X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=tests%2Fbasic;h=a3d0b4f73ed732cff9660315dd035238b6a43874;hb=001f9d9990b0341dfc8b94651cd7a7e51dccd6cf;hp=5006f8fa5cfb8c91de2b48f91ca6b1bdfcbb7a05;hpb=5b5a517e61fb5028aea6c2521524ccf2a377d822;p=monkeysphere.git diff --git a/tests/basic b/tests/basic index 5006f8f..a3d0b4f 100755 --- a/tests/basic +++ b/tests/basic @@ -19,10 +19,13 @@ set -o pipefail ## make sure that the right tools are installed to run the test. the ## test has *more* requirements than plain ol' monkeysphere: -which socat || { echo "You must have socat installed to run this test." ; exit 1; } +which socat >/dev/null || { echo "You must have socat installed to run this test." ; exit 1; } ## FIXME: other checks? +###################################################################### +### FUNCTIONS + # gpg command for test admin user gpgadmin() { GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg "$@" @@ -103,11 +106,13 @@ SSHD_PID= trap failed_cleanup EXIT +###################################################################### ### SETUP VARIABLES + ## set up some variables to ensure that we're operating strictly in ## the tests, not system-wide: -export TESTDIR=$(pwd) +export TESTDIR=$(dirname "$0") # make temp dir TEMPDIR="$TESTDIR"/tmp @@ -127,6 +132,7 @@ export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src/share export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami) export MONKEYSPHERE_CHECK_KEYSERVER=false export MONKEYSPHERE_LOG_LEVEL=DEBUG +export MONKEYSPHERE_CORE_KEYLENGTH=1024 export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket @@ -137,9 +143,12 @@ export SOCKET="$TEMPDIR"/ssh-socket # *anything* with any running X11 session. export DISPLAY=monkeys + +###################################################################### ### CONFIGURE ENVIRONMENTS # copy in admin and testuser home to tmp +echo "##################################################" echo "### copying admin and testuser homes..." cp -a "$TESTDIR"/home/admin "$TEMPDIR"/ cp -a "$TESTDIR"/home/testuser "$TEMPDIR"/ @@ -160,107 +169,160 @@ EOF get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf # set up sshd +echo "##################################################" echo "### configuring sshd..." -cp etc/ssh/sshd_config "$SSHD_CONFIG" +cp "$TESTDIR"/etc/ssh/sshd_config "$SSHD_CONFIG" # write the sshd_config cat <> "$SSHD_CONFIG" HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authentication/authorized_keys/%u EOF -# set up monkeysphere host -echo "### configuring monkeysphere host..." -mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/host - -# set up monkeysphere authentication -echo "### configuring monkeysphere authentication..." -mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authentication/{authorized_keys,core,sphere,tmp} -cp etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/ -cat <> "$TEMPDIR"/monkeysphere-authentication.conf -AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authentication/authorized_user_ids" -EOF -cat < "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf -primary-keyring ${MONKEYSPHERE_SYSDATADIR}/authentication/sphere/pubring.gpg -keyring ${MONKEYSPHERE_SYSDATADIR}/authentication/core/pubring.gpg -EOF - -### SERVER TESTS +###################################################################### +### SERVER HOST SETUP # create a new host key -echo "### generating server key..." +echo "##################################################" +echo "### testing host key generation..." +mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/host # add gpg.conf with quick-random get_gpg_prng_arg >> "$MONKEYSPHERE_SYSCONFIGDIR"/host/gpg.conf -echo | monkeysphere-host expert gen-key --length 1024 --expire 0 testhost -# remove the gpg.conf -rm "$MONKEYSPHERE_SYSCONFIGDIR"/host/gpg.conf - +echo | monkeysphere-host expert gen-key --length 1024 testhost + +# remove the host home for the next test +rm -rf "$MONKEYSPHERE_SYSCONFIGDIR"/host + +# import host key +echo "##################################################" +echo "### testing host key importing..." +ssh-keygen -b 1024 -t rsa -N '' -f "$TEMPDIR"/ssh_host_rsa_key +monkeysphere-host expert import-key testhost < "$TEMPDIR"/ssh_host_rsa_key + +# change host key expiration +echo "##################################################" +echo "### setting host key expiration..." +monkeysphere-host set-expire 1 +monkeysphere-host show-key +# FIXME: how do we check that the expiration has really been set? + +echo "##################################################" +echo "### getting host key fingerprint..." HOSTKEYID=$( monkeysphere-host show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\ ) -# certify it with the "Admin's Key". +# certify host key with the "Admin's Key". # (this would normally be done via keyservers) -echo "### certifying server key..." -monkeysphere-authentication expert gpg-cmd "--armor --export $HOSTKEYID" | gpgadmin --import +echo "##################################################" +echo "### certifying server host key..." +GNUPGHOME="$MONKEYSPHERE_SYSCONFIGDIR"/host gpg --armor --export "$HOSTKEYID" | gpgadmin --import echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID" +# FIXME: add revoker? + # FIXME: how can we test publish-key without flooding junk into the # keyservers? +# FIXME: should we run "diagnostics" here to test setup? + + +###################################################################### +### SERVER AUTHENTICATION SETUP + +# set up monkeysphere authentication +echo "##################################################" +echo "### setup monkeysphere authentication..." +cp "$TESTDIR"/etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/ +cat <> "$TEMPDIR"/monkeysphere-authentication.conf +AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authentication/authorized_user_ids" +EOF +monkeysphere-authentication setup +get_gpg_prng_arg >> "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf + # add admin as identity certifier for testhost +echo "##################################################" echo "### adding admin as certifier..." echo y | monkeysphere-authentication add-id-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg +# FIXME: should we run "diagnostics" here to test setup? + -### TESTUSER TESTS +###################################################################### +### TESTUSER SETUP # generate an auth subkey for the test user that expires in 2 days +echo "##################################################" echo "### generating key for testuser..." monkeysphere gen-subkey --expire 2 # add server key to testuser keychain +echo "##################################################" echo "### export server key to testuser..." gpgadmin --armor --export "$HOSTKEYID" | gpg --import # teach the "server" about the testuser's key +echo "##################################################" echo "### export testuser key to server..." gpg --export testuser | monkeysphere-authentication gpg-cmd --import + +# update authorized_keys for user +echo "##################################################" echo "### update server authorized_keys file for this testuser..." monkeysphere-authentication update-users $(whoami) + +###################################################################### +### TESTS + # connect to test sshd, using monkeysphere-ssh-proxycommand to verify # the identity before connection. This should work in both directions! +echo "##################################################" echo "### ssh connection test for success..." ssh_test # remove the testuser's authorized_user_ids file, update, and make # sure that the ssh authentication FAILS +echo "##################################################" echo "### removing testuser authorized_user_ids and updating..." mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak} monkeysphere-authentication update-users $(whoami) +echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,} # put improper permissions on authorized_user_ids file, update, and # make sure ssh authentication FAILS +echo "##################################################" echo "### setting group writability on authorized_user_ids and updating..." chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids monkeysphere-authentication update-users $(whoami) +echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids +echo "##################################################" echo "### setting other writability on authorized_user_ids and updating..." chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids monkeysphere-authentication update-users $(whoami) +echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids +# FIXME: addtest: remove admin as id-certifier and check ssh failure + +# FIXME: addtest: add hostname on host key +# FIXME: addtest: revoke hostname on host key and check ssh failure + +# FIXME: addtest: revoke the host key and check ssh failure + + +###################################################################### trap - EXIT -echo -echo "Monkeysphere basic tests completed successfully!" -echo +echo "##################################################" +echo " Monkeysphere basic tests completed successfully!" +echo "##################################################" cleanup