summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJameson Graef Rollins <jrollins@phys.columbia.edu>2008-08-01 14:49:02 -0700
committerJameson Graef Rollins <jrollins@phys.columbia.edu>2008-08-01 14:49:02 -0700
commit8ec4e9b0a4a58aece8e5034324971ab40b25fa12 (patch)
tree40e3ec9c0ea48db1fc31afccbf46d7dcd7de1f5c
parentb5df4f6f51830558e50061922b659c14b8d4d9e0 (diff)
some tweaks to output formatting for diagnostic command.
-rwxr-xr-xsrc/monkeysphere-server97
1 files changed, 49 insertions, 48 deletions
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index db0fa97..63c3668 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -398,53 +398,54 @@ diagnostics() {
warnwindow='2 months'
warndate=$(date +%s -d "$warnwindow")
+ echo "Checking host GPG key..."
if (( "$keysfound" < 1 )); then
- echo "No host key found!"
- echo "Recommendation: run 'monkeysphere-server gen-key'"
+ echo "! No host key found."
+ echo " - Recommendation: run 'monkeysphere-server gen-key'"
+ elif (( "$keysfound" > 1 )); then
+ echo "! More than one host key found?"
+ # FIXME: recommend a way to resolve this
else
- if (( "$keysfound" > 1 )); then
- echo "more than one host key found?"
- else
- create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
- expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
- fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
+ create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
+ expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
+ fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
# check for key expiration:
- if [ "$expire" ]; then
- if (( "$expire" < "$curdate" )); then
- echo "Host key is expired!"
+ if [ "$expire" ]; then
+ if (( "$expire" < "$curdate" )); then
+ echo "! Host key is expired."
# FIXME: recommend a way to resolve this other than re-keying?
- elif (( "$expire" < "$warndate" )); then
- echo "Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
+ elif (( "$expire" < "$warndate" )); then
+ echo "! Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
# FIXME: recommend a way to resolve this?
- fi
fi
-
+ fi
+
# and weirdnesses:
- if [ "$create" ] && (( "$create" > "$curdate" )); then
- echo "Host key was created in the future(?!). Is your clock correct?"
- echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
- fi
+ if [ "$create" ] && (( "$create" > "$curdate" )); then
+ echo "! Host key was created in the future(?!). Is your clock correct?"
+ echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+ fi
# check for UserID expiration:
- echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
- while IFS=: read create expire uid ; do
- # FIXME: should we be doing any checking on the form
- # of the User ID? Should we be unmangling it somehow?
-
- if [ "$create" ] && (( "$create" > "$curdate" )); then
- echo "User ID '$uid' was created in the future(?!). Is your clock correct?"
- echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
- fi
- if [ "$expire" ] ; then
- if (( "$expire" < "$curdate" )); then
- echo "User ID '$uid' is expired!"
- # FIXME: recommend a way to resolve this
- elif (( "$expire" < "$warndate" )); then
- echo "User ID '$uid' expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
+ echo "$seckey" | grep ^uid: | cut -d: -f6,7,10 | \
+ while IFS=: read create expire uid ; do
+ # FIXME: should we be doing any checking on the form
+ # of the User ID? Should we be unmangling it somehow?
+
+ if [ "$create" ] && (( "$create" > "$curdate" )); then
+ echo "! User ID '$uid' was created in the future(?!). Is your clock correct?"
+ echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
+ fi
+ if [ "$expire" ] ; then
+ if (( "$expire" < "$curdate" )); then
+ echo "! User ID '$uid' is expired."
# FIXME: recommend a way to resolve this
- fi
+ elif (( "$expire" < "$warndate" )); then
+ echo "! User ID '$uid' expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
+ # FIXME: recommend a way to resolve this
fi
- done
+ fi
+ done
# FIXME: verify that the host key is properly published to the
# keyservers (do this with the non-privileged user)
@@ -456,19 +457,19 @@ diagnostics() {
# FIXME: propose adding a revoker to the host key if none exist (do we
# have a way to do that after key generation?)
-# Ensure that the ssh_host_rsa_key file is present and non-empty:
- if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
- echo "The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty!"
- else
- if [ $(stat -c '%a' "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
- echo "Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600 !"
- fi
+ # Ensure that the ssh_host_rsa_key file is present and non-empty:
+ echo "Checking host SSH key..."
+ if [ ! -s "${VARLIB}/ssh_host_rsa_key" ] ; then
+ echo "! The host key as prepared for SSH (${VARLIB}/ssh_host_rsa_key) is missing or empty."
+ else
+ if [ $(stat -c '%a' "${VARLIB}/ssh_host_rsa_key") != 600 ] ; then
+ echo "! Permissions seem wrong for ${VARLIB}/ssh_host_rsa_key -- should be 0600."
+ fi
- # propose changes needed for sshd_config (if any)
- if ! grep -q "^HostKey ${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
- echo "/etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
- echo "Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
- fi
+ # propose changes needed for sshd_config (if any)
+ if ! grep -q "^HostKey ${VARLIB}/ssh_host_rsa_key$" /etc/ssh/sshd_config; then
+ echo "! /etc/ssh/sshd_config does not point to the monkeysphere host key (${VARLIB}/ssh_host_rsa_key)."
+ echo " - Recommendation: add a line to /etc/ssh/sshd_config: 'HostKey ${VARLIB}/ssh_host_rsa_key'"
fi
fi
fi