diff options
author | Daniel Kahn Gillmor <dkg@fifthhorseman.net> | 2008-07-31 22:41:29 -0400 |
---|---|---|
committer | Daniel Kahn Gillmor <dkg@fifthhorseman.net> | 2008-07-31 22:41:29 -0400 |
commit | 91f299c44f20f913ac5309a67d6cf9162c101810 (patch) | |
tree | 3783b4287e761dff274c87a42d7aff9ad2e2e38c /src | |
parent | 60931f1c182c6b163862c2eb34b48e459c51c23a (diff) |
properly handle host keys with no expiration date, store host key fingerprint for later use in diagnostics.
Diffstat (limited to 'src')
-rwxr-xr-x | src/monkeysphere-server | 27 |
1 files changed, 17 insertions, 10 deletions
diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 16836b2..db0fa97 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -383,15 +383,15 @@ diagnostics() { # * check on the status and validity of the key and public certificates local seckey local keysfound - local keyexp local curdate local warnwindow local warndate local create local expire local uid + local fingerprint - seckey=$(gpg_host --list-secret-keys --with-colons --fixed-list-mode) + seckey=$(gpg_host --list-secret-keys --fingerprint --with-colons --fixed-list-mode) keysfound=$(echo "$seckey" | grep -c ^sec:) curdate=$(date +%s) # warn when anything is 2 months away from expiration @@ -405,17 +405,22 @@ diagnostics() { if (( "$keysfound" > 1 )); then echo "more than one host key found?" else + create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:) + expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:) + fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:) # check for key expiration: - keyexp=$(echo "$seckey" | grep ^sec: | cut -f7 -d:) - if (( "$keyexp" < "$curdate" )); then - echo "Host key is expired!" + if [ "$expire" ]; then + if (( "$expire" < "$curdate" )); then + echo "Host key is expired!" # FIXME: recommend a way to resolve this other than re-keying? - elif (( "$keyexp" < "$warndate" )); then - echo "Host key expires in less than $warnwindow:" $(date -d "$(( $keyexp - $curdate )) seconds" +%F) + elif (( "$expire" < "$warndate" )); then + echo "Host key expires in less than $warnwindow:" $(date -d "$(( $expire - $curdate )) seconds" +%F) # FIXME: recommend a way to resolve this? + fi fi + # and weirdnesses: - if (( $(echo "$seckey" | grep ^sec: | cut -f6 -d:) > "$curdate" )); then + if [ "$create" ] && (( "$create" > "$curdate" )); then echo "Host key was created in the future(?!). Is your clock correct?" echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?" fi @@ -425,6 +430,7 @@ diagnostics() { while IFS=: read create expire uid ; do # FIXME: should we be doing any checking on the form # of the User ID? Should we be unmangling it somehow? + if [ "$create" ] && (( "$create" > "$curdate" )); then echo "User ID '$uid' was created in the future(?!). Is your clock correct?" echo "Recommendation: Check clock ($(date +%F_%T)); use NTP?" @@ -441,10 +447,11 @@ diagnostics() { done # FIXME: verify that the host key is properly published to the -# keyservers +# keyservers (do this with the non-privileged user) # FIXME: check that there are valid, non-expired certifying signatures -# attached to the host key +# attached to the host key after fetching from the public keyserver +# (do this with the non-privileged user as well) # FIXME: propose adding a revoker to the host key if none exist (do we # have a way to do that after key generation?) |