summaryrefslogtreecommitdiff
path: root/src/share/ma/diagnostics
blob: 0411080fb8cd3599fee36ecc0ab6cf11e997faf5 (plain)
  1. # -*-shell-script-*-
  2. # This should be sourced by bash (though we welcome changes to make it POSIX sh compliant)
  3. # Monkeysphere authentication diagnostics subcommand
  4. #
  5. # The monkeysphere scripts are written by:
  6. # Jameson Rollins <jrollins@finestructure.net>
  7. # Jamie McClelland <jm@mayfirst.org>
  8. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  9. #
  10. # They are Copyright 2008-2009, and are all released under the GPL,
  11. # version 3 or later.
  12. # check on the status and validity of the key and public certificates
  13. diagnostics() {
  14. local seckey
  15. local keysfound
  16. local curdate
  17. local warnwindow
  18. local warndate
  19. local create
  20. local expire
  21. local uid
  22. local fingerprint
  23. local badhostkeys
  24. local sshd_config
  25. local problemsfound=0
  26. if ! id monkeysphere >/dev/null ; then
  27. echo "! No monkeysphere user found! Please create a monkeysphere system user with bash as its shell."
  28. problemsfound=$(($problemsfound+1))
  29. fi
  30. if ! [ -d "$SYSDATADIR" ] ; then
  31. echo "! no $SYSDATADIR directory found. Please create it."
  32. problemsfound=$(($problemsfound+1))
  33. fi
  34. echo "Checking for authentication directory..."
  35. if ! [ -d "$MADATADIR" ] ; then
  36. echo "! No authentication data directory found."
  37. echo " - Recommendation: run 'monkeysphere-authentication setup'"
  38. exit
  39. fi
  40. # FIXME: what's the correct, cross-platform answer?
  41. seckey=$(gpg_core --list-secret-keys --fingerprint --with-colons --fixed-list-mode)
  42. keysfound=$(echo "$seckey" | grep -c ^sec:)
  43. curdate=$(date +%s)
  44. # warn when anything is 2 months away from expiration
  45. warnwindow='2 months'
  46. warndate=$(advance_date $warnwindow +%s)
  47. echo "Checking core GPG key..."
  48. if (( "$keysfound" < 1 )); then
  49. echo "! No core key found."
  50. echo " - Recommendation: run 'monkeysphere-authentication setup'"
  51. problemsfound=$(($problemsfound+1))
  52. elif (( "$keysfound" > 1 )); then
  53. echo "! More than one core key found?"
  54. # FIXME: recommend a way to resolve this
  55. problemsfound=$(($problemsfound+1))
  56. else
  57. create=$(echo "$seckey" | grep ^sec: | cut -f6 -d:)
  58. expire=$(echo "$seckey" | grep ^sec: | cut -f7 -d:)
  59. fingerprint=$(echo "$seckey" | grep ^fpr: | head -n1 | cut -f10 -d:)
  60. # check for key expiration:
  61. if [ "$expire" ]; then
  62. if (( "$expire" < "$curdate" )); then
  63. echo "! Core key is expired."
  64. echo " - Recommendation: ???"
  65. problemsfound=$(($problemsfound+1))
  66. elif (( "$expire" < "$warndate" )); then
  67. echo "! Core key expires in less than $warnwindow:" $(advance_date $(( $expire - $curdate )) seconds +%F)
  68. echo " - Recommendation: ???"
  69. problemsfound=$(($problemsfound+1))
  70. fi
  71. fi
  72. # and weirdnesses:
  73. if [ "$create" ] && (( "$create" > "$curdate" )); then
  74. echo "! Core key was created in the future(?!). Is your clock correct?"
  75. echo " - Recommendation: Check clock ($(date +%F_%T)); use NTP?"
  76. problemsfound=$(($problemsfound+1))
  77. fi
  78. fi
  79. # FIXME: look at the ownership/privileges of the various keyrings,
  80. # directories housing them, etc (what should those values be? can
  81. # we make them as minimal as possible?)
  82. # FIXME: look to see that the ownertrust rules are set properly on the
  83. # sphere keyring
  84. # FIXME: make sure that at least one identity certifier exists
  85. # FIXME: look at the timestamps on the monkeysphere-generated
  86. # authorized_keys files -- warn if they seem out-of-date.
  87. # FIXME: check for a cronjob that updates monkeysphere-generated
  88. # authorized_keys?
  89. echo
  90. echo "Checking for Monkeysphere-enabled public-key authentication for users ..."
  91. # Ensure that User ID authentication is enabled:
  92. if ! grep -q "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$" "$sshd_config"; then
  93. echo "! $sshd_config does not point to monkeysphere authorized keys."
  94. echo " - Recommendation: add a line to $sshd_config: 'AuthorizedKeysFile ${SYSDATADIR}/authorized_keys/%u'"
  95. problemsfound=$(($problemsfound+1))
  96. fi
  97. if badauthorizedkeys=$(grep -i '^AuthorizedKeysFile' "$sshd_config" | grep -v "^AuthorizedKeysFile[[:space:]]\+${SYSDATADIR}/authorized_keys/%u$") ; then
  98. echo "! $sshd_config refers to non-monkeysphere authorized_keys files:"
  99. echo "$badauthorizedkeys"
  100. echo " - Recommendation: remove the above AuthorizedKeysFile lines from $sshd_config"
  101. problemsfound=$(($problemsfound+1))
  102. fi
  103. if [ "$problemsfound" -gt 0 ]; then
  104. echo "When the above $problemsfound issue"$(if [ "$problemsfound" -eq 1 ] ; then echo " is" ; else echo "s are" ; fi)" resolved, please re-run:"
  105. echo " monkeysphere-authentication diagnostics"
  106. else
  107. echo "Everything seems to be in order!"
  108. fi
  109. }