Merge commit 'dkg/master'

[monkeysphere.git] / doc / TODO

diff --git a/doc/TODO b/doc/TODO
index c17ef617d77636211ca9b7f69d2ce7d50906629a..e1e90f0ec84994a02ff060e4fe81250f6ec43a43 100644 (file)
--- a/doc/TODO
+++ b/doc/TODO
@@ -3,17 +3,49 @@ Next-Steps Monkeysphere Projects:
 
 Detail advantages of monkeysphere: detail the race conditions in ssh,
    and how the monkeysphere can help you reduce these threat vectors:
 
 Detail advantages of monkeysphere: detail the race conditions in ssh,
    and how the monkeysphere can help you reduce these threat vectors:

-   threat model reduction diagrams 
+   threat model reduction diagrams.

 
 Determine how openssh handles multiple processes writing to
 
 Determine how openssh handles multiple processes writing to

-   known_hosts file (atomic appends?)
+   known_hosts/authorized_keys files (lockfile, atomic appends?)

 
 

-Handle unknown hosts in such a way that they're not always removed
-   from known_hosts file.  Ask user to lsign the host key?
+Handle unverified monkeysphere hosts in such a way that they're not
+   always removed from known_hosts file.  Ask user to lsign the host
+   key?

 
 Handle multiple hostnames (multiple user IDs?) when generating host
    keys with gen-key.
 
 
 Handle multiple hostnames (multiple user IDs?) when generating host
    keys with gen-key.
 

+Work out the details (and describe a full use case) for assigning a
+   REVOKER during monkeysphere-server gen_key -- how is this set?  How
+   do we export it so it's available when a second-party revocation is
+   needed?
+
+Actually enable server hostkey publication.
+
+Streamline host key generation, publication, verification.  See
+   doc/george/host-key-publication for what dkg went through on
+   2008-06-19
+
+Ensure that authorized_user_ids are under as tight control as ssh
+   expects from authorized_keys: we don't want monkeysphere to be a
+   weak link in the filesystem.
+
+What happens when a user account has no corresponding
+   /etc/monkeysphere/authorized_user_ids/$USER file?  What gets placed
+   in /var/cache/monkeysphere/authorized_keys/$USER?  It looks
+   currently untouched, which could mean bad things for such a user.
+   - if authorized_user_ids is empty, then the user's authorized_keys
+     file will be also, unless the user-controlled authorized_keys file
+     is added.  I believe this is expected, correct behavior.
+
+Consider the default permissions for
+   /var/cache/monkeysphere/authorized_keys/* (and indeed the whole
+   directory path leading up to that)
+
+As an administrator, how do i reverse the effect of a
+   "monkeysphere-server trust-keys" that i later decide i should not
+   have run?
+

 Make sure alternate ports are handled for known_hosts.
 
 Script to import private key into ssh agent.
 Make sure alternate ports are handled for known_hosts.
 
 Script to import private key into ssh agent.


@@ -61,16 +93,12 @@ File bug against ssh-keygen about how "-R" option removes comments
 File bug against ssh-keygen to see if we can get it to write to hash a
    known_hosts file to/from stdout/stdin.
 
 File bug against ssh-keygen to see if we can get it to write to hash a
    known_hosts file to/from stdout/stdin.
 

-Note all threat model reductions (with diagrams).
-

 Add environment variables sections to man pages.
 
 Environment variable scoping.
 
 Move environment variable precedence before conf file.
 
 Add environment variables sections to man pages.
 
 Environment variable scoping.
 
 Move environment variable precedence before conf file.
 

-Handle lockfiles when modifying known_hosts or authorized_keys.
-

 When using ssh-proxycommand, if only host keys found are expired or
    revoked, then output loud warning with prompt, or fail hard.
 
 When using ssh-proxycommand, if only host keys found are expired or
    revoked, then output loud warning with prompt, or fail hard.
 


@@ -79,3 +107,29 @@ Update monkeysphere-ssh-proxycommand man page with new keyserver
 
 Update monkeysphere-ssh-proxycommand man page with info about
    no-connect option.
 
 Update monkeysphere-ssh-proxycommand man page with info about
    no-connect option.

+
+File bug against seahorse about how, when creating new primary keys,
+   it presents option for "RSA (sign only)" but then creates an "esca"
+   key.
+
+File bug against enigmail about lack of ability to create subkeys.
+
+Privilege separation: monkeysphere user to handle authn keyring and
+   generate authorized_keys file (which would be moved into place by
+   root).  Host keyring would be owned by root.
+
+Check permissions of authorized_user_ids file to be writable only by
+   user and root (same as authorized_keys)
+
+Improve function that sets owner trust for keys in server keychain.
+
+Test and document what happens when any filesystem that the
+   monkeysphere-server relies on and modifies (/tmp, /etc, and /var?)
+   fills up.
+
+Consider moving monkeysphere-managed files (gpg homedirs? temporary
+   files?) into /var.
+
+Optimize keyserver access, particularly on monkeysphere-server
+   update-users -- is there a way to query the keyserver all in a
+   chunk?