/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-monitor

  • Committer: Teddy Hogeborn
  • Date: 2014-06-22 02:19:30 UTC
  • mto: (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 317.
  • Revision ID: teddy@recompile.se-20140622021930-icl7h4cm97blhjml
mandos-keygen: Generate "checker" option to use SSH fingerprints.

To turn this off, use a new "--no-ssh" option to mandos-keygen.

* INSTALL (Mandos Server, Mandos Client): Document new suggested
                                          installation of SSH.
* Makefile (confdir/clients.conf): Use new "--no-ssh" option to
                                   "mandos-keygen".
* debian/control (mandos/Depends): Changed to "fping | ssh-client".
  (mandos-client/Recommends): New; set to "ssh".
* intro.xml (FREQUENTLY ASKED QUESTIONS): Rename and rewrite section
                                          called "Faking ping
                                          replies?" to address new
                                          default behavior.
* mandos-clients.conf.xml (OPTIONS/checker): Briefly discuss new
                                             behavior of
                                             mandos-keygen.
* mandos-keygen: Bug fix: Suppress failure output of "shred" to remove
                 "sec*", since no such files may exist.
 (password mode): Scan for SSH key fingerprints and output as new
                  "checker" and "ssh_fingerprint" options, unless new
                  "--no-ssh" option is given.
* mandos-keygen.xml (SYNOPSIS/--force): Bug fix: Document short form.
  (OPTIONS/--no-ssh): New.
  (SEE ALSO): Add reference "ssh-keyscan(1)".
* plugins.d/mandos-client.xml (SECURITY): Briefly mention the
                                          possibility of using SSH key
                                          fingerprints for checking.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-monitor
3
3
# 
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
5
# 
6
 
# Copyright © 2009-2012 Teddy Hogeborn
7
 
# Copyright © 2009-2012 Björn Påhlsson
 
6
# Copyright © 2009-2014 Teddy Hogeborn
 
7
# Copyright © 2009-2014 Björn Påhlsson
8
8
# 
9
9
# This program is free software: you can redistribute it and/or modify
10
10
# it under the terms of the GNU General Public License as published by
17
17
#     GNU General Public License for more details.
18
18
# 
19
19
# You should have received a copy of the GNU General Public License
20
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
20
# along with this program.  If not, see
 
21
# <http://www.gnu.org/licenses/>.
21
22
# 
22
23
# Contact the authors at <mandos@recompile.se>.
23
24
# 
24
25
 
25
26
from __future__ import (division, absolute_import, print_function,
26
27
                        unicode_literals)
 
28
try:
 
29
    from future_builtins import *
 
30
except ImportError:
 
31
    pass
27
32
 
28
33
import sys
29
34
import os
30
 
import signal
31
35
 
32
36
import datetime
33
37
 
35
39
import urwid
36
40
 
37
41
from dbus.mainloop.glib import DBusGMainLoop
38
 
import gobject
 
42
try:
 
43
    import gobject
 
44
except ImportError:
 
45
    from gi.repository import GObject as gobject
39
46
 
40
47
import dbus
41
48
 
42
 
import UserList
43
 
 
44
49
import locale
45
50
 
 
51
if sys.version_info[0] == 2:
 
52
    str = unicode
 
53
 
46
54
locale.setlocale(locale.LC_ALL, '')
47
55
 
48
56
import logging
52
60
domain = 'se.recompile'
53
61
server_interface = domain + '.Mandos'
54
62
client_interface = domain + '.Mandos.Client'
55
 
version = "1.5.3"
56
 
 
57
 
# Always run in monochrome mode
58
 
urwid.curses_display.curses.has_colors = lambda : False
59
 
 
60
 
# Urwid doesn't support blinking, but we want it.  Since we have no
61
 
# use for underline on its own, we make underline also always blink.
62
 
urwid.curses_display.curses.A_UNDERLINE |= (
63
 
    urwid.curses_display.curses.A_BLINK)
 
63
version = "1.6.5"
64
64
 
65
65
def isoformat_to_datetime(iso):
66
66
    "Parse an ISO 8601 date string to a datetime.datetime()"
83
83
    properties and calls a hook function when any of them are
84
84
    changed.
85
85
    """
86
 
    def __init__(self, proxy_object=None, *args, **kwargs):
 
86
    def __init__(self, proxy_object=None, properties=None, **kwargs):
87
87
        self.proxy = proxy_object # Mandos Client proxy object
88
 
        
89
 
        self.properties = dict()
 
88
        self.properties = dict() if properties is None else properties
90
89
        self.property_changed_match = (
91
90
            self.proxy.connect_to_signal("PropertyChanged",
92
 
                                         self.property_changed,
 
91
                                         self._property_changed,
93
92
                                         client_interface,
94
93
                                         byte_arrays=True))
95
94
        
96
 
        self.properties.update(
97
 
            self.proxy.GetAll(client_interface,
98
 
                              dbus_interface = dbus.PROPERTIES_IFACE))
99
 
 
100
 
        #XXX This breaks good super behaviour
101
 
#        super(MandosClientPropertyCache, self).__init__(
102
 
#            *args, **kwargs)
 
95
        if properties is None:
 
96
            self.properties.update(
 
97
                self.proxy.GetAll(client_interface,
 
98
                                  dbus_interface
 
99
                                  = dbus.PROPERTIES_IFACE))
 
100
        
 
101
        super(MandosClientPropertyCache, self).__init__(**kwargs)
 
102
    
 
103
    def _property_changed(self, property, value):
 
104
        """Helper which takes positional arguments"""
 
105
        return self.property_changed(property=property, value=value)
103
106
    
104
107
    def property_changed(self, property=None, value=None):
105
108
        """This is called whenever we get a PropertyChanged signal
108
111
        # Update properties dict with new value
109
112
        self.properties[property] = value
110
113
    
111
 
    def delete(self, *args, **kwargs):
 
114
    def delete(self):
112
115
        self.property_changed_match.remove()
113
 
        super(MandosClientPropertyCache, self).__init__(
114
 
            *args, **kwargs)
115
116
 
116
117
 
117
118
class MandosClientWidget(urwid.FlowWidget, MandosClientPropertyCache):
119
120
    """
120
121
    
121
122
    def __init__(self, server_proxy_object=None, update_hook=None,
122
 
                 delete_hook=None, logger=None, *args, **kwargs):
 
123
                 delete_hook=None, logger=None, **kwargs):
123
124
        # Called on update
124
125
        self.update_hook = update_hook
125
126
        # Called on delete
130
131
        self.logger = logger
131
132
        
132
133
        self._update_timer_callback_tag = None
133
 
        self._update_timer_callback_lock = 0
134
134
        
135
135
        # The widget shown normally
136
136
        self._text_widget = urwid.Text("")
137
137
        # The widget shown when we have focus
138
138
        self._focus_text_widget = urwid.Text("")
139
 
        super(MandosClientWidget, self).__init__(
140
 
            update_hook=update_hook, delete_hook=delete_hook,
141
 
            *args, **kwargs)
 
139
        super(MandosClientWidget, self).__init__(**kwargs)
142
140
        self.update()
143
141
        self.opened = False
144
142
        
145
 
        last_checked_ok = isoformat_to_datetime(self.properties
146
 
                                                ["LastCheckedOK"])
147
 
        
148
 
        if self.properties ["LastCheckerStatus"] != 0:
149
 
            self.using_timer(True)
150
 
        
151
 
        if self.need_approval:
152
 
            self.using_timer(True)
153
 
        
154
143
        self.match_objects = (
155
144
            self.proxy.connect_to_signal("CheckerCompleted",
156
145
                                         self.checker_completed,
175
164
        #self.logger('Created client {0}'
176
165
        #            .format(self.properties["Name"]))
177
166
    
178
 
    def property_changed(self, property=None, value=None):
179
 
        super(self, MandosClientWidget).property_changed(property,
180
 
                                                         value)
181
 
        if property == "ApprovalPending":
182
 
            using_timer(bool(value))
183
 
        if property == "LastCheckerStatus":
184
 
            using_timer(value != 0)
185
 
            #self.logger('Checker for client {0} (command "{1}") was '
186
 
            #            ' successful'.format(self.properties["Name"],
187
 
            #                                 command))
188
 
    
189
167
    def using_timer(self, flag):
190
168
        """Call this method with True or False when timer should be
191
169
        activated or deactivated.
192
170
        """
193
 
        old = self._update_timer_callback_lock
194
 
        if flag:
195
 
            self._update_timer_callback_lock += 1
196
 
        else:
197
 
            self._update_timer_callback_lock -= 1
198
 
        if old == 0 and self._update_timer_callback_lock:
 
171
        if flag and self._update_timer_callback_tag is None:
199
172
            # Will update the shown timer value every second
200
173
            self._update_timer_callback_tag = (gobject.timeout_add
201
174
                                               (1000,
202
175
                                                self.update_timer))
203
 
        elif old and self._update_timer_callback_lock == 0:
 
176
        elif not (flag or self._update_timer_callback_tag is None):
204
177
            gobject.source_remove(self._update_timer_callback_tag)
205
178
            self._update_timer_callback_tag = None
206
179
    
234
207
           to log in the future. """
235
208
        #self.logger('Client {0} started checker "{1}"'
236
209
        #            .format(self.properties["Name"],
237
 
        #                    unicode(command)))
 
210
        #                    str(command)))
238
211
        pass
239
212
    
240
213
    def got_secret(self):
248
221
            message = 'Client {0} will get its secret in {1} seconds'
249
222
        self.logger(message.format(self.properties["Name"],
250
223
                                   timeout/1000))
251
 
        self.using_timer(True)
252
224
    
253
225
    def rejected(self, reason):
254
226
        self.logger('Client {0} was rejected; reason: {1}'
280
252
                          "bold-underline-blink":
281
253
                              "bold-underline-blink-standout",
282
254
                          }
283
 
 
 
255
        
284
256
        # Rebuild focus and non-focus widgets using current properties
285
 
 
 
257
        
286
258
        # Base part of a client. Name!
287
259
        base = '{name}: '.format(name=self.properties["Name"])
288
260
        if not self.properties["Enabled"]:
289
261
            message = "DISABLED"
 
262
            self.using_timer(False)
290
263
        elif self.properties["ApprovalPending"]:
291
264
            timeout = datetime.timedelta(milliseconds
292
265
                                         = self.properties
294
267
            last_approval_request = isoformat_to_datetime(
295
268
                self.properties["LastApprovalRequest"])
296
269
            if last_approval_request is not None:
297
 
                timer = timeout - (datetime.datetime.utcnow()
298
 
                                   - last_approval_request)
 
270
                timer = max(timeout - (datetime.datetime.utcnow()
 
271
                                       - last_approval_request),
 
272
                            datetime.timedelta())
299
273
            else:
300
274
                timer = datetime.timedelta()
301
275
            if self.properties["ApprovedByDefault"]:
302
276
                message = "Approval in {0}. (d)eny?"
303
277
            else:
304
278
                message = "Denial in {0}. (a)pprove?"
305
 
            message = message.format(unicode(timer).rsplit(".", 1)[0])
 
279
            message = message.format(str(timer).rsplit(".", 1)[0])
 
280
            self.using_timer(True)
306
281
        elif self.properties["LastCheckerStatus"] != 0:
307
 
            # When checker has failed, print a timer until client expires
 
282
            # When checker has failed, show timer until client expires
308
283
            expires = self.properties["Expires"]
309
284
            if expires == "":
310
285
                timer = datetime.timedelta(0)
311
286
            else:
312
 
                expires = datetime.datetime.strptime(expires,
313
 
                                                     '%Y-%m-%dT%H:%M:%S.%f')
314
 
                timer = expires - datetime.datetime.utcnow()
 
287
                expires = (datetime.datetime.strptime
 
288
                           (expires, '%Y-%m-%dT%H:%M:%S.%f'))
 
289
                timer = max(expires - datetime.datetime.utcnow(),
 
290
                            datetime.timedelta())
315
291
            message = ('A checker has failed! Time until client'
316
292
                       ' gets disabled: {0}'
317
 
                       .format(unicode(timer).rsplit(".", 1)[0]))
 
293
                       .format(str(timer).rsplit(".", 1)[0]))
 
294
            self.using_timer(True)
318
295
        else:
319
296
            message = "enabled"
 
297
            self.using_timer(False)
320
298
        self._text = "{0}{1}".format(base, message)
321
 
            
 
299
        
322
300
        if not urwid.supports_unicode():
323
301
            self._text = self._text.encode("ascii", "replace")
324
302
        textlist = [("normal", self._text)]
341
319
        self.update()
342
320
        return True             # Keep calling this
343
321
    
344
 
    def delete(self, *args, **kwargs):
 
322
    def delete(self, **kwargs):
345
323
        if self._update_timer_callback_tag is not None:
346
324
            gobject.source_remove(self._update_timer_callback_tag)
347
325
            self._update_timer_callback_tag = None
350
328
        self.match_objects = ()
351
329
        if self.delete_hook is not None:
352
330
            self.delete_hook(self)
353
 
        return super(MandosClientWidget, self).delete(*args, **kwargs)
 
331
        return super(MandosClientWidget, self).delete(**kwargs)
354
332
    
355
333
    def render(self, maxcolrow, focus=False):
356
334
        """Render differently if we have focus.
398
376
        else:
399
377
            return key
400
378
    
401
 
    def property_changed(self, property=None, value=None,
402
 
                         *args, **kwargs):
 
379
    def property_changed(self, property=None, **kwargs):
403
380
        """Call self.update() if old value is not new value.
404
381
        This overrides the method from MandosClientPropertyCache"""
405
 
        property_name = unicode(property)
 
382
        property_name = str(property)
406
383
        old_value = self.properties.get(property_name)
407
384
        super(MandosClientWidget, self).property_changed(
408
 
            property=property, value=value, *args, **kwargs)
 
385
            property=property, **kwargs)
409
386
        if self.properties.get(property_name) != old_value:
410
387
            self.update()
411
388
 
415
392
    "down" key presses, thus not allowing any containing widgets to
416
393
    use them as an excuse to shift focus away from this widget.
417
394
    """
418
 
    def keypress(self, maxcolrow, key):
419
 
        ret = super(ConstrainedListBox, self).keypress(maxcolrow, key)
 
395
    def keypress(self, *args, **kwargs):
 
396
        ret = super(ConstrainedListBox, self).keypress(*args, **kwargs)
420
397
        if ret in ("up", "down"):
421
398
            return
422
399
        return ret
435
412
                ("normal",
436
413
                 "default", "default", None),
437
414
                ("bold",
438
 
                 "default", "default", "bold"),
 
415
                 "bold", "default", "bold"),
439
416
                ("underline-blink",
440
 
                 "default", "default", "underline"),
 
417
                 "underline,blink", "default", "underline,blink"),
441
418
                ("standout",
442
 
                 "default", "default", "standout"),
 
419
                 "standout", "default", "standout"),
443
420
                ("bold-underline-blink",
444
 
                 "default", "default", ("bold", "underline")),
 
421
                 "bold,underline,blink", "default", "bold,underline,blink"),
445
422
                ("bold-standout",
446
 
                 "default", "default", ("bold", "standout")),
 
423
                 "bold,standout", "default", "bold,standout"),
447
424
                ("underline-blink-standout",
448
 
                 "default", "default", ("underline", "standout")),
 
425
                 "underline,blink,standout", "default",
 
426
                 "underline,blink,standout"),
449
427
                ("bold-underline-blink-standout",
450
 
                 "default", "default", ("bold", "underline",
451
 
                                          "standout")),
 
428
                 "bold,underline,blink,standout", "default",
 
429
                 "bold,underline,blink,standout"),
452
430
                ))
453
431
        
454
432
        if urwid.supports_unicode():
509
487
        self.topwidget = urwid.Pile(self.uilist)
510
488
    
511
489
    def log_message(self, message):
 
490
        """Log message formatted with timestamp"""
512
491
        timestamp = datetime.datetime.now().isoformat()
513
492
        self.log_message_raw(timestamp + ": " + message)
514
493
    
527
506
        self.log_visible = not self.log_visible
528
507
        self.rebuild()
529
508
        #self.log_message("Log visibility changed to: "
530
 
        #                 + unicode(self.log_visible))
 
509
        #                 + str(self.log_visible))
531
510
    
532
511
    def change_log_display(self):
533
512
        """Change type of log display.
573
552
        if path is None:
574
553
            path = client.proxy.object_path
575
554
        self.clients_dict[path] = client
576
 
        self.clients.sort(None, lambda c: c.properties["Name"])
 
555
        self.clients.sort(key=lambda c: c.properties["Name"])
577
556
        self.refresh()
578
557
    
579
558
    def remove_client(self, client, path=None):
581
560
        if path is None:
582
561
            path = client.proxy.object_path
583
562
        del self.clients_dict[path]
584
 
        if not self.clients_dict:
585
 
            # Work around bug in Urwid 0.9.8.3 - if a SimpleListWalker
586
 
            # is completely emptied, we need to recreate it.
587
 
            self.clients = urwid.SimpleListWalker([])
588
 
            self.rebuild()
589
563
        self.refresh()
590
564
    
591
565
    def refresh(self):
604
578
        try:
605
579
            mandos_clients = (self.mandos_serv
606
580
                              .GetAllClientsWithProperties())
 
581
            if not mandos_clients:
 
582
                self.log_message_raw(("bold", "Note: Server has no clients."))
607
583
        except dbus.exceptions.DBusException:
 
584
            self.log_message_raw(("bold", "Note: No Mandos server running."))
608
585
            mandos_clients = dbus.Dictionary()
609
586
        
610
587
        (self.mandos_serv
622
599
                            self.client_not_found,
623
600
                            dbus_interface=server_interface,
624
601
                            byte_arrays=True))
625
 
        for path, client in mandos_clients.iteritems():
 
602
        for path, client in mandos_clients.items():
626
603
            client_proxy_object = self.bus.get_object(self.busname,
627
604
                                                      path)
628
605
            self.add_client(MandosClientWidget(server_proxy_object
637
614
                                               logger
638
615
                                               =self.log_message),
639
616
                            path=path)
640
 
 
 
617
        
641
618
        self.refresh()
642
619
        self._input_callback_tag = (gobject.io_add_watch
643
620
                                    (sys.stdin.fileno(),
740
717
    ui.run()
741
718
except KeyboardInterrupt:
742
719
    ui.screen.stop()
743
 
except Exception, e:
744
 
    ui.log_message(unicode(e))
 
720
except Exception as e:
 
721
    ui.log_message(str(e))
745
722
    ui.screen.stop()
746
723
    raise