X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=tests%2Fbasic;h=a3d0b4f73ed732cff9660315dd035238b6a43874;hb=be606510fb37cac8ca7eddadf719efb0598a2ed2;hp=bf6a364942d0fcbfb6b664609a19567dc368f6d6;hpb=d27b1e18de6b23968ec59d7b39a798869f415065;p=monkeysphere.git diff --git a/tests/basic b/tests/basic index bf6a364..a3d0b4f 100755 --- a/tests/basic +++ b/tests/basic @@ -23,6 +23,9 @@ which socat >/dev/null || { echo "You must have socat installed to run this test ## FIXME: other checks? +###################################################################### +### FUNCTIONS + # gpg command for test admin user gpgadmin() { GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg "$@" @@ -103,7 +106,9 @@ SSHD_PID= trap failed_cleanup EXIT +###################################################################### ### SETUP VARIABLES + ## set up some variables to ensure that we're operating strictly in ## the tests, not system-wide: @@ -127,6 +132,7 @@ export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src/share export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami) export MONKEYSPHERE_CHECK_KEYSERVER=false export MONKEYSPHERE_LOG_LEVEL=DEBUG +export MONKEYSPHERE_CORE_KEYLENGTH=1024 export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket @@ -137,9 +143,12 @@ export SOCKET="$TEMPDIR"/ssh-socket # *anything* with any running X11 session. export DISPLAY=monkeys + +###################################################################### ### CONFIGURE ENVIRONMENTS # copy in admin and testuser home to tmp +echo "##################################################" echo "### copying admin and testuser homes..." cp -a "$TESTDIR"/home/admin "$TEMPDIR"/ cp -a "$TESTDIR"/home/testuser "$TEMPDIR"/ @@ -160,6 +169,7 @@ EOF get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf # set up sshd +echo "##################################################" echo "### configuring sshd..." cp "$TESTDIR"/etc/ssh/sshd_config "$SSHD_CONFIG" # write the sshd_config @@ -169,105 +179,150 @@ AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authentication/authorized_keys/%u EOF +###################################################################### ### SERVER HOST SETUP -# set up monkeysphere host -echo "### configuring monkeysphere host..." -mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/host - # create a new host key -echo "### generating server host key..." +echo "##################################################" +echo "### testing host key generation..." +mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/host # add gpg.conf with quick-random get_gpg_prng_arg >> "$MONKEYSPHERE_SYSCONFIGDIR"/host/gpg.conf -echo | monkeysphere-host expert gen-key --length 1024 --expire 0 testhost -# remove the gpg.conf -rm "$MONKEYSPHERE_SYSCONFIGDIR"/host/gpg.conf - +echo | monkeysphere-host expert gen-key --length 1024 testhost + +# remove the host home for the next test +rm -rf "$MONKEYSPHERE_SYSCONFIGDIR"/host + +# import host key +echo "##################################################" +echo "### testing host key importing..." +ssh-keygen -b 1024 -t rsa -N '' -f "$TEMPDIR"/ssh_host_rsa_key +monkeysphere-host expert import-key testhost < "$TEMPDIR"/ssh_host_rsa_key + +# change host key expiration +echo "##################################################" +echo "### setting host key expiration..." +monkeysphere-host set-expire 1 +monkeysphere-host show-key +# FIXME: how do we check that the expiration has really been set? + +echo "##################################################" +echo "### getting host key fingerprint..." HOSTKEYID=$( monkeysphere-host show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\ ) -# certify it with the "Admin's Key". +# certify host key with the "Admin's Key". # (this would normally be done via keyservers) +echo "##################################################" echo "### certifying server host key..." GNUPGHOME="$MONKEYSPHERE_SYSCONFIGDIR"/host gpg --armor --export "$HOSTKEYID" | gpgadmin --import echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID" +# FIXME: add revoker? + # FIXME: how can we test publish-key without flooding junk into the # keyservers? +# FIXME: should we run "diagnostics" here to test setup? -### SERVER AUTHENTICATION TESTS + +###################################################################### +### SERVER AUTHENTICATION SETUP # set up monkeysphere authentication -echo "### configuring monkeysphere authentication..." -mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authentication/{authorized_keys,core,sphere,tmp} +echo "##################################################" +echo "### setup monkeysphere authentication..." cp "$TESTDIR"/etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/ cat <> "$TEMPDIR"/monkeysphere-authentication.conf AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authentication/authorized_user_ids" EOF -cat < "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf -primary-keyring ${MONKEYSPHERE_SYSDATADIR}/authentication/sphere/pubring.gpg -keyring ${MONKEYSPHERE_SYSDATADIR}/authentication/core/pubring.gpg -EOF - -# setup server authentication -echo "### setting up server authentication..." monkeysphere-authentication setup +get_gpg_prng_arg >> "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf # add admin as identity certifier for testhost +echo "##################################################" echo "### adding admin as certifier..." echo y | monkeysphere-authentication add-id-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg +# FIXME: should we run "diagnostics" here to test setup? + -### TESTUSER TESTS +###################################################################### +### TESTUSER SETUP # generate an auth subkey for the test user that expires in 2 days +echo "##################################################" echo "### generating key for testuser..." monkeysphere gen-subkey --expire 2 # add server key to testuser keychain +echo "##################################################" echo "### export server key to testuser..." gpgadmin --armor --export "$HOSTKEYID" | gpg --import # teach the "server" about the testuser's key +echo "##################################################" echo "### export testuser key to server..." gpg --export testuser | monkeysphere-authentication gpg-cmd --import + +# update authorized_keys for user +echo "##################################################" echo "### update server authorized_keys file for this testuser..." monkeysphere-authentication update-users $(whoami) + +###################################################################### +### TESTS + # connect to test sshd, using monkeysphere-ssh-proxycommand to verify # the identity before connection. This should work in both directions! +echo "##################################################" echo "### ssh connection test for success..." ssh_test # remove the testuser's authorized_user_ids file, update, and make # sure that the ssh authentication FAILS +echo "##################################################" echo "### removing testuser authorized_user_ids and updating..." mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak} monkeysphere-authentication update-users $(whoami) +echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,} # put improper permissions on authorized_user_ids file, update, and # make sure ssh authentication FAILS +echo "##################################################" echo "### setting group writability on authorized_user_ids and updating..." chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids monkeysphere-authentication update-users $(whoami) +echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids +echo "##################################################" echo "### setting other writability on authorized_user_ids and updating..." chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids monkeysphere-authentication update-users $(whoami) +echo "##################################################" echo "### ssh connection test for server authentication denial..." ssh_test 255 chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids +# FIXME: addtest: remove admin as id-certifier and check ssh failure + +# FIXME: addtest: add hostname on host key +# FIXME: addtest: revoke hostname on host key and check ssh failure + +# FIXME: addtest: revoke the host key and check ssh failure + + +###################################################################### trap - EXIT -echo -echo "Monkeysphere basic tests completed successfully!" -echo +echo "##################################################" +echo " Monkeysphere basic tests completed successfully!" +echo "##################################################" cleanup