X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=doc%2FTODO;h=d365ac7e357268f2d6679c7bfac04bedcc2a943a;hb=e9f00652e3503ef2292e6d27df80cbb4c8e09504;hp=e1e90f0ec84994a02ff060e4fe81250f6ec43a43;hpb=f85884c451f77afa95183da36c33dbc334d1a14b;p=monkeysphere.git diff --git a/doc/TODO b/doc/TODO index e1e90f0..d365ac7 100644 --- a/doc/TODO +++ b/doc/TODO @@ -5,66 +5,12 @@ Detail advantages of monkeysphere: detail the race conditions in ssh, and how the monkeysphere can help you reduce these threat vectors: threat model reduction diagrams. -Determine how openssh handles multiple processes writing to - known_hosts/authorized_keys files (lockfile, atomic appends?) - Handle unverified monkeysphere hosts in such a way that they're not always removed from known_hosts file. Ask user to lsign the host key? -Handle multiple hostnames (multiple user IDs?) when generating host - keys with gen-key. - -Work out the details (and describe a full use case) for assigning a - REVOKER during monkeysphere-server gen_key -- how is this set? How - do we export it so it's available when a second-party revocation is - needed? - -Actually enable server hostkey publication. - -Streamline host key generation, publication, verification. See - doc/george/host-key-publication for what dkg went through on - 2008-06-19 - -Ensure that authorized_user_ids are under as tight control as ssh - expects from authorized_keys: we don't want monkeysphere to be a - weak link in the filesystem. - -What happens when a user account has no corresponding - /etc/monkeysphere/authorized_user_ids/$USER file? What gets placed - in /var/cache/monkeysphere/authorized_keys/$USER? It looks - currently untouched, which could mean bad things for such a user. - - if authorized_user_ids is empty, then the user's authorized_keys - file will be also, unless the user-controlled authorized_keys file - is added. I believe this is expected, correct behavior. - -Consider the default permissions for - /var/cache/monkeysphere/authorized_keys/* (and indeed the whole - directory path leading up to that) - -As an administrator, how do i reverse the effect of a - "monkeysphere-server trust-keys" that i later decide i should not - have run? - -Make sure alternate ports are handled for known_hosts. - -Script to import private key into ssh agent. - -Provide a friendly interactive UI for marginal or failing client-side - hostkey verifications. Handle the common cases smoothly, and - provide good debugging info for the unusual cases. - -Make sure onak properly escapes user IDs with colons in them. - -Build a decent, presentable web site for documentation, evangelism, - etc. Include a mention of how to report trouble or concerns. - -Create ssh2openpgp or convert to full-fledged keytrans. - Resolve the bugs listed in openpgp2ssh(1):BUGS. -Understand and document alternate trustdb models. - Understand and document the output of gpg --check-trustdb: gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 2 signed: 20 trust: 0-, 0q, 0n, 0m, 0f, 2u @@ -87,49 +33,19 @@ Make it easier to do domain-relative ssh host trust signatures with Fix the order of questions when user does a tsign in gpg or gpg2. -File bug against ssh-keygen about how "-R" option removes comments - from known_hosts file. - -File bug against ssh-keygen to see if we can get it to write to hash a - known_hosts file to/from stdout/stdin. - -Add environment variables sections to man pages. - -Environment variable scoping. - -Move environment variable precedence before conf file. - When using ssh-proxycommand, if only host keys found are expired or revoked, then output loud warning with prompt, or fail hard. -Update monkeysphere-ssh-proxycommand man page with new keyserver - checking policy info. - -Update monkeysphere-ssh-proxycommand man page with info about - no-connect option. - -File bug against seahorse about how, when creating new primary keys, - it presents option for "RSA (sign only)" but then creates an "esca" - key. - File bug against enigmail about lack of ability to create subkeys. -Privilege separation: monkeysphere user to handle authn keyring and - generate authorized_keys file (which would be moved into place by - root). Host keyring would be owned by root. - -Check permissions of authorized_user_ids file to be writable only by - user and root (same as authorized_keys) - -Improve function that sets owner trust for keys in server keychain. - Test and document what happens when any filesystem that the monkeysphere-server relies on and modifies (/tmp, /etc, and /var?) fills up. -Consider moving monkeysphere-managed files (gpg homedirs? temporary - files?) into /var. - Optimize keyserver access, particularly on monkeysphere-server update-users -- is there a way to query the keyserver all in a chunk? + +Think about packaging monkeysphere for other (non-apt-based) operating + systems. RPM-based linux systems, FreeBSD ports, and Mac OS X seem + like the most likely candidates.