summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniel Kahn Gillmor <dkg@fifthhorseman.net>2008-08-11 18:10:46 -0400
committerDaniel Kahn Gillmor <dkg@fifthhorseman.net>2008-08-11 18:10:46 -0400
commit0565fa2f4dd1e6b563d00771bf71142c4004aa9d (patch)
tree5bc64035d09d2fbd66c59f52e756fd8bb7a054d4
parent71957c6582a865d214db0cf91fb6d98da421ffc0 (diff)
added monkeysphere-server diagnostics to check for (and advise) AuthorizedKeysFile changes for monkeysphere-enabled authorized_keys
-rwxr-xr-xsrc/monkeysphere-server17
1 files changed, 15 insertions, 2 deletions
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 7fac3ee..9e025f9 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -468,11 +468,11 @@ diagnostics() {
fi
# propose changes needed for sshd_config (if any)
- if ! grep -q "^HostKey ${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
+ if ! grep -q "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
echo "! /etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
echo " - Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
fi
- if badhostkeys=$(grep '^HostKey' | grep -q -v "^HostKey ${VARLIB}/ssh_host_rsa_key$") ; then
+ if badhostkeys=$(grep -i '^HostKey' | grep -q -v "^HostKey[[:space:]]\+${VARLIB}/ssh_host_rsa_key$") ; then
echo "! /etc/sshd_config refers to some non-monkeysphere host keys:"
echo "$badhostkeys"
echo " - Recommendation: remove the above HostKey lines from /etc/ssh/sshd_config"
@@ -489,6 +489,19 @@ diagnostics() {
# FIXME: make sure that at least one identity certifier exists
+ echo "Checking for MonkeySphere-enabled public-key authentication for users ..."
+ # Ensure that User ID authentication is enabled:
+ if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$" /etc/ssh/sshd_config; then
+ echo "! /etc/ssh/sshd_config does not point to monkeysphere authorized keys."
+ echo " - Recommendation: add a line to /etc/ssh/sshd_config: 'AuthorizedKeysFile ${VARLIB}/authorized_keys/%u'"
+ fi
+ if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' | grep -q -v "^AuthorizedKeysFile[[:space:]]\+${VARLIB}/authorized_keys/%u$") ; then
+ echo "! /etc/sshd_config refers to non-monkeysphere authorized_keys files:"
+ echo "$badauthorizedkeys"
+ echo " - Recommendation: remove the above AuthorizedKeysFile lines from /etc/ssh/sshd_config"
+ fi
+
+
}
# retrieve key from web of trust, import it into the host keyring, and