Name /etc/nginx in alerts, and say both reasons known_hosts changes

dejima documents /etc/nginx for remote access on the devbox, so a change
there is common and now reads as its own area rather than as /etc.

The known_hosts note said it changes only on a first connection. ssh's
UpdateHostKeys also adds keys a known host offers, keeping known_hosts.old.

README.md

@@ -460,8 +460,9 @@ the path like `critical_paths`:
 ignore_paths = /.ssh/known_hosts
 ```
 
-`~/.ssh/known_hosts` is the usual candidate. It changes whenever the devbox
-first connects to an SSH host, such as cloning from a new git server. Ignored
+`~/.ssh/known_hosts` is the usual candidate. It changes when the devbox first
+connects to an SSH host, and when a host it already knows offers a key not yet
+recorded: ssh adds it and keeps the old file as `known_hosts.old`. Ignored
 changes still show in `report`, under their own heading, and a critical path
 cannot be ignored.
 

bin/dejima-guard

@@ -428,6 +428,7 @@ describe() {  # describe DIFF_FILE
             if (p ~ /^\/etc\/apt\//)                              return "/etc/apt"
             if (p ~ /^\/etc\/systemd\//)                          return "/etc/systemd"
             if (p ~ /^\/etc\/ssh\//)                              return "/etc/ssh"
+            if (p ~ /^\/etc\/nginx\//)                            return "/etc/nginx"
             if (p ~ /^\/etc\//)                                   return "/etc"
             if (p ~ /^\/usr\/local\/bin\//)                       return "/usr/local/bin"
             if (p ~ /^\/usr\/local\/sbin\//)                      return "/usr/local/sbin"
@@ -447,11 +448,13 @@ describe() {  # describe DIFF_FILE
 }
 
 # Said beside a change to known_hosts, which is the one most often harmless and
-# least obviously so.
+# least obviously so. ssh's UpdateHostKeys, on by default, adds keys a known
+# host offers that are not recorded yet, and keeps the previous file as
+# known_hosts.old: so a familiar host can change it too, as two files.
 known_hosts_note() {  # known_hosts_note DESCRIPTION
     case "$1" in
         *"~/.ssh/known_hosts"*)
-            printf ' known_hosts changes when the devbox first connects to an SSH host it has not seen, such as cloning from a new git server.' ;;
+            printf ' known_hosts changes when the devbox first connects to an SSH host, or when a host it already knows offers a key not yet recorded, which ssh adds while keeping the old file as known_hosts.old.' ;;
     esac
 }
 

etc/config.example

@@ -72,8 +72,9 @@ ssh_known_hosts = /var/lib/dejima-guard/known_hosts
 # Paths whose change is reported but not alerted on, space-separated, each
 # matched as a substring of the path. None by default.
 #
-# ~/.ssh/known_hosts is the usual one: it changes whenever the devbox first
-# connects to an SSH host, such as cloning from a new git server. Ignored
+# ~/.ssh/known_hosts is the usual one: it changes when the devbox first
+# connects to an SSH host, and when a host it already knows offers a key not
+# yet recorded, which ssh adds while keeping known_hosts.old. Ignored
 # changes still appear in `dejima-guard report`, and a critical path above is
 # never ignored, whatever this says.
 # ignore_paths = /.ssh/known_hosts

test/guard.bats

@@ -1394,11 +1394,21 @@ FILE ccc /etc/apt/sources.list.d/new.list" 0
     run_watch check
     [[ "$(curl_log)" == *"1 file(s) modified in ~/.ssh/known_hosts"* ]]
     [[ "$(curl_log)" == *"1 file(s) added in /etc/apt"* ]]
-    [[ "$(curl_log)" == *"first connects to an SSH host"* ]]
+    [[ "$(curl_log)" == *"a host it already knows offers a key"* ]]
     [[ "$(curl_log)" != *intruder-chosen* ]]
     [[ "$(curl_log)" != *new.list* ]]
 }
 
+@test "remote access's nginx config is named as its own area" {
+    # dejima documents /etc/nginx for remote access on the devbox, so a change
+    # there is common and worth telling apart from the rest of /etc.
+    stub_ssh "FILE aaa /etc/nginx/sites-available/dejima" 0
+    run_watch accept
+    stub_ssh "FILE bbb /etc/nginx/sites-available/dejima" 0
+    run_watch check
+    [[ "$(curl_log)" == *"1 file(s) modified in /etc/nginx"* ]]
+}
+
 @test "the report pairs an edit into one modified line" {
     stub_ssh "FILE aaa /etc/one
 FILE ddd /etc/gone" 0