-keys --with-colons --fixed-list-mode)
+ seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
keysfound=$(echo "$seckey" | grep -c ^sec:)
curdate=$(date +%s)
# warn when anything is 2 months away from expiration
if (( "$keysfound" > 1 )); then
echo "more than one host key found?"
else
+ create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
+ expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
+ fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
# check for key expiration:
- keyexp=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
- if (( "$keyexp" < "$curdate" )); then
- echo "Host key is expired!"
+ if [ "$expire" ]; then
+ if (( "$expire" < "$curdate" )); then
+ echo "Host key is expired!"
# FIXME: recommend a way to resolve this other than re-keying?
- elif (( "$keyexp" < "$warndate" )); then
- echo "Host key expires in less than $warnwindow"
+ elif (( "$expire" < "$warndate" )); then
+ echo "Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
# FIXME: recommend a way to resolve this?
+ fi
fi
+
# and weirdnesses:
- if (( $(echo "$seckey" | grep ^sec: | cut -f6 -d:) > "$curdate" )); then
+ if [ "$create" ] && (( "$create" > "$curdate" )); then
echo "Host key was created in the future(?!). Is your clock correct?"
echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
fi
while IFS=: read create expire uid ; do
# FIXME: should we be doing any checking on the form
# of the User ID? Should we be unmangling it somehow?
+
if [ "$create" ] && (( "$create" > "$curdate" )); then
echo "User ID '$uid' was created in the future(?!). Is your clock correct?"
echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
echo "User ID '$uid' is expired!"
# FIXME: recommend a way to resolve this
elif (( "$expire" < "$warndate" )); then
- echo "User ID '$uid' expires in less than $warnwindow"
+ echo "User ID '$uid' expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
# FIXME: recommend a way to resolve this
fi
fi
done
# FIXME: verify that the host key is properly published to the
-# keyservers
+# keyservers (do this with the non-privileged user)
# FIXME: check that there are valid, non-expired certifying signatures
-# attached to the host key
+# attached to the host key after fetching from the public keyserver
+# (do this with the non-privileged user as well)
# FIXME: propose adding a revoker to the host key if none exist (do we
# have a way to do that after key generation?)
if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
echo "The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty!"
else
- if [ $(stat -c "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
+ if [ $(stat -c '%a' "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
echo "Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600 !"
fi
projects / monkeysphere.git / blobdiff