summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorDaniel Kahn Gillmor <dkg@fifthhorseman.net>2008-07-31 22:41:29 -0400
committerDaniel Kahn Gillmor <dkg@fifthhorseman.net>2008-07-31 22:41:29 -0400
commit91f299c44f20f913ac5309a67d6cf9162c101810 (patch)
tree3783b4287e761dff274c87a42d7aff9ad2e2e38c /src
parent60931f1c182c6b163862c2eb34b48e459c51c23a (diff)
properly handle host keys with no expiration date, store host key fingerprint for later use in diagnostics.
Diffstat (limited to 'src')
-rwxr-xr-xsrc/monkeysphere-server27
1 files changed, 17 insertions, 10 deletions
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 16836b2..db0fa97 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -383,15 +383,15 @@ diagnostics() {
# * check on the status and validity of the key and public certificates
local seckey
local keysfound
- local keyexp
local curdate
local warnwindow
local warndate
local create
local expire
local uid
+ local fingerprint
- seckey=$(gpg_host --list-secret-keys --with-colons --fixed-list-mode)
+ seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
keysfound=$(echo "$seckey" | grep -c ^sec:)
curdate=$(date +%s)
# warn when anything is 2 months away from expiration
@@ -405,17 +405,22 @@ diagnostics() {
if (( "$keysfound" > 1 )); then
echo "more than one host key found?"
else
+ create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
+ expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
+ fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
# check for key expiration:
- keyexp=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
- if (( "$keyexp" < "$curdate" )); then
- echo "Host key is expired!"
+ if [ "$expire" ]; then
+ if (( "$expire" < "$curdate" )); then
+ echo "Host key is expired!"
# FIXME: recommend a way to resolve this other than re-keying?
- elif (( "$keyexp" < "$warndate" )); then
- echo "Host key expires in less than $warnwindow:" $(date -d "$(( $keyexp - $curdate )) seconds" +%F)
+ elif (( "$expire" < "$warndate" )); then
+ echo "Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F)
# FIXME: recommend a way to resolve this?
+ fi
fi
+
# and weirdnesses:
- if (( $(echo "$seckey" | grep ^sec: | cut -f6 -d:) > "$curdate" )); then
+ if [ "$create" ] && (( "$create" > "$curdate" )); then
echo "Host key was created in the future(?!). Is your clock correct?"
echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
fi
@@ -425,6 +430,7 @@ diagnostics() {
while IFS=: read create expire uid ; do
# FIXME: should we be doing any checking on the form
# of the User ID? Should we be unmangling it somehow?
+
if [ "$create" ] && (( "$create" > "$curdate" )); then
echo "User ID '$uid' was created in the future(?!). Is your clock correct?"
echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?"
@@ -441,10 +447,11 @@ diagnostics() {
done
# FIXME: verify that the host key is properly published to the
-# keyservers
+# keyservers (do this with the non-privileged user)
# FIXME: check that there are valid, non-expired certifying signatures
-# attached to the host key
+# attached to the host key after fetching from the public keyserver
+# (do this with the non-privileged user as well)
# FIXME: propose adding a revoker to the host key if none exist (do we
# have a way to do that after key generation?)