diff options
| -rw-r--r-- | etc/monkeysphere-server.conf | 6 | ||||
| -rwxr-xr-x | src/monkeysphere-server | 2 | ||||
| -rwxr-xr-x | tests/basic | 42 | ||||
| -rw-r--r-- | tests/etc/monkeysphere/monkeysphere-server.conf | 5 |
4 files changed, 32 insertions, 23 deletions
diff --git a/etc/monkeysphere-server.conf b/etc/monkeysphere-server.conf index b69420a..8b9ffa4 100644 --- a/etc/monkeysphere-server.conf +++ b/etc/monkeysphere-server.conf @@ -23,6 +23,6 @@ # Path to a user controlled authorized_keys file to be added to the # monkeysphere-generated authorized_keys file. '%h' will be replaced # by the home directory of the user, and '%u' will by replaced by the -# username of the user. To not add any user-controlled file set this -# variable to be the empty string, "". -#RAW_AUTHORIZED_KEYS="%h/.ssh/authorized_keys" +# username of the user. Setting this variable to 'none' prevents the +# inclusion of user controlled authorized_keys file. +# RAW_AUTHORIZED_KEYS="%h/.ssh/authorized_keys" diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 0b63e5c..5f0cb73 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -230,7 +230,7 @@ update_users() { # add user-controlled authorized_keys file if specified # translate ssh-style path variables rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS") - if [ "$rawAuthorizedKeys" ] ; then + if [ "$rawAuthorizedKeys" != 'none' ] ; then log debug "checking for raw authorized_keys..." if [ -s "$rawAuthorizedKeys" ] ; then # check permissions on the authorized_keys file path diff --git a/tests/basic b/tests/basic index ec92e1a..d79b64b 100755 --- a/tests/basic +++ b/tests/basic @@ -70,6 +70,8 @@ cleanup() { ## setup trap trap failed_cleanup EXIT + +### SETUP VARIABLES ## set up some variables to ensure that we're operating strictly in ## the tests, not system-wide: @@ -89,6 +91,7 @@ export PATH="$TESTDIR"/../src:"$TESTDIR"/../src/keytrans:"$PATH" export MONKEYSPHERE_SYSDATADIR="$TEMPDIR" export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR" +export MONKEYSPHERE_SERVER_CONFIG="$TEMPDIR"/monkeysphere-server.conf export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami) export MONKEYSPHERE_CHECK_KEYSERVER=false @@ -98,6 +101,9 @@ export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket export SSHD_PID= + +### CONFIGURE ENVIRONMENTS + # copy in admin and testuser home to tmp echo "### copying admin and testuser homes..." cp -a "$TESTDIR"/home/admin "$TEMPDIR"/ @@ -108,36 +114,43 @@ TESTHOME="$TEMPDIR"/testuser export GNUPGHOME="$TESTHOME"/.gnupg export SSH_ASKPASS="$TESTHOME"/.ssh/askpass export MONKEYSPHERE_HOME="$TESTHOME"/.monkeysphere - cat <<EOF >> "$TESTHOME"/.ssh/config UserKnownHostsFile $TESTHOME/.ssh/known_hosts IdentityFile $TESTHOME/.ssh/no-such-identity ProxyCommand $TESTHOME/.ssh/proxy-command %h %p $SOCKET EOF - cat <<EOF >> "$MONKEYSPHERE_HOME"/monkeysphere.conf KNOWN_HOSTS=$TESTHOME/.ssh/known_hosts EOF - get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf -# set up a simple default monkeysphere-server.conf -cat <<EOF >> "$TEMPDIR"/monkeysphere-server.conf -AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids" +# set up sshd +echo "### configuring sshd..." +cp etc/ssh/sshd_config "$SSHD_CONFIG" +# write the sshd_config +cat <<EOF >> "$SSHD_CONFIG" +HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key +AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u EOF -### SERVER TESTS - -# setup monkeysphere directories +# set up monkeysphere-server +echo "### configuring monkeysphere..." mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/gnupg-host mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authorized_keys mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/tmp +cp etc/monkeysphere/monkeysphere-server.conf "$MONKEYSPHERE_SERVER_CONFIG" +cat <<EOF >> "$MONKEYSPHERE_SERVER_CONFIG" +AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids" +EOF cat <<EOF > "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication/gpg.conf primary-keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-authentication/pubring.gpg keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-host/pubring.gpg EOF + +### SERVER TESTS + # create a new host key echo "### generating server key..." # add gpg.conf with quick-random @@ -161,14 +174,6 @@ echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID" echo "### adding admin as certifier..." echo y | monkeysphere-server add-identity-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg -# initialize base sshd_config -echo "### configuring sshd..." -cp etc/ssh/sshd_config "$SSHD_CONFIG" -# write the sshd_config -cat <<EOF >> "$SSHD_CONFIG" -HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key -AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u -EOF ### TESTUSER TESTS @@ -200,8 +205,7 @@ monkeysphere-server update-users $(whoami) # make sure the user can NOT connect echo "### ssh connection test for server authentication denial..." -ssh_test -ret="$?" +ssh_test || ret="$?" if [ "$ret" != '255' ] ; then echo "### connection should have failed!" exit "$ret" diff --git a/tests/etc/monkeysphere/monkeysphere-server.conf b/tests/etc/monkeysphere/monkeysphere-server.conf new file mode 100644 index 0000000..5b4d90f --- /dev/null +++ b/tests/etc/monkeysphere/monkeysphere-server.conf @@ -0,0 +1,5 @@ +# Base monkeysphere-server.conf for monkeysphere tests + +# AUTHORIZED_USER_IDS variable will be added dynamically during test. + +RAW_AUTHORIZED_KEYS= |