From 34439fbc29dde4d946fa6542cf441655aed06f5e Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 28 Oct 2008 01:58:54 -0400 Subject: tests now avoid prompting for default identity files. --- tests/basic | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'tests/basic') diff --git a/tests/basic b/tests/basic index 46ba63c..3ec4a21 100755 --- a/tests/basic +++ b/tests/basic @@ -23,6 +23,7 @@ launch_sshd() { socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log & export SSHD_PID=$! + # wait until the socket is created before continuing while [ ! -S "$SOCKET" ] ; do sleep 1 done @@ -89,6 +90,7 @@ cp -a "$TESTDIR"/home/testuser "$TEMPDIR"/ cat <> "$TEMPDIR"/testuser/.ssh/config UserKnownHostsFile $TEMPDIR/testuser/.ssh/known_hosts +IdentityFile $TEMPDIR/testuser/.ssh/no-such-identity ProxyCommand $TEMPDIR/testuser/.ssh/proxy-command %h %p $SOCKET EOF @@ -187,8 +189,6 @@ launch_sshd # and make sure the user can no longer connect echo "### testuser attempting to connect to sshd socket..." -# FIXME: this prompts for the passphrase for the default identity -# file. how can this be avoided? ssh_test || SSH_RETURN="$?" if [ "$SSH_RETURN" != '255' ] ; then exit -- cgit v1.2.3 From 3e5ccfd11d143e113944a8c35831618421d90552 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 28 Oct 2008 18:04:51 -0400 Subject: do not choke at end of test suite if no sshd was ever launched. --- tests/basic | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'tests/basic') diff --git a/tests/basic b/tests/basic index 3ec4a21..393bcc2 100755 --- a/tests/basic +++ b/tests/basic @@ -43,7 +43,7 @@ failed_cleanup() { } cleanup() { - if ( ps "$SSHD_PID" >/dev/null ) ; then + if [ "$SSHD_PID" ] && ( ps "$SSHD_PID" >/dev/null ) ; then echo "### stopping still-running sshd..." kill "$SSHD_PID" fi @@ -82,6 +82,7 @@ export MONKEYSPHERE_CHECK_KEYSERVER=false export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket +export SSHD_PID= # copy in admin and testuser home to tmp echo "### copying admin and testuser homes..." -- cgit v1.2.3 From 30ac88c7bd68e38af8b2b06327bc1c6492a337c6 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 28 Oct 2008 18:18:24 -0400 Subject: test suite now auto-detects which flavor of prng support GPG uses. --- debian/changelog | 2 ++ tests/basic | 12 +++++++++++- tests/home/testuser/.gnupg/gpg.conf | 2 -- 3 files changed, 13 insertions(+), 3 deletions(-) (limited to 'tests/basic') diff --git a/debian/changelog b/debian/changelog index 05383d4..30b33f0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -6,6 +6,8 @@ monkeysphere (0.18-1) UNRELEASED; urgency=low [ Daniel Kahn Gillmor ] * update install to ensure placement of /etc/monkeysphere/gnupg-{host,authentication}.conf + * choose either --quick-random or --debug-quick-random depending on + which gpg supports for the test suite. -- Daniel Kahn Gillmor Tue, 28 Oct 2008 17:58:25 -0400 diff --git a/tests/basic b/tests/basic index 393bcc2..9c3796c 100755 --- a/tests/basic +++ b/tests/basic @@ -42,6 +42,14 @@ failed_cleanup() { cleanup } +get_gpg_prng_arg() { + if (gpg --quick-random --version >/dev/null 2>&1) ; then + echo quick-random + elif (gpg --debug-quick-random --version >/dev/null 2>&1) ; then + echo debug-quick-random + fi +} + cleanup() { if [ "$SSHD_PID" ] && ( ps "$SSHD_PID" >/dev/null ) ; then echo "### stopping still-running sshd..." @@ -99,6 +107,8 @@ cat <> "$TEMPDIR"/testuser/.monkeysphere/monkeysphere.conf KNOWN_HOSTS=$TEMPDIR/testuser/.ssh/known_hosts EOF +get_gpg_prng_arg >> "$TEMPDIR"/testuser/.gnupg/gpg.conf + # set up a simple default monkeysphere-server.conf cat <> "$TEMPDIR"/monkeysphere-server.conf AUTHORIZED_USER_IDS="$TEMPDIR/testuser/.monkeysphere/authorized_user_ids" @@ -118,7 +128,7 @@ EOF # create a new host key echo "### generating server key..." # add gpg.conf with quick-random -echo "quick-random" >> "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf +get_gpg_prng_arg >> "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf echo | monkeysphere-server gen-key --length 1024 --expire 0 testhost # remove the gpg.conf rm "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf diff --git a/tests/home/testuser/.gnupg/gpg.conf b/tests/home/testuser/.gnupg/gpg.conf index f65c71b..c8cb60d 100644 --- a/tests/home/testuser/.gnupg/gpg.conf +++ b/tests/home/testuser/.gnupg/gpg.conf @@ -1,5 +1,3 @@ -# command to avoid depleting the system entropy -quick-random # other options verify-options show-uid-validity list-options show-uid-validity -- cgit v1.2.3 From bee6028687945fd7d8d6eab98c26def2ecadf8b1 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 28 Oct 2008 18:26:10 -0400 Subject: testing: tighten up the umask before sshd launch, so that the socket is not exposed during the test. --- tests/basic | 1 + 1 file changed, 1 insertion(+) (limited to 'tests/basic') diff --git a/tests/basic b/tests/basic index 9c3796c..d82719d 100755 --- a/tests/basic +++ b/tests/basic @@ -20,6 +20,7 @@ gpgadmin() { } launch_sshd() { + umask 0077 socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log & export SSHD_PID=$! -- cgit v1.2.3 From f7242749c484cac12aacf8bcfe19bdea72c89aaa Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 28 Oct 2008 19:20:14 -0400 Subject: chown authorized_keys files as jrollins, and add monkeysphere tmpdir in SYSDATADIR, for atomic moves of authorized_keys. --- debian/changelog | 6 +++++- debian/dirs | 1 + src/monkeysphere-server | 9 +++++++-- tests/basic | 49 +++++++++++++++++++++---------------------------- 4 files changed, 34 insertions(+), 31 deletions(-) (limited to 'tests/basic') diff --git a/debian/changelog b/debian/changelog index 30b33f0..78266d5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -2,6 +2,10 @@ monkeysphere (0.18-1) UNRELEASED; urgency=low [ Jameson Graef Rollins ] * Fix bugs in authorized_{user_ids,keys} file permission checking. + * Add new monkeysphere tmpdir to enable atomic moves of authorized_keys + files. + * chown authorized_keys files to `whoami`, for compatibility with test + suite. [ Daniel Kahn Gillmor ] * update install to ensure placement of @@ -9,7 +13,7 @@ monkeysphere (0.18-1) UNRELEASED; urgency=low * choose either --quick-random or --debug-quick-random depending on which gpg supports for the test suite. - -- Daniel Kahn Gillmor Tue, 28 Oct 2008 17:58:25 -0400 + -- Jameson Graef Rollins Tue, 28 Oct 2008 19:19:20 -0400 monkeysphere (0.17-1) experimental; urgency=low diff --git a/debian/dirs b/debian/dirs index e9390a7..b2bd77c 100644 --- a/debian/dirs +++ b/debian/dirs @@ -1,5 +1,6 @@ var/lib/monkeysphere var/lib/monkeysphere/authorized_keys +var/lib/monkeysphere/tmp usr/bin usr/sbin usr/share diff --git a/src/monkeysphere-server b/src/monkeysphere-server index b6bf78b..846eb81 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -20,6 +20,11 @@ export SYSSHAREDIR SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"} export SYSDATADIR +# monkeysphere temp directory, in sysdatadir to enable atomic moves of +# authorized_keys files +MSTMPDIR="${SYSDATADIR}/tmp" +export MSTMPDIR + # UTC date in ISO 8601 format if needed DATE=$(date -u '+%FT%T') @@ -173,7 +178,7 @@ update_users() { log verbose "----- user: $uname -----" # make temporary directory - TMPLOC=$(mktemp -d ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX) + TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) # trap to delete temporary directory on exit trap "rm -rf $TMPLOC" EXIT @@ -244,7 +249,7 @@ update_users() { # authorized_keys file as the user in question, so the # file must be readable by that user at least. # FIXME: is there a better way to do this? - chown root "$AUTHORIZED_KEYS" + chown $(whoami) "$AUTHORIZED_KEYS" chgrp $(getent passwd "$uname" | cut -f4 -d:) "$AUTHORIZED_KEYS" chmod g+r "$AUTHORIZED_KEYS" diff --git a/tests/basic b/tests/basic index d82719d..067a02c 100755 --- a/tests/basic +++ b/tests/basic @@ -19,20 +19,27 @@ gpgadmin() { GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg "$@" } -launch_sshd() { +ssh_test() { umask 0077 + + # start the ssh daemon on the socket socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log & - export SSHD_PID=$! + SSHD_PID="$!" # wait until the socket is created before continuing while [ ! -S "$SOCKET" ] ; do sleep 1 done -} -ssh_test() { + # make a client connection to the socket ssh-agent bash -c \ "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config testhost true" + RETURN="$?" + + # kill the previous sshd process if it's still running + kill "$SSHD_PID" + + return "$RETURN" } failed_cleanup() { @@ -52,11 +59,6 @@ get_gpg_prng_arg() { } cleanup() { - if [ "$SSHD_PID" ] && ( ps "$SSHD_PID" >/dev/null ) ; then - echo "### stopping still-running sshd..." - kill "$SSHD_PID" - fi - echo "### removing temp dir..." rm -rf "$TEMPDIR" @@ -88,6 +90,7 @@ export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR" export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src export MONKEYSPHERE_MONKEYSPHERE_USER="$USER" export MONKEYSPHERE_CHECK_KEYSERVER=false +export MONKEYSPHERE_LOG_LEVEL=DEBUG export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket @@ -150,6 +153,7 @@ echo "### adding admin as certifier..." echo y | monkeysphere-server add-identity-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg # initialize base sshd_config +echo "### configuring sshd..." cp etc/ssh/sshd_config "$SSHD_CONFIG" # write the sshd_config cat <> "$SSHD_CONFIG" @@ -157,10 +161,6 @@ HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u EOF -# launch test sshd with the new host key. -echo "### starting sshd..." -launch_sshd - ### TESTUSER TESTS # generate an auth subkey for the test user @@ -168,7 +168,6 @@ echo "### generating key for testuser..." export GNUPGHOME="$TEMPDIR"/testuser/.gnupg export SSH_ASKPASS="$TEMPDIR"/testuser/.ssh/askpass export MONKEYSPHERE_HOME="$TEMPDIR"/testuser/.monkeysphere - monkeysphere gen-subkey --expire 0 # add server key to testuser keychain @@ -183,26 +182,20 @@ monkeysphere-server update-users "$USER" # connect to test sshd, using monkeysphere-ssh-proxycommand to verify # the identity before connection. This should work in both directions! -echo "### testuser connecting to sshd socket..." +echo "### ssh connection test for success..." ssh_test -# kill the previous sshd process if it's still running -kill "$SSHD_PID" - -# now remove the testuser's authorized_user_ids file and reupdate -# authorized_keys file... +# remove the testuser's authorized_user_ids file and update +# authorized_keys file, this is to make sure that the ssh +# authentication FAILS... echo "### removing testuser authorized_user_ids and reupdating authorized_keys..." rm -f "$TEMPDIR"/testuser/.monkeysphere/authorized_user_ids monkeysphere-server update-users "$USER" -# restart the sshd -echo "### restarting sshd..." -launch_sshd - -# and make sure the user can no longer connect -echo "### testuser attempting to connect to sshd socket..." -ssh_test || SSH_RETURN="$?" -if [ "$SSH_RETURN" != '255' ] ; then +# make sure the user can NOT connect +echo "### ssh connection test for server authentication denial..." +ssh_test +if [ "$?" != '255' ] ; then exit fi -- cgit v1.2.3 From 4b5be52a9e06b2e2f0dfb1377e0a5d8bdaea1aef Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 28 Oct 2008 19:57:10 -0400 Subject: more work on test suite, and add new tmpdir to monkeysphere.dirs. --- debian/monkeysphere.dirs | 1 + tests/basic | 32 +++++++++++++++++++------------- 2 files changed, 20 insertions(+), 13 deletions(-) (limited to 'tests/basic') diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs index b0b2d9c..0ff6712 100644 --- a/debian/monkeysphere.dirs +++ b/debian/monkeysphere.dirs @@ -1,4 +1,5 @@ usr/share/monkeysphere var/lib/monkeysphere var/lib/monkeysphere/authorized_keys +var/lib/monkeysphere/tmp etc/monkeysphere diff --git a/tests/basic b/tests/basic index 067a02c..08705eb 100755 --- a/tests/basic +++ b/tests/basic @@ -23,6 +23,7 @@ ssh_test() { umask 0077 # start the ssh daemon on the socket + echo "##### starting ssh server..." socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log & SSHD_PID="$!" @@ -32,6 +33,7 @@ ssh_test() { done # make a client connection to the socket + echo "##### starting ssh client..." ssh-agent bash -c \ "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config testhost true" RETURN="$?" @@ -101,21 +103,27 @@ echo "### copying admin and testuser homes..." cp -a "$TESTDIR"/home/admin "$TEMPDIR"/ cp -a "$TESTDIR"/home/testuser "$TEMPDIR"/ -cat <> "$TEMPDIR"/testuser/.ssh/config -UserKnownHostsFile $TEMPDIR/testuser/.ssh/known_hosts -IdentityFile $TEMPDIR/testuser/.ssh/no-such-identity -ProxyCommand $TEMPDIR/testuser/.ssh/proxy-command %h %p $SOCKET +# set up environment for testuser +export HOME="$TEMPDIR"/testuser +export GNUPGHOME="$HOME"/.gnupg +export SSH_ASKPASS="$HOME"/.ssh/askpass +export MONKEYSPHERE_HOME="$HOME"/.monkeysphere + +cat <> "$HOME"/.ssh/config +UserKnownHostsFile $HOME/.ssh/known_hosts +IdentityFile $HOME/.ssh/no-such-identity +ProxyCommand $HOME/.ssh/proxy-command %h %p $SOCKET EOF -cat <> "$TEMPDIR"/testuser/.monkeysphere/monkeysphere.conf -KNOWN_HOSTS=$TEMPDIR/testuser/.ssh/known_hosts +cat <> "$MONKEYSPHERE_HOME"/monkeysphere.conf +KNOWN_HOSTS=$HOME/.ssh/known_hosts EOF -get_gpg_prng_arg >> "$TEMPDIR"/testuser/.gnupg/gpg.conf +get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf # set up a simple default monkeysphere-server.conf cat <> "$TEMPDIR"/monkeysphere-server.conf -AUTHORIZED_USER_IDS="$TEMPDIR/testuser/.monkeysphere/authorized_user_ids" +AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids" EOF ### SERVER TESTS @@ -124,6 +132,7 @@ EOF mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/gnupg-host mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authorized_keys +mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/tmp cat < "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication/gpg.conf primary-keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-authentication/pubring.gpg keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-host/pubring.gpg @@ -165,9 +174,6 @@ EOF # generate an auth subkey for the test user echo "### generating key for testuser..." -export GNUPGHOME="$TEMPDIR"/testuser/.gnupg -export SSH_ASKPASS="$TEMPDIR"/testuser/.ssh/askpass -export MONKEYSPHERE_HOME="$TEMPDIR"/testuser/.monkeysphere monkeysphere gen-subkey --expire 0 # add server key to testuser keychain @@ -178,7 +184,7 @@ gpgadmin --armor --export "$HOSTKEYID" | gpg --import echo "### export testuser key to server..." gpg --export testuser | monkeysphere-server gpg-authentication-cmd --import echo "### update server authorized_keys file for this testuser..." -monkeysphere-server update-users "$USER" +monkeysphere-server update-users testuser # connect to test sshd, using monkeysphere-ssh-proxycommand to verify # the identity before connection. This should work in both directions! @@ -190,7 +196,7 @@ ssh_test # authentication FAILS... echo "### removing testuser authorized_user_ids and reupdating authorized_keys..." rm -f "$TEMPDIR"/testuser/.monkeysphere/authorized_user_ids -monkeysphere-server update-users "$USER" +monkeysphere-server update-users testuser # make sure the user can NOT connect echo "### ssh connection test for server authentication denial..." -- cgit v1.2.3 From dbbd331815b6f15f675d2ce651678b8b2ec06d68 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 28 Oct 2008 21:27:47 -0400 Subject: cleaning up basic test. --- tests/basic | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) (limited to 'tests/basic') diff --git a/tests/basic b/tests/basic index 08705eb..1f4930f 100755 --- a/tests/basic +++ b/tests/basic @@ -90,7 +90,7 @@ export PATH="$TESTDIR"/../src:"$TESTDIR"/../src/keytrans:"$PATH" export MONKEYSPHERE_SYSDATADIR="$TEMPDIR" export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR" export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src -export MONKEYSPHERE_MONKEYSPHERE_USER="$USER" +export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami) export MONKEYSPHERE_CHECK_KEYSERVER=false export MONKEYSPHERE_LOG_LEVEL=DEBUG @@ -172,9 +172,9 @@ EOF ### TESTUSER TESTS -# generate an auth subkey for the test user +# generate an auth subkey for the test user that expires in 2 days echo "### generating key for testuser..." -monkeysphere gen-subkey --expire 0 +monkeysphere gen-subkey --expire 2 # add server key to testuser keychain echo "### export server key to testuser..." @@ -184,7 +184,7 @@ gpgadmin --armor --export "$HOSTKEYID" | gpg --import echo "### export testuser key to server..." gpg --export testuser | monkeysphere-server gpg-authentication-cmd --import echo "### update server authorized_keys file for this testuser..." -monkeysphere-server update-users testuser +monkeysphere-server update-users $(whoami) # connect to test sshd, using monkeysphere-ssh-proxycommand to verify # the identity before connection. This should work in both directions! @@ -196,13 +196,15 @@ ssh_test # authentication FAILS... echo "### removing testuser authorized_user_ids and reupdating authorized_keys..." rm -f "$TEMPDIR"/testuser/.monkeysphere/authorized_user_ids -monkeysphere-server update-users testuser +monkeysphere-server update-users $(whoami) # make sure the user can NOT connect echo "### ssh connection test for server authentication denial..." ssh_test -if [ "$?" != '255' ] ; then - exit +ret="$?" +if [ "$ret" != '255' ] ; then + echo "### connection should have failed!" + exit "$ret" fi trap - EXIT -- cgit v1.2.3 From 4af6e62dee8d977ab52f16b61d38051175655082 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 28 Oct 2008 22:32:56 -0400 Subject: touch known_hosts file in monkeysphere so that permission checking down't fail. remove spurios directory in monkeysphere.dirs. more work on test suite. --- debian/monkeysphere.dirs | 1 - src/monkeysphere | 8 +++++--- tests/basic | 24 +++++++++++----------- .../home/testuser/.monkeysphere/monkeysphere.conf | 2 ++ 4 files changed, 19 insertions(+), 16 deletions(-) (limited to 'tests/basic') diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs index b2bd77c..cfafe15 100644 --- a/debian/monkeysphere.dirs +++ b/debian/monkeysphere.dirs @@ -10,4 +10,3 @@ usr/share/man/man1 usr/share/man/man5 usr/share/man/man8 etc/monkeysphere -etc/monkeysphere/authorized_user_ids diff --git a/src/monkeysphere b/src/monkeysphere index 5703995..7e800cc 100755 --- a/src/monkeysphere +++ b/src/monkeysphere @@ -318,10 +318,12 @@ case $COMMAND in 'update-known_hosts'|'update-known-hosts'|'k') MODE='known_hosts' + # touch the known_hosts file so that the file permission check + # below won't fail upon not finding the file + (umask 0022 && touch "$KNOWN_HOSTS") + # check permissions on the known_hosts file path - if ! check_key_file_permissions "$USER" "$KNOWN_HOSTS" ; then - failure "Improper permissions on known_hosts file path." - fi + check_key_file_permissions "$USER" "$KNOWN_HOSTS" || failure # if hosts are specified on the command line, process just # those hosts diff --git a/tests/basic b/tests/basic index 1f4930f..ec92e1a 100755 --- a/tests/basic +++ b/tests/basic @@ -104,19 +104,19 @@ cp -a "$TESTDIR"/home/admin "$TEMPDIR"/ cp -a "$TESTDIR"/home/testuser "$TEMPDIR"/ # set up environment for testuser -export HOME="$TEMPDIR"/testuser -export GNUPGHOME="$HOME"/.gnupg -export SSH_ASKPASS="$HOME"/.ssh/askpass -export MONKEYSPHERE_HOME="$HOME"/.monkeysphere - -cat <> "$HOME"/.ssh/config -UserKnownHostsFile $HOME/.ssh/known_hosts -IdentityFile $HOME/.ssh/no-such-identity -ProxyCommand $HOME/.ssh/proxy-command %h %p $SOCKET +TESTHOME="$TEMPDIR"/testuser +export GNUPGHOME="$TESTHOME"/.gnupg +export SSH_ASKPASS="$TESTHOME"/.ssh/askpass +export MONKEYSPHERE_HOME="$TESTHOME"/.monkeysphere + +cat <> "$TESTHOME"/.ssh/config +UserKnownHostsFile $TESTHOME/.ssh/known_hosts +IdentityFile $TESTHOME/.ssh/no-such-identity +ProxyCommand $TESTHOME/.ssh/proxy-command %h %p $SOCKET EOF cat <> "$MONKEYSPHERE_HOME"/monkeysphere.conf -KNOWN_HOSTS=$HOME/.ssh/known_hosts +KNOWN_HOSTS=$TESTHOME/.ssh/known_hosts EOF get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf @@ -128,7 +128,7 @@ EOF ### SERVER TESTS -# setup monkeysphere temp gnupghome directories +# setup monkeysphere directories mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/gnupg-host mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authorized_keys @@ -195,7 +195,7 @@ ssh_test # authorized_keys file, this is to make sure that the ssh # authentication FAILS... echo "### removing testuser authorized_user_ids and reupdating authorized_keys..." -rm -f "$TEMPDIR"/testuser/.monkeysphere/authorized_user_ids +rm -f "$TESTHOME"/.monkeysphere/authorized_user_ids monkeysphere-server update-users $(whoami) # make sure the user can NOT connect diff --git a/tests/home/testuser/.monkeysphere/monkeysphere.conf b/tests/home/testuser/.monkeysphere/monkeysphere.conf index 59cc0cf..dbe0233 100644 --- a/tests/home/testuser/.monkeysphere/monkeysphere.conf +++ b/tests/home/testuser/.monkeysphere/monkeysphere.conf @@ -1,3 +1,5 @@ # monkeysphere config for testuser in monkeysphere test suite +LOG_LEVEL=DEBUG + # KNOWN_HOSTS will be dynamically defined after creation. -- cgit v1.2.3 From 11cd8c4839367d87b0dbcb58f46e81391c0dac1c Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 28 Oct 2008 23:27:11 -0400 Subject: move to using 'none' for the RAW_AUTHORIZED_KEY value to use for *not* including a user-controlled authorized_keys file. more fixes on test suite. --- etc/monkeysphere-server.conf | 6 ++-- src/monkeysphere-server | 2 +- tests/basic | 42 ++++++++++++++----------- tests/etc/monkeysphere/monkeysphere-server.conf | 5 +++ 4 files changed, 32 insertions(+), 23 deletions(-) create mode 100644 tests/etc/monkeysphere/monkeysphere-server.conf (limited to 'tests/basic') diff --git a/etc/monkeysphere-server.conf b/etc/monkeysphere-server.conf index b69420a..8b9ffa4 100644 --- a/etc/monkeysphere-server.conf +++ b/etc/monkeysphere-server.conf @@ -23,6 +23,6 @@ # Path to a user controlled authorized_keys file to be added to the # monkeysphere-generated authorized_keys file. '%h' will be replaced # by the home directory of the user, and '%u' will by replaced by the -# username of the user. To not add any user-controlled file set this -# variable to be the empty string, "". -#RAW_AUTHORIZED_KEYS="%h/.ssh/authorized_keys" +# username of the user. Setting this variable to 'none' prevents the +# inclusion of user controlled authorized_keys file. +# RAW_AUTHORIZED_KEYS="%h/.ssh/authorized_keys" diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 0b63e5c..5f0cb73 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -230,7 +230,7 @@ update_users() { # add user-controlled authorized_keys file if specified # translate ssh-style path variables rawAuthorizedKeys=$(translate_ssh_variables "$uname" "$RAW_AUTHORIZED_KEYS") - if [ "$rawAuthorizedKeys" ] ; then + if [ "$rawAuthorizedKeys" != 'none' ] ; then log debug "checking for raw authorized_keys..." if [ -s "$rawAuthorizedKeys" ] ; then # check permissions on the authorized_keys file path diff --git a/tests/basic b/tests/basic index ec92e1a..d79b64b 100755 --- a/tests/basic +++ b/tests/basic @@ -70,6 +70,8 @@ cleanup() { ## setup trap trap failed_cleanup EXIT + +### SETUP VARIABLES ## set up some variables to ensure that we're operating strictly in ## the tests, not system-wide: @@ -89,6 +91,7 @@ export PATH="$TESTDIR"/../src:"$TESTDIR"/../src/keytrans:"$PATH" export MONKEYSPHERE_SYSDATADIR="$TEMPDIR" export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR" +export MONKEYSPHERE_SERVER_CONFIG="$TEMPDIR"/monkeysphere-server.conf export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami) export MONKEYSPHERE_CHECK_KEYSERVER=false @@ -98,6 +101,9 @@ export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket export SSHD_PID= + +### CONFIGURE ENVIRONMENTS + # copy in admin and testuser home to tmp echo "### copying admin and testuser homes..." cp -a "$TESTDIR"/home/admin "$TEMPDIR"/ @@ -108,36 +114,43 @@ TESTHOME="$TEMPDIR"/testuser export GNUPGHOME="$TESTHOME"/.gnupg export SSH_ASKPASS="$TESTHOME"/.ssh/askpass export MONKEYSPHERE_HOME="$TESTHOME"/.monkeysphere - cat <> "$TESTHOME"/.ssh/config UserKnownHostsFile $TESTHOME/.ssh/known_hosts IdentityFile $TESTHOME/.ssh/no-such-identity ProxyCommand $TESTHOME/.ssh/proxy-command %h %p $SOCKET EOF - cat <> "$MONKEYSPHERE_HOME"/monkeysphere.conf KNOWN_HOSTS=$TESTHOME/.ssh/known_hosts EOF - get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf -# set up a simple default monkeysphere-server.conf -cat <> "$TEMPDIR"/monkeysphere-server.conf -AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids" +# set up sshd +echo "### configuring sshd..." +cp etc/ssh/sshd_config "$SSHD_CONFIG" +# write the sshd_config +cat <> "$SSHD_CONFIG" +HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key +AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u EOF -### SERVER TESTS - -# setup monkeysphere directories +# set up monkeysphere-server +echo "### configuring monkeysphere..." mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/gnupg-host mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authorized_keys mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/tmp +cp etc/monkeysphere/monkeysphere-server.conf "$MONKEYSPHERE_SERVER_CONFIG" +cat <> "$MONKEYSPHERE_SERVER_CONFIG" +AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids" +EOF cat < "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication/gpg.conf primary-keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-authentication/pubring.gpg keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-host/pubring.gpg EOF + +### SERVER TESTS + # create a new host key echo "### generating server key..." # add gpg.conf with quick-random @@ -161,14 +174,6 @@ echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID" echo "### adding admin as certifier..." echo y | monkeysphere-server add-identity-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg -# initialize base sshd_config -echo "### configuring sshd..." -cp etc/ssh/sshd_config "$SSHD_CONFIG" -# write the sshd_config -cat <> "$SSHD_CONFIG" -HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key -AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u -EOF ### TESTUSER TESTS @@ -200,8 +205,7 @@ monkeysphere-server update-users $(whoami) # make sure the user can NOT connect echo "### ssh connection test for server authentication denial..." -ssh_test -ret="$?" +ssh_test || ret="$?" if [ "$ret" != '255' ] ; then echo "### connection should have failed!" exit "$ret" diff --git a/tests/etc/monkeysphere/monkeysphere-server.conf b/tests/etc/monkeysphere/monkeysphere-server.conf new file mode 100644 index 0000000..5b4d90f --- /dev/null +++ b/tests/etc/monkeysphere/monkeysphere-server.conf @@ -0,0 +1,5 @@ +# Base monkeysphere-server.conf for monkeysphere tests + +# AUTHORIZED_USER_IDS variable will be added dynamically during test. + +RAW_AUTHORIZED_KEYS= -- cgit v1.2.3 From c5b6958858173044c74af2b0af6a8d46e5019221 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Tue, 28 Oct 2008 23:38:07 -0400 Subject: move away from using MONKEYSPHERE_SERVER_CONFIG in test suite. --- tests/basic | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'tests/basic') diff --git a/tests/basic b/tests/basic index d79b64b..f6fa7fc 100755 --- a/tests/basic +++ b/tests/basic @@ -91,7 +91,6 @@ export PATH="$TESTDIR"/../src:"$TESTDIR"/../src/keytrans:"$PATH" export MONKEYSPHERE_SYSDATADIR="$TEMPDIR" export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR" -export MONKEYSPHERE_SERVER_CONFIG="$TEMPDIR"/monkeysphere-server.conf export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami) export MONKEYSPHERE_CHECK_KEYSERVER=false @@ -139,8 +138,8 @@ mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/gnupg-host mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authorized_keys mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/tmp -cp etc/monkeysphere/monkeysphere-server.conf "$MONKEYSPHERE_SERVER_CONFIG" -cat <> "$MONKEYSPHERE_SERVER_CONFIG" +cp etc/monkeysphere/monkeysphere-server.conf "$TEMPDIR"/monkeysphere-server.conf +cat <> "$TEMPDIR"/monkeysphere-server.conf AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids" EOF cat < "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication/gpg.conf -- cgit v1.2.3 From 8d609df9ec376905dbed377c8b03a49ceca5efc5 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 29 Oct 2008 00:19:12 -0400 Subject: finish consolidating test suite ssh test into single function, and add more tests (for permission checking). --- tests/basic | 51 ++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 38 insertions(+), 13 deletions(-) (limited to 'tests/basic') diff --git a/tests/basic b/tests/basic index f6fa7fc..259a7f0 100755 --- a/tests/basic +++ b/tests/basic @@ -19,9 +19,13 @@ gpgadmin() { GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg "$@" } +# test ssh connection +# first argument is expected return code from ssh connection ssh_test() { umask 0077 + CODE=${1:-0} + # start the ssh daemon on the socket echo "##### starting ssh server..." socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log & @@ -32,16 +36,27 @@ ssh_test() { sleep 1 done + set +e + # make a client connection to the socket echo "##### starting ssh client..." ssh-agent bash -c \ "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config testhost true" RETURN="$?" - # kill the previous sshd process if it's still running + # kill the sshd process if it's still running kill "$SSHD_PID" - return "$RETURN" + set -e + + echo "##### return $RETURN" + if [ "$RETURN" = "$CODE" ] ; then + echo "##### ssh connection test returned as desired" + return 0 + else + echo "##### ssh connection test failed. expected return code $CODE" + return 1 + fi } failed_cleanup() { @@ -195,20 +210,30 @@ monkeysphere-server update-users $(whoami) echo "### ssh connection test for success..." ssh_test -# remove the testuser's authorized_user_ids file and update -# authorized_keys file, this is to make sure that the ssh -# authentication FAILS... -echo "### removing testuser authorized_user_ids and reupdating authorized_keys..." -rm -f "$TESTHOME"/.monkeysphere/authorized_user_ids +# remove the testuser's authorized_user_ids file, update, and make +# sure that the ssh authentication FAILS +echo "### removing testuser authorized_user_ids and updating..." +mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak} monkeysphere-server update-users $(whoami) +echo "### ssh connection test for server authentication denial..." +ssh_test 255 +mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,} -# make sure the user can NOT connect +# put improper permissions on authorized_user_ids file, update, and +# make sure ssh authentication FAILS +echo "### setting group writability on authorized_user_ids and updating..." +chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids +monkeysphere-server update-users $(whoami) echo "### ssh connection test for server authentication denial..." -ssh_test || ret="$?" -if [ "$ret" != '255' ] ; then - echo "### connection should have failed!" - exit "$ret" -fi +ssh_test 255 +chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids +echo "### setting other writability on authorized_user_ids and updating..." +chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids +monkeysphere-server update-users $(whoami) +echo "### ssh connection test for server authentication denial..." +ssh_test 255 +chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids + trap - EXIT -- cgit v1.2.3 From 753b7c5f74caa99f31254b44fac62c313ecbb1db Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 29 Oct 2008 01:38:39 -0400 Subject: set DISPLAY in test suite so that passphrase prompting falls through. --- src/common | 2 +- tests/basic | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) (limited to 'tests/basic') diff --git a/src/common b/src/common index 68a69e9..297e7f3 100644 --- a/src/common +++ b/src/common @@ -669,7 +669,7 @@ process_user_id() { else log debug " - unacceptable primary key." if [ -z "$sshKey" ] ; then - log error " ! primary key could not be translated (not RSA or DSA?)." + log error " ! primary key could not be translated (not RSA or DSA?)." else echo "1:${sshKey}" fi diff --git a/tests/basic b/tests/basic index 259a7f0..c85b449 100755 --- a/tests/basic +++ b/tests/basic @@ -115,6 +115,7 @@ export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket export SSHD_PID= +export DISPLAY=monkeys ### CONFIGURE ENVIRONMENTS -- cgit v1.2.3 From 37c5b03dbe70f8f3fe24d15318645e1678841879 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Wed, 29 Oct 2008 02:17:54 -0400 Subject: added comments and changelog notes about why the test script sets $DISPLAY --- debian/changelog | 6 ++++++ tests/basic | 4 ++++ 2 files changed, 10 insertions(+) (limited to 'tests/basic') diff --git a/debian/changelog b/debian/changelog index ebde5e4..f42b3d8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +monkeysphere (0.19-1) UNRELEASED; urgency=low + + * simulating an X11 session in the test script. + + -- + monkeysphere (0.18-1) experimental; urgency=low [ Jameson Graef Rollins ] diff --git a/tests/basic b/tests/basic index c85b449..d735578 100755 --- a/tests/basic +++ b/tests/basic @@ -115,6 +115,10 @@ export SSHD_CONFIG="$TEMPDIR"/sshd_config export SOCKET="$TEMPDIR"/ssh-socket export SSHD_PID= +# Make sure $DISPLAY is set to convince ssh and monkeysphere to fall +# back on $SSH_ASKPASS. Make sure it's not set to the current actual +# $DISPLAY (if one exists) because this test suite should not be doing +# *anything* with any running X11 session. export DISPLAY=monkeys ### CONFIGURE ENVIRONMENTS -- cgit v1.2.3