initial pass at monkeysphere-server diagnostics (lots more to fill in!)

diff --git a/debian/changelog b/debian/changelog
index 71ef1a836ff1220bf6bb336aba3f05068ab07428..fcf87f1d58e8d7c68de24e8e78429cfe0742da97 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+monkeysphere (0.7-) UNRELEASED; urgency=low
+
+  * Added monkeysphere-server diagnostics subcommand.
+
+ -- Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net>  Thu, 31 Jul 2008 19:27:45 -0400
+
 monkeysphere (0.6-1) experimental; urgency=low
   
   [ Jameson Graef Rollins ]

diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8
index d7710e59066f9229ce43db053fdcd270049df7fc..527cae791f9b131521f0166a451a761b41a5b0b5 100644 (file)
--- a/man/man8/monkeysphere-server.8
+++ b/man/man8/monkeysphere-server.8
@@ -52,6 +52,14 @@ Show the fingerprint for the host's OpenPGP key.  `f' may be used in place of
 Publish the host's OpenPGP key to the keyserver.  `p' may be used in
 place of `publish-key'.
 .TP
+.B diagnostics
+Review the state of the server with respect to the MonkeySphere in
+general and report on suggested changes.  Among other checks, this
+includes making sure there is a valid host key, that the key is
+published, that the sshd configuration points to the right place, and
+that there are at least some valid identity certifiers.  `d' may be
+used in place of `diagnostics'.
+.TP
 .B add-identity-certifier KEYID
 Instruct system to trust user identity certifications made by KEYID.
 Using the `-n' or `--domain' option allows you to indicate that you

diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index ce800593da8fec3cf82722393dc9ca7d05a31d3d..98b60c035b89f4bf98e7a2aca1b9cc56fcea2fc3 100755 (executable)
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -45,6 +45,7 @@ subcommands:
     -r|--revoker FINGERPRINT              add a revoker
   show-fingerprint (f)                  show server's host key fingerprint
   publish-key (p)                       publish server's host key to keyserver
+  diagnostics (d)                       report on the server's monkeysphere status
 
   add-identity-certifier (a) KEYID      import and tsign a certification key
     -n|--domain DOMAIN                    limit ID certifications to IDs in DOMAIN ()
@@ -379,6 +380,101 @@ publish_server_key() {
     exit 255
 }
 
+diagnostics() {
+#  * check on the status and validity of the key and public certificates
+    local seckey
+    local keysfound
+    local keyexp
+    local curdate
+    local warnwindow
+    local warndate
+
+    seckey=$(gpg_host --list-secret-keys --with-colons --fixed-list-mode)
+    keysfound=$(echo "$seckey" | grep -c ^sec:)
+    curdate=$(date +%s)
+    # warn when anything is 2 months away from expiration
+    warnwindow='2 months'
+    warndate=$(date +%s -d "$warnwindow")
+
+    if (( "$keysfound" < 1 )); then
+       echo "No host key found!"
+       echo "Recommendation: run 'monkeysphere-server gen-key'"
+    else
+       if (( "$keysfound" > 1 )); then
+           echo "more than one host key found?"
+       else
+       # check for key expiration:
+           keyexp=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
+           if (( "$keyexp"  < "$curdate" )); then
+               echo "Host key is expired!"
+               # FIXME: recommend a way to resolve this other than re-keying?
+           elif (( "$keyexp" < "$warndate" )); then
+               echo "Host key expires in less than $warnwindow"
+               # FIXME: recommend a way to resolve this?
+           fi
+        # and weirdnesses:
+           if (( $(echo "$seckey" | grep ^sec: | cut -f6 -d:) > "$curdate" )); then
+               echo "Host key was created in the future(?!). Is your clock correct?"
+               echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+           fi
+
+        # check for UserID expiration:
+           echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
+           while IFS=: read create expire uid ; do
+               # FIXME: should we be doing any checking on the form
+               # of the User ID?  Should we be unmangling it somehow?
+               if [ "$create" ] && (( "$create" > "$curdate" )); then
+                   echo "User ID '$uid' was created in the future(?!).  Is your clock correct?"
+                   echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+               fi
+               if [ "$expire" ] ; then
+                   if (( "$expire" < "$curdate" )); then
+                       echo "User ID '$uid' is expired!"
+                       # FIXME: recommend a way to resolve this
+                   elif (( "$expire" < "$warndate" )); then
+                       echo "User ID '$uid' expires in less than $warnwindow"
+                       # FIXME: recommend a way to resolve this
+                   fi
+               fi
+           done
+           
+# FIXME: verify that the host key is properly published to the
+#   keyservers
+
+# FIXME: check that there are valid, non-expired certifying signatures
+#   attached to the host key
+
+# FIXME: propose adding a revoker to the host key if none exist (do we
+#   have a way to do that after key generation?)
+
+# Ensure that the ssh_host_rsa_key file is present and non-empty:
+           if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
+               echo "The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty!"
+           else
+               if [ $(stat -c "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
+                   echo "Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600 !"
+               fi
+
+               # propose changes needed for sshd_config (if any)
+               if ! grep -q "^HostKey ${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
+                   echo "/etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
+                   echo "Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
+               fi
+           fi
+       fi
+    fi
+
+# FIXME: look at the ownership/privileges of the various keyrings,
+#    directories housing them, etc (what should those values be?  can
+#    we make them as minimal as possible?)
+
+# FIXME: look to see that the ownertrust rules are set properly on the
+#    authentication keyring
+
+# FIXME:  make sure that at least one identity certifier exists
+
+}
+
 # retrieve key from web of trust, import it into the host keyring, and
 # ltsign the key in the host keyring so that it may certify other keys
 add_certifier() {
@@ -567,6 +663,10 @@ case $COMMAND in
        publish_server_key
        ;;
 
+    'diagnostics'|'d')
+       diagnostics
+       ;;
+
     'add-identity-certifier'|'add-certifier'|'a')
        add_certifier "$1"
        ;;