/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-monitor

  • Committer: Teddy Hogeborn
  • Date: 2014-06-22 02:19:30 UTC
  • Revision ID: teddy@recompile.se-20140622021930-icl7h4cm97blhjml
mandos-keygen: Generate "checker" option to use SSH fingerprints.

To turn this off, use a new "--no-ssh" option to mandos-keygen.

* INSTALL (Mandos Server, Mandos Client): Document new suggested
                                          installation of SSH.
* Makefile (confdir/clients.conf): Use new "--no-ssh" option to
                                   "mandos-keygen".
* debian/control (mandos/Depends): Changed to "fping | ssh-client".
  (mandos-client/Recommends): New; set to "ssh".
* intro.xml (FREQUENTLY ASKED QUESTIONS): Rename and rewrite section
                                          called "Faking ping
                                          replies?" to address new
                                          default behavior.
* mandos-clients.conf.xml (OPTIONS/checker): Briefly discuss new
                                             behavior of
                                             mandos-keygen.
* mandos-keygen: Bug fix: Suppress failure output of "shred" to remove
                 "sec*", since no such files may exist.
 (password mode): Scan for SSH key fingerprints and output as new
                  "checker" and "ssh_fingerprint" options, unless new
                  "--no-ssh" option is given.
* mandos-keygen.xml (SYNOPSIS/--force): Bug fix: Document short form.
  (OPTIONS/--no-ssh): New.
  (SEE ALSO): Add reference "ssh-keyscan(1)".
* plugins.d/mandos-client.xml (SECURITY): Briefly mention the
                                          possibility of using SSH key
                                          fingerprints for checking.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-monitor
3
3
# 
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
5
# 
6
 
# Copyright © 2009-2015 Teddy Hogeborn
7
 
# Copyright © 2009-2015 Björn Påhlsson
 
6
# Copyright © 2009-2014 Teddy Hogeborn
 
7
# Copyright © 2009-2014 Björn Påhlsson
8
8
# 
9
9
# This program is free software: you can redistribute it and/or modify
10
10
# it under the terms of the GNU General Public License as published by
48
48
 
49
49
import locale
50
50
 
51
 
if sys.version_info.major == 2:
 
51
if sys.version_info[0] == 2:
52
52
    str = unicode
53
53
 
54
54
locale.setlocale(locale.LC_ALL, '')
60
60
domain = 'se.recompile'
61
61
server_interface = domain + '.Mandos'
62
62
client_interface = domain + '.Mandos.Client'
63
 
version = "1.6.9"
 
63
version = "1.6.5"
64
64
 
65
65
def isoformat_to_datetime(iso):
66
66
    "Parse an ISO 8601 date string to a datetime.datetime()"
87
87
        self.proxy = proxy_object # Mandos Client proxy object
88
88
        self.properties = dict() if properties is None else properties
89
89
        self.property_changed_match = (
90
 
            self.proxy.connect_to_signal("PropertiesChanged",
91
 
                                         self.properties_changed,
92
 
                                         dbus.PROPERTIES_IFACE,
 
90
            self.proxy.connect_to_signal("PropertyChanged",
 
91
                                         self._property_changed,
 
92
                                         client_interface,
93
93
                                         byte_arrays=True))
94
94
        
95
95
        if properties is None:
100
100
        
101
101
        super(MandosClientPropertyCache, self).__init__(**kwargs)
102
102
    
103
 
    def properties_changed(self, interface, properties, invalidated):
104
 
        """This is called whenever we get a PropertiesChanged signal
105
 
        It updates the changed properties in the "properties" dict.
 
103
    def _property_changed(self, property, value):
 
104
        """Helper which takes positional arguments"""
 
105
        return self.property_changed(property=property, value=value)
 
106
    
 
107
    def property_changed(self, property=None, value=None):
 
108
        """This is called whenever we get a PropertyChanged signal
 
109
        It updates the changed property in the "properties" dict.
106
110
        """
107
111
        # Update properties dict with new value
108
 
        self.properties.update(properties)
 
112
        self.properties[property] = value
109
113
    
110
114
    def delete(self):
111
115
        self.property_changed_match.remove()
157
161
                                         self.rejected,
158
162
                                         client_interface,
159
163
                                         byte_arrays=True))
160
 
        self.logger('Created client {}'
161
 
                    .format(self.properties["Name"]), level=0)
 
164
        #self.logger('Created client {0}'
 
165
        #            .format(self.properties["Name"]))
162
166
    
163
167
    def using_timer(self, flag):
164
168
        """Call this method with True or False when timer should be
173
177
            gobject.source_remove(self._update_timer_callback_tag)
174
178
            self._update_timer_callback_tag = None
175
179
    
176
 
    def checker_completed(self, exitstatus, signal, command):
 
180
    def checker_completed(self, exitstatus, condition, command):
177
181
        if exitstatus == 0:
178
 
            self.logger('Checker for client {} (command "{}")'
179
 
                        ' succeeded'.format(self.properties["Name"],
180
 
                                            command), level=0)
181
182
            self.update()
182
183
            return
183
184
        # Checker failed
184
 
        if exitstatus >= 0:
185
 
            self.logger('Checker for client {} (command "{}") failed'
186
 
                        ' with exit code {}'
187
 
                        .format(self.properties["Name"], command,
188
 
                                exitstatus))
189
 
        elif signal != 0:
190
 
            self.logger('Checker for client {} (command "{}") was'
191
 
                        ' killed by signal {}'
192
 
                        .format(self.properties["Name"], command,
193
 
                                signal))
 
185
        if os.WIFEXITED(condition):
 
186
            self.logger('Checker for client {0} (command "{1}")'
 
187
                        ' failed with exit code {2}'
 
188
                        .format(self.properties["Name"], command,
 
189
                                os.WEXITSTATUS(condition)))
 
190
        elif os.WIFSIGNALED(condition):
 
191
            self.logger('Checker for client {0} (command "{1}") was'
 
192
                        ' killed by signal {2}'
 
193
                        .format(self.properties["Name"], command,
 
194
                                os.WTERMSIG(condition)))
 
195
        elif os.WCOREDUMP(condition):
 
196
            self.logger('Checker for client {0} (command "{1}")'
 
197
                        ' dumped core'
 
198
                        .format(self.properties["Name"], command))
194
199
        else:
195
 
            self.logger('Checker for client {} completed'
 
200
            self.logger('Checker for client {0} completed'
196
201
                        ' mysteriously'
197
202
                        .format(self.properties["Name"]))
198
203
        self.update()
199
204
    
200
205
    def checker_started(self, command):
201
 
        """Server signals that a checker started."""
202
 
        self.logger('Client {} started checker "{}"'
203
 
                    .format(self.properties["Name"],
204
 
                            command), level=0)
 
206
        """Server signals that a checker started. This could be useful
 
207
           to log in the future. """
 
208
        #self.logger('Client {0} started checker "{1}"'
 
209
        #            .format(self.properties["Name"],
 
210
        #                    str(command)))
 
211
        pass
205
212
    
206
213
    def got_secret(self):
207
 
        self.logger('Client {} received its secret'
 
214
        self.logger('Client {0} received its secret'
208
215
                    .format(self.properties["Name"]))
209
216
    
210
217
    def need_approval(self, timeout, default):
211
218
        if not default:
212
 
            message = 'Client {} needs approval within {} seconds'
 
219
            message = 'Client {0} needs approval within {1} seconds'
213
220
        else:
214
 
            message = 'Client {} will get its secret in {} seconds'
 
221
            message = 'Client {0} will get its secret in {1} seconds'
215
222
        self.logger(message.format(self.properties["Name"],
216
223
                                   timeout/1000))
217
224
    
218
225
    def rejected(self, reason):
219
 
        self.logger('Client {} was rejected; reason: {}'
 
226
        self.logger('Client {0} was rejected; reason: {1}'
220
227
                    .format(self.properties["Name"], reason))
221
228
    
222
229
    def selectable(self):
266
273
            else:
267
274
                timer = datetime.timedelta()
268
275
            if self.properties["ApprovedByDefault"]:
269
 
                message = "Approval in {}. (d)eny?"
 
276
                message = "Approval in {0}. (d)eny?"
270
277
            else:
271
 
                message = "Denial in {}. (a)pprove?"
 
278
                message = "Denial in {0}. (a)pprove?"
272
279
            message = message.format(str(timer).rsplit(".", 1)[0])
273
280
            self.using_timer(True)
274
281
        elif self.properties["LastCheckerStatus"] != 0:
282
289
                timer = max(expires - datetime.datetime.utcnow(),
283
290
                            datetime.timedelta())
284
291
            message = ('A checker has failed! Time until client'
285
 
                       ' gets disabled: {}'
 
292
                       ' gets disabled: {0}'
286
293
                       .format(str(timer).rsplit(".", 1)[0]))
287
294
            self.using_timer(True)
288
295
        else:
289
296
            message = "enabled"
290
297
            self.using_timer(False)
291
 
        self._text = "{}{}".format(base, message)
 
298
        self._text = "{0}{1}".format(base, message)
292
299
        
293
300
        if not urwid.supports_unicode():
294
301
            self._text = self._text.encode("ascii", "replace")
369
376
        else:
370
377
            return key
371
378
    
372
 
    def properties_changed(self, interface, properties, invalidated):
373
 
        """Call self.update() if any properties changed.
 
379
    def property_changed(self, property=None, **kwargs):
 
380
        """Call self.update() if old value is not new value.
374
381
        This overrides the method from MandosClientPropertyCache"""
375
 
        old_values = { key: self.properties.get(key)
376
 
                       for key in properties.keys() }
377
 
        super(MandosClientWidget, self).properties_changed(
378
 
            interface, properties, invalidated)
379
 
        if any(old_values[key] != self.properties.get(key)
380
 
               for key in old_values):
 
382
        property_name = str(property)
 
383
        old_value = self.properties.get(property_name)
 
384
        super(MandosClientWidget, self).property_changed(
 
385
            property=property, **kwargs)
 
386
        if self.properties.get(property_name) != old_value:
381
387
            self.update()
382
388
 
383
389
 
397
403
    """This is the entire user interface - the whole screen
398
404
    with boxes, lists of client widgets, etc.
399
405
    """
400
 
    def __init__(self, max_log_length=1000, log_level=1):
 
406
    def __init__(self, max_log_length=1000):
401
407
        DBusGMainLoop(set_as_default=True)
402
408
        
403
409
        self.screen = urwid.curses_display.Screen()
441
447
        self.log = []
442
448
        self.max_log_length = max_log_length
443
449
        
444
 
        self.log_level = log_level
445
 
        
446
450
        # We keep a reference to the log widget so we can remove it
447
451
        # from the ListWalker without it getting destroyed
448
452
        self.logbox = ConstrainedListBox(self.log)
462
466
        self.main_loop = gobject.MainLoop()
463
467
    
464
468
    def client_not_found(self, fingerprint, address):
465
 
        self.log_message("Client with address {} and fingerprint {}"
466
 
                         " could not be found"
 
469
        self.log_message("Client with address {0} and fingerprint"
 
470
                         " {1} could not be found"
467
471
                         .format(address, fingerprint))
468
472
    
469
473
    def rebuild(self):
482
486
            self.uilist.append(self.logbox)
483
487
        self.topwidget = urwid.Pile(self.uilist)
484
488
    
485
 
    def log_message(self, message, level=1):
 
489
    def log_message(self, message):
486
490
        """Log message formatted with timestamp"""
487
 
        if level < self.log_level:
488
 
            return
489
491
        timestamp = datetime.datetime.now().isoformat()
490
 
        self.log_message_raw("{}: {}".format(timestamp, message),
491
 
                             level=level)
 
492
        self.log_message_raw(timestamp + ": " + message)
492
493
    
493
 
    def log_message_raw(self, markup, level=1):
 
494
    def log_message_raw(self, markup):
494
495
        """Add a log message to the log buffer."""
495
 
        if level < self.log_level:
496
 
            return
497
496
        self.log.append(urwid.Text(markup, wrap=self.log_wrap))
498
497
        if (self.max_log_length
499
498
            and len(self.log) > self.max_log_length):
506
505
        """Toggle visibility of the log buffer."""
507
506
        self.log_visible = not self.log_visible
508
507
        self.rebuild()
509
 
        self.log_message("Log visibility changed to: {}"
510
 
                         .format(self.log_visible), level=0)
 
508
        #self.log_message("Log visibility changed to: "
 
509
        #                 + str(self.log_visible))
511
510
    
512
511
    def change_log_display(self):
513
512
        """Change type of log display.
518
517
            self.log_wrap = "clip"
519
518
        for textwidget in self.log:
520
519
            textwidget.set_wrap_mode(self.log_wrap)
521
 
        self.log_message("Wrap mode: {}".format(self.log_wrap),
522
 
                         level=0)
 
520
        #self.log_message("Wrap mode: " + self.log_wrap)
523
521
    
524
522
    def find_and_remove_client(self, path, name):
525
523
        """Find a client by its object path and remove it.
530
528
            client = self.clients_dict[path]
531
529
        except KeyError:
532
530
            # not found?
533
 
            self.log_message("Unknown client {!r} ({!r}) removed"
 
531
            self.log_message("Unknown client {0!r} ({1!r}) removed"
534
532
                             .format(name, path))
535
533
            return
536
534
        client.delete()
654
652
            elif key == "window resize":
655
653
                self.size = self.screen.get_cols_rows()
656
654
                self.refresh()
657
 
            elif key == "ctrl l":
658
 
                self.screen.clear()
 
655
            elif key == "\f":  # Ctrl-L
659
656
                self.refresh()
660
657
            elif key == "l" or key == "D":
661
658
                self.toggle_log_display()
673
670
                                            "?: Help",
674
671
                                            "l: Log window toggle",
675
672
                                            "TAB: Switch window",
676
 
                                            "w: Wrap (log lines)",
677
 
                                            "v: Toggle verbose log",
678
 
                                            ))))
 
673
                                            "w: Wrap (log)"))))
679
674
                self.log_message_raw(("bold",
680
675
                                      "  "
681
676
                                      .join(("Clients:",
694
689
                else:
695
690
                    self.topwidget.set_focus(self.logbox)
696
691
                self.refresh()
697
 
            elif key == "v":
698
 
                if self.log_level == 0:
699
 
                    self.log_level = 1
700
 
                    self.log_message("Verbose mode: Off")
701
 
                else:
702
 
                    self.log_level = 0
703
 
                    self.log_message("Verbose mode: On")
704
692
            #elif (key == "end" or key == "meta >" or key == "G"
705
693
            #      or key == ">"):
706
694
            #    pass            # xxx end-of-buffer