summaryrefslogtreecommitdiff
path: root/tests/basic
blob: f591c59068b55317760b8a24facd78d50a9d74d6 (plain)
  1. #!/usr/bin/env bash
  2. # Tests to ensure that the monkeysphere is working
  3. #
  4. # unset MONKEYSPHERE_TEST_NO_EXAMINE to get a prompt to examine the
  5. # test state after failure.
  6. # Authors:
  7. # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  8. # Jameson Rollins <jrollins@fifthhorseman.net>
  9. # Micah Anderson <micah@riseup.net>
  10. #
  11. # Copyright: © 2008-2010
  12. # License: GPL v3 or later
  13. # these tests should all be able to run as a non-privileged user.
  14. # put all the test output to stdout
  15. exec 2>&1
  16. # all subcommands in this script should complete without failure:
  17. set -e
  18. # piped commands should return the code of the first non-zero return
  19. set -o pipefail
  20. # make sure the TESTDIR is an absolute path, not a relative one.
  21. export TESTDIR=$(cd $(dirname "$0") && pwd)
  22. source "$TESTDIR"/common
  23. ## make sure that the right tools are installed to run the test. the
  24. ## test has *more* requirements than plain ol' monkeysphere:
  25. [ -f /usr/sbin/sshd ] || { echo "You must have sshd installed to run this test." ; exit 1; }
  26. which socat >/dev/null || { echo "You must have socat installed to run this test." ; exit 1; }
  27. perl -MCrypt::OpenSSL::RSA -e 1 2>/dev/null || { echo "You must have the perl module Crypt::OpenSSL::RSA installed to run this test.
  28. On debian-derived systems, you can set this up with:
  29. apt-get install libcrypt-openssl-rsa-perl" ; exit 1; }
  30. perl -MDigest::SHA -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA installed to run this test.
  31. On debian-derived systems, you can set this up with:
  32. apt-get install libdigest-sha-perl" ; exit 1; }
  33. ## FIXME: other checks?
  34. ######################################################################
  35. ### FUNCTIONS
  36. # gpg command for test admin user
  37. gpgadmin() {
  38. chmod 0700 "$TEMPDIR"/admin "$TEMPDIR"/admin/.gnupg
  39. GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg --no-tty "$@"
  40. }
  41. # test ssh connection
  42. # first argument is expected return code from ssh connection
  43. ssh_test() {
  44. local RETURN=0
  45. local remote_command=${1:-true}
  46. umask 0077
  47. CODE=${2:-0}
  48. # start the ssh daemon on the socket
  49. echo "##### starting ssh server..."
  50. socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log &
  51. SSHD_PID="$!"
  52. # wait until the socket is created before continuing
  53. while [ ! -S "$SOCKET" ] ; do
  54. sleep 1
  55. done
  56. # make a client connection to the socket
  57. echo "##### starting ssh client..."
  58. ssh-agent bash -c \
  59. "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config ${target_hostname:-testhost.example} $remote_command" \
  60. || RETURN="$?"
  61. # kill the sshd process if it's still running
  62. kill "$SSHD_PID" || true
  63. wait
  64. SSHD_PID=
  65. if [ "$RETURN" = "$CODE" ] ; then
  66. echo "##### ssh connection test PASSED. returned: $RETURN"
  67. return 0
  68. else
  69. echo "##### ssh connection test FAILED. returned: $RETURN, expected: $CODE"
  70. return 1
  71. fi
  72. }
  73. # invoke this instead of ssh_test() if you want this test to be
  74. # skipped when the working directory has bad permissions.
  75. ssh_good_perm_test() {
  76. if [ "$TEMPDIR_PERMISSIONS_SAFE" = no ] ; then
  77. echo "WARNING!!! Test SKIPPED because we are running in an unsafe working directory."
  78. else
  79. ssh_test "$@"
  80. fi
  81. }
  82. SSHD_PID=
  83. ## setup trap
  84. trap failed_cleanup EXIT
  85. ######################################################################
  86. ### SETUP VARIABLES
  87. ## set up some variables to ensure that we're operating strictly in
  88. ## the tests, not system-wide:
  89. # set up temp dir
  90. # NOTE: /tmp can not be used as the temp dir here, since the
  91. # permissions on /tmp are usually such that they will not pass the
  92. # monkeysphere/ssh path permission checking. If you need to use a
  93. # different location than the current source, please set $TMPDIR
  94. # somewhere with tighter permissions.
  95. mkdir -p "$TESTDIR"/tmp
  96. TEMPDIR=$(mktemp -d "${TMPDIR:-$TESTDIR/tmp}/monkeyspheretest.XXXXXXX")
  97. # Use the local copy of executables first, instead of system ones.
  98. # This should help us test without installing.
  99. export PATH="$TESTDIR"/../src:"$PATH"
  100. export MONKEYSPHERE_SYSDATADIR="$TEMPDIR"
  101. export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR"
  102. export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src/share
  103. export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami)
  104. HOST_KEY_FILE="$MONKEYSPHERE_SYSCONFIGDIR"/host_keys.pub.pgp
  105. export MONKEYSPHERE_CHECK_KEYSERVER=false
  106. # example.org does not respond to the HKP port, so this should cause
  107. # any keyserver connection attempts that do happen (they shouldn't!)
  108. # to hang, so we'll notice them:
  109. export MONKEYSPHERE_KEYSERVER=example.org
  110. export MONKEYSPHERE_LOG_LEVEL=DEBUG
  111. export MONKEYSPHERE_CORE_KEYLENGTH=1024
  112. export MONKEYSPHERE_PROMPT=false
  113. # unset SUBKEYS_FOR_AGENT variable which, if set, would confuse the
  114. # into trying to use the user's key, instead of the testuser's key
  115. unset MONKEYSPHERE_SUBKEYS_FOR_AGENT
  116. export SSHD_CONFIG="$TEMPDIR"/sshd_config
  117. export SOCKET="$TEMPDIR"/ssh-socket
  118. # Make sure $DISPLAY is set to convince ssh and monkeysphere to fall
  119. # back on $SSH_ASKPASS. Make sure it's not set to the current actual
  120. # $DISPLAY (if one exists) because this test suite should not be doing
  121. # *anything* with any running X11 session.
  122. export DISPLAY=monkeys
  123. ## we cannot do proper directory permissions checking if the current
  124. ## working directory has unsatisfactory permissions:
  125. if "$MONKEYSPHERE_SYSSHAREDIR"/checkperms $(whoami) "$TEMPDIR"; then
  126. echo "Permissions on temporary directory '$TEMPDIR' are OK for permissions checks."
  127. TEMPDIR_PERMISSIONS_SAFE=yes
  128. else
  129. cat <<EOF
  130. !!!WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING!!!
  131. Permissions on testing directory '$TEMPDIR' are
  132. too loose to do proper strict permissions checking. Some tests
  133. will be disabled or ignored.
  134. To avoid this warning (and to make sure that all tests are run
  135. properly), please run these tests within a directory that meets
  136. sshd's standards for "StrictModes yes" -- the directory (and every
  137. one of its parents) should be owned only be the user running this
  138. test or root, and should not be writable by group or other.
  139. !!!WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING!!!
  140. EOF
  141. # FIXME: what else should we do with this knowledge to make sure
  142. # that the appropriate tests are handled properly?
  143. TEMPDIR_PERMISSIONS_SAFE=no
  144. # this is a new option (as of 0.26) to disable filesystem
  145. # permission checks.
  146. # it should operate by analogy with StrictModes from sshd_config(5)
  147. export MONKEYSPHERE_STRICT_MODES=false
  148. fi
  149. ######################################################################
  150. ### CONFIGURE ENVIRONMENTS
  151. # copy in admin and testuser home to tmp
  152. echo
  153. echo "##################################################"
  154. echo "### configuring testuser home..."
  155. (cd "$TESTDIR"/home && find testuser | cpio -pdu "$TEMPDIR")
  156. # set up environment for testuser
  157. export TESTHOME="$TEMPDIR"/testuser
  158. export GNUPGHOME="$TESTHOME"/.gnupg
  159. chmod 0700 "$GNUPGHOME"
  160. export SSH_ASKPASS="$TESTHOME"/.ssh/askpass
  161. export MONKEYSPHERE_HOME="$TESTHOME"/.monkeysphere
  162. cat <<EOF >> "$TESTHOME"/.ssh/config
  163. UserKnownHostsFile $TESTHOME/.ssh/known_hosts
  164. IdentityFile $TESTHOME/.ssh/no-such-identity
  165. ProxyCommand $TESTHOME/.ssh/proxy-command %h %p $SOCKET
  166. EOF
  167. cat <<EOF >> "$MONKEYSPHERE_HOME"/monkeysphere.conf
  168. KNOWN_HOSTS=$TESTHOME/.ssh/known_hosts
  169. EOF
  170. get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf
  171. echo
  172. echo "##################################################"
  173. echo "### configuring admin home..."
  174. (cd "$TESTDIR"/home && find admin | cpio -pdu "$TEMPDIR")
  175. # set up sshd
  176. echo
  177. echo "##################################################"
  178. echo "### configuring sshd..."
  179. cp "$TESTDIR"/etc/ssh/sshd_config "$SSHD_CONFIG"
  180. # write the sshd_config
  181. cat <<EOF >> "$SSHD_CONFIG"
  182. HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key
  183. AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u
  184. EOF
  185. # disable sshd's strict permissions settings so that some tests can
  186. # complete when running under a dubious path:
  187. if [ "$TEMPDIR_PERMISSIONS_SAFE" != yes ] ; then
  188. cat <<EOF >> "$SSHD_CONFIG"
  189. StrictModes no
  190. EOF
  191. fi
  192. ######################################################################
  193. ### SERVER HOST SETUP
  194. # import host key
  195. echo
  196. echo "##################################################"
  197. echo "### import host key..."
  198. ssh-keygen -b 1024 -t rsa -N '' -f "$TEMPDIR"/ssh_host_rsa_key
  199. monkeysphere-host import-key "$TEMPDIR"/ssh_host_rsa_key ssh://testhost.example
  200. echo
  201. echo "##################################################"
  202. echo "### getting host key fingerprint..."
  203. SSHHOSTKEYID=$( monkeysphere-host show-keys | grep '^OpenPGP fingerprint: ' | cut -f3 -d\ )
  204. echo "$SSHHOSTKEYID"
  205. # change host key expiration
  206. echo
  207. echo "##################################################"
  208. echo "### setting host key expiration..."
  209. monkeysphere-host set-expire 1
  210. # FIXME: how do we check that the expiration has really been set?
  211. # certify host key with the "Admin's Key".
  212. # (this would normally be done via keyservers)
  213. echo
  214. echo "##################################################"
  215. echo "### certifying server host key..."
  216. < "$HOST_KEY_FILE" gpgadmin --import
  217. echo y | gpgadmin --command-fd 0 --sign-key "$SSHHOSTKEYID"
  218. # FIXME: add revoker?
  219. # FIXME: how can we test publish-key without flooding junk into the
  220. # keyservers?
  221. # FIXME: should we run "diagnostics" here to test setup?
  222. ######################################################################
  223. ### SERVER AUTHENTICATION SETUP
  224. # set up monkeysphere authentication
  225. echo
  226. echo "##################################################"
  227. echo "### setup monkeysphere authentication..."
  228. cp "$TESTDIR"/etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/
  229. cat <<EOF >> "$TEMPDIR"/monkeysphere-authentication.conf
  230. AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids"
  231. EOF
  232. monkeysphere-authentication setup
  233. get_gpg_prng_arg >> "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf
  234. # add admin as identity certifier for testhost.example
  235. echo
  236. echo "##################################################"
  237. echo "### adding admin as certifier..."
  238. monkeysphere-authentication add-id-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg
  239. echo
  240. echo "##################################################"
  241. echo "### list certifiers..."
  242. monkeysphere-authentication list-certifiers
  243. # FIXME: should we run "diagnostics" here to test setup?
  244. ######################################################################
  245. ### TESTUSER SETUP
  246. # generate an auth subkey for the test user that expires in 2 days
  247. echo
  248. echo "##################################################"
  249. echo "### generating key for testuser..."
  250. monkeysphere gen-subkey
  251. # add server key to testuser keychain
  252. echo
  253. echo "##################################################"
  254. echo "### export server key to testuser..."
  255. gpgadmin --armor --export "$SSHHOSTKEYID" | gpg --import
  256. # teach the "server" about the testuser's key
  257. echo
  258. echo "##################################################"
  259. echo "### export testuser key to server..."
  260. gpg --export testuser | monkeysphere-authentication gpg-cmd --import
  261. # update authorized_keys for user
  262. echo
  263. echo "##################################################"
  264. echo "### update server authorized_keys file for this testuser..."
  265. monkeysphere-authentication update-users $(whoami)
  266. # FIXME: this is maybe not failing properly for:
  267. # ms: improper group or other writability on path '/tmp'.
  268. ######################################################################
  269. ### TESTS
  270. ## see whether keys-for-userid works from the client's perspective:
  271. echo
  272. echo "##################################################"
  273. echo "### testing monkeysphere keys-for-userid ..."
  274. diff -q <( monkeysphere keys-for-userid ssh://testhost.example ) <( cut -f1,2 -d' ' < "$TEMPDIR"/ssh_host_rsa_key.pub )
  275. # connect to test sshd, using monkeysphere ssh-proxycommand to verify
  276. # the identity before connection. This should work in both directions!
  277. echo
  278. echo "##################################################"
  279. echo "### ssh connection test for success..."
  280. ssh_test true
  281. # Make sure it works if there is "armor" written in gpg.conf
  282. # add other weirdnesses here as they come up.
  283. echo
  284. echo "##################################################"
  285. echo "### testing functionality in the face of unusual gpg.conf settings..."
  286. echo 'armor' >> "$GNUPGHOME"/gpg.conf
  287. ssh_test true
  288. # remove the testuser's authorized_user_ids file, update, and make
  289. # sure that the ssh authentication FAILS
  290. echo
  291. echo "##################################################"
  292. echo "### removing testuser authorized_user_ids and updating..."
  293. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
  294. monkeysphere-authentication update-users $(whoami)
  295. echo
  296. echo "##################################################"
  297. echo "### ssh connection test for failure..."
  298. ssh_test true 255
  299. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
  300. # put improper permissions on authorized_user_ids file, update, and
  301. # make sure ssh authentication FAILS
  302. echo
  303. echo "##################################################"
  304. echo "### setting group writability on authorized_user_ids and updating..."
  305. chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids
  306. monkeysphere-authentication update-users $(whoami)
  307. echo
  308. echo "##################################################"
  309. echo "### ssh connection test for failure..."
  310. ssh_good_perm_test true 255
  311. chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids
  312. echo
  313. echo "##################################################"
  314. echo "### setting other writability on authorized_user_ids and updating..."
  315. chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids
  316. monkeysphere-authentication update-users $(whoami)
  317. echo
  318. echo "##################################################"
  319. echo "### ssh connection test for failure..."
  320. ssh_good_perm_test true 255
  321. chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids
  322. monkeysphere-authentication update-users $(whoami)
  323. # test symlinks
  324. echo
  325. echo "##################################################"
  326. echo "### setup for symlink tests..."
  327. cp -a "$TESTHOME"/.monkeysphere{,.linktest}
  328. echo
  329. echo "##################################################"
  330. echo "### make authorized_user_ids an absolute symlink and updating..."
  331. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
  332. ln -s "$TESTHOME"/.monkeysphere{.linktest,}/authorized_user_ids
  333. monkeysphere-authentication update-users $(whoami)
  334. echo
  335. echo "##################################################"
  336. echo "### ssh connection test for success..."
  337. ssh_test true
  338. echo
  339. echo "##################################################"
  340. echo "### create bad permissions on link dir and updating..."
  341. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  342. monkeysphere-authentication update-users $(whoami)
  343. echo
  344. echo "##################################################"
  345. echo "### ssh connection test for failure..."
  346. ssh_good_perm_test true 255
  347. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  348. echo
  349. echo "##################################################"
  350. echo "### make authorized_user_ids a relative symlink and updating..."
  351. ln -sf ../.monkeysphere.linktest/authorized_user_ids "$TESTHOME"/.monkeysphere/authorized_user_ids
  352. monkeysphere-authentication update-users $(whoami)
  353. echo
  354. echo "##################################################"
  355. echo "### ssh connection test for success..."
  356. ssh_test true
  357. echo
  358. echo "##################################################"
  359. echo "### create bad permissions on link dir updating..."
  360. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  361. monkeysphere-authentication update-users $(whoami)
  362. echo
  363. echo "##################################################"
  364. echo "### ssh connection test for failure..."
  365. ssh_good_perm_test true 255
  366. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  367. # FIXME: implement check of link path, and uncomment this test
  368. # echo
  369. # echo "##################################################"
  370. # echo "### create bad permissions on link dir and updating..."
  371. # chmod o+w "$TESTHOME"/.monkeysphere
  372. # monkeysphere-authentication update-users $(whoami)
  373. # echo
  374. # echo "##################################################"
  375. # echo "### ssh connection test for failure..."
  376. # ssh_good_perm_test true 255
  377. # chmod o-w "$TESTHOME"/.monkeysphere
  378. rm "$TESTHOME"/.monkeysphere/authorized_user_ids
  379. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
  380. echo
  381. echo "##################################################"
  382. echo "### make .monkeysphere directory an absolute symlink and updating..."
  383. mv "$TESTHOME"/.monkeysphere{,.bak}
  384. ln -s "$TESTHOME"/.monkeysphere{.linktest,}
  385. monkeysphere-authentication update-users $(whoami)
  386. echo
  387. echo "##################################################"
  388. echo "### ssh connection test for success..."
  389. ssh_test true
  390. echo
  391. echo "##################################################"
  392. echo "### create bad permissions on link dir and updating..."
  393. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  394. monkeysphere-authentication update-users $(whoami)
  395. echo
  396. echo "##################################################"
  397. echo "### ssh connection test for failure..."
  398. ssh_good_perm_test true 255
  399. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  400. echo
  401. echo "##################################################"
  402. echo "### make .monkeysphere directory a relative symlink and updating..."
  403. ln -sfn .monkeysphere.linktest "$TESTHOME"/.monkeysphere
  404. monkeysphere-authentication update-users $(whoami)
  405. echo
  406. echo "##################################################"
  407. echo "### ssh connection test for success..."
  408. ssh_test true
  409. echo
  410. echo "##################################################"
  411. echo "### create bad permissions on link dir updating..."
  412. chmod o+w "$TESTHOME"/.monkeysphere.linktest
  413. monkeysphere-authentication update-users $(whoami)
  414. echo
  415. echo "##################################################"
  416. echo "### ssh connection test for failure..."
  417. ssh_good_perm_test true 255
  418. chmod o-w "$TESTHOME"/.monkeysphere.linktest
  419. rm "$TESTHOME"/.monkeysphere
  420. mv "$TESTHOME"/.monkeysphere{.bak,}
  421. # ensure we're back to normal:
  422. echo
  423. echo "##################################################"
  424. echo "### making sure we are back to normal..."
  425. monkeysphere-authentication update-users $(whoami)
  426. ssh_test true
  427. # check ssh authorized_key options
  428. echo
  429. echo "##################################################"
  430. echo "### checking ssh authorized_key option support..."
  431. cp "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
  432. echo ' no-X11-forwarding' >>"$TESTHOME"/.monkeysphere/authorized_user_ids
  433. echo ' no-port-forwarding' >>"$TESTHOME"/.monkeysphere/authorized_user_ids
  434. echo ' command="/bin/false"' >>"$TESTHOME"/.monkeysphere/authorized_user_ids
  435. monkeysphere-authentication update-users $(whoami)
  436. ssh_test /bin/true 1
  437. ssh_test /bin/false 1
  438. mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
  439. # ensure we're back to normal:
  440. echo
  441. echo "##################################################"
  442. echo "### making sure we are back to normal..."
  443. monkeysphere-authentication update-users $(whoami)
  444. ssh_test true
  445. echo
  446. echo "##################################################"
  447. echo "### ssh connection test directly to 'testhost2.example' without new name..."
  448. target_hostname=testhost2.example ssh_test true 255
  449. echo
  450. echo "##################################################"
  451. echo "### add servicename, certify by admin, import by user..."
  452. monkeysphere-host add-servicename ssh://testhost2.example
  453. <"$HOST_KEY_FILE" gpgadmin --import
  454. printf "y\ny\n" | gpgadmin --command-fd 0 --sign-key "$SSHHOSTKEYID"
  455. echo
  456. echo "##################################################"
  457. echo "### ssh connection test with hostname 'testhost2.example' added..."
  458. gpgadmin --export "$SSHHOSTKEYID" | gpg --import
  459. gpg --check-trustdb
  460. ssh_test true
  461. echo
  462. echo "##################################################"
  463. echo "### ssh connection test directly to 'testhost2.example' ..."
  464. gpg --import <"$HOST_KEY_FILE"
  465. gpg --check-trustdb
  466. target_hostname=testhost2.example ssh_test true
  467. echo
  468. echo "##################################################"
  469. echo "### ssh connection test for failure with 'testhost2.example' revoked..."
  470. monkeysphere-host revoke-servicename ssh://testhost2.example
  471. gpg --import <"$HOST_KEY_FILE"
  472. gpg --check-trustdb
  473. target_hostname=testhost2.example ssh_test true 255
  474. # FIXME: addtest: remove admin as id-certifier and check ssh failure
  475. # FIXME: addtest: how do we test that set-expire makes sense after new
  476. # servicenames have been added?
  477. echo
  478. echo "##################################################"
  479. echo "### testing monkeysphere authentication keys-for-user"
  480. diff -q <(monkeysphere-authentication keys-for-user $(whoami) | cut -d' ' -f1,2) <(cut -d' ' -f1,2 ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/${MONKEYSPHERE_MONKEYSPHERE_USER})
  481. # test to make sure things are OK after the previous tests:
  482. echo
  483. echo "##################################################"
  484. echo "### settings reset, updating..."
  485. monkeysphere-authentication update-users $(whoami)
  486. echo
  487. echo "##################################################"
  488. echo "### ssh connection test for success..."
  489. ssh_test true
  490. echo
  491. echo "##################################################"
  492. echo "### Testing TLS setup..."
  493. openssl req -config "$TESTDIR"/openssl.cnf -x509 -newkey rsa:1024 -subj '/DC=example/DC=testhost/CN=testhost.example/' -days 3 -keyout "$TEMPDIR"/tls_key.pem -nodes >"$TEMPDIR"/tls_cert.pem
  494. monkeysphere-host import-key "$TEMPDIR"/tls_key.pem https://testhost.example
  495. # FIXME: how can we test this via an https client?
  496. # We don't currently provide one.
  497. # FIXME: should we test other monkeysphere-host operations somehow now
  498. # that we have more than one key in the host keyring?
  499. echo
  500. echo "##################################################"
  501. echo "### revoking ssh host key..."
  502. # generate the revocation certificate and feed it directly to the test
  503. # user's keyring (we're not publishing to the keyservers)
  504. monkeysphere-host revoke-key "$SSHHOSTKEYID" | gpg --import
  505. echo
  506. echo "##################################################"
  507. echo "### ssh connection test for failure..."
  508. ssh_test true 255
  509. ######################################################################
  510. trap - EXIT
  511. echo
  512. echo "##################################################"
  513. echo " Monkeysphere basic tests completed successfully!"
  514. echo "##################################################"
  515. cleanup