28 Mar
2012
28 Mar
'12
11:15 a.m.
Hi,
I've just this second "discovered" Monkeysphere, and I can see it's a
great
idea, so I'm trying to set it up as per their (Monkeysphere's)
documentation for all the machines I regularly SSH to/from, but I'm pretty
sure that:
# monkeysphere-host publish-key
Isn't sending my key(s) to the keyserver mentioned (pool.sks-keyservers.net),
because using their web-based search tool I can't find any of the (now
three) keys I've published.
Anyone know where I might be going wrong, or suggestions on how to proceed?
Kind regards
Murray Crane
28 Mar
28 Mar
2:24 p.m.
Hi Murray,
On Wed, Mar 28, 2012 at 12:15:08PM +0100, Murray Crane wrote:
pool.sks-keyservers.net is a big set of individual servers and your
client will just pick one to send to and to receive from. Sometimes
it can take a while for them to distribute keys between each other.
Have you waited a few hours before checking again?
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
2:41 p.m.
TBH, for only one of the three it's been a couple of hours; it's under an
hour for the other two.
Best course right now would appear to be to not panic and let time be time.
I've yet to lock down SSHD to key-only in all three cases, so I'm not
losing anything as yet (other than the additional security).
Kind regards
Murray Crane
On 28 March 2012 15:24, Andy Smith <andy(a)bitfolk.com> wrote:
29 Mar
29 Mar
3:16 p.m.
Just a quick update; everything A-OK.
One of the three host keys went in shortly (within minutes) of my previous
email, and the other two went in this morning without issue (just had to
redo the send commands). Happy (enough) bunny...
I'm now in the process of getting admin keys for all three machines (and
user keys for two of them) into Monkeysphere and the greater GPG key
networks. With a bit of luck, I'll have it all working tomorrow.
Is there any further guidance on how to get my
*.console.bitfolk.comcert/key so I can include that in all the fun
(other than the wiki)?
Kind regards
Murray Crane
On 28 March 2012 15:41, Murray Crane <murray.crane(a)gmail.com> wrote:
30 Mar
30 Mar
2:26 a.m.
Hi Murray,
On Thu, Mar 29, 2012 at 04:16:02PM +0100, Murray Crane wrote:
Is there any further guidance on how to get my
*.console.bitfolk.comcert/key so I can include that in all the fun
(other than the wiki)?
If we're talking about:
https://tools.bitfolk.com/wiki/Verifying_BitFolk%27s_SSH_fingerprints
then you'll see the problem of console host vs. real host. The
article states that BitFolk is not going to publish the keys for
every console.bitfolk.com hostname, but then incorrectly goes on to
state that you could publish them yourself.
You obviously can't publish them yourself because
whatever.console.bitfolk.com is actually just a CNAME for some VPS
host that you have no admin access to, and admin access would be
required to do the:
# monkeysphere-host import-key blah..
I will correct the article.
What I would suggest, if you want to be able to verify the console
host using Monkeysphere, is that you do it in a two stage process.
For example, if your account name were "ruminant", you could find
your VPS host like so:
$ host ruminant.console.bitfolk.com
ruminant.console.bitfolk.com is an alias for console.president.bitfolk.com.
console.president.bitfolk.com is an alias for president.bitfolk.com.
president.bitfolk.com has address 85.119.80.16
president.bitfolk.com has IPv6 address 2001:ba8:0:1f1::6
You could then:
$ ssh ruminant(a)president.bitfolk.com
which Monkeysphere should be able to verify, as the host key for
president.bitfolk.com is published. One you've verified that you do
end up connected to the thing you expected to be connected to you
could sign the host key yourself and re-publish it, as at the moment
the entire thing relies on my single PGP key.
Hopefully soon I will be able to add DNSSEC to the bitfolk.com zone
and along with it I will publish SSHFP¹ records for all the console
host mappings, so that will provide another (easier) way to verify,
if you're using a validating DNS resolver.
Cheers,
Andy
¹ Dry details: http://tools.ietf.org/html/rfc4255
An example of use:
http://benctechnicalblog.blogspot.co.uk/2011/03/sshfp-dns.html
--
The optimum programming team size is 1.
Has
Jurassic Park taught us nothing?
-- pfilandr
4755
days inactive
4757
days old
4 comments
2 participants
participants (2)
-
Andy Smith -
Murray Crane