From a5066c3a37a84bf47e1e1d6ff8ad755ad5fa9414 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 19 Jun 2008 03:17:01 -0400 Subject: [PATCH] added more documentation about george, and more TODO notes. --- doc/TODO | 25 +++++++++++++++++++++++-- doc/george/changelog | 14 ++++++++++++-- doc/george/user-id-configuration | 21 +++++++++++++++++++++ 3 files changed, 56 insertions(+), 4 deletions(-) create mode 100644 doc/george/user-id-configuration diff --git a/doc/TODO b/doc/TODO index 3538fbf..e2fce0e 100644 --- a/doc/TODO +++ b/doc/TODO @@ -8,12 +8,33 @@ Detail advantages of monkeysphere: detail the race conditions in ssh, Determine how openssh handles multiple processes writing to known_hosts/authorized_keys files (lockfile, atomic appends?) -Handle unknown hosts in such a way that they're not always removed - from known_hosts file. Ask user to lsign the host key? +Handle unverified monkeysphere hosts in such a way that they're not + always removed from known_hosts file. Ask user to lsign the host + key? Handle multiple hostnames (multiple user IDs?) when generating host keys with gen-key. +Work out the details (and describe a full use case) for assigning a + REVOKER during monkeysphere-server gen_key -- how is this set? How + do we export it so it's available when a second-party revocation is + needed? + +Actually enable server hostkey publication. + +Streamline host key generation, publication, verification. See + doc/george/host-key-publication for what dkg went through on + 2008-06-19 + +Streamline authorized_user_ids setup (including question of where + authorized_user_ids files should go). See + doc/george/user-id-configuration for what dkg went through on + 2008-06-19 + +Ensure that authorized_user_ids are under as tight control as ssh + expects from authorized_keys: we don't want monkeysphere to be a + weak link in the filesystem. + Make sure alternate ports are handled for known_hosts. Script to import private key into ssh agent. diff --git a/doc/george/changelog b/doc/george/changelog index 8eebe4b..afea2d0 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -20,8 +20,18 @@ Installed syslog-ng in their stead, which still gives errors related to /proc/kmsg unreadability, but the install completes :/ - * added experimental, juggled pinning: - experimental: 1, unstable: 2 + * added experimental + * juggled pinning: experimental: 1, unstable: 2 + * added mathopd onak, tweaked /etc/mathopd.conf and /etc/onak.conf + + * installed monkeysphere v0.1-1, changed host key, published + them via the local keyserver (see host-key-publication) + + * added local unprivileged user accounts for everyone listed in + /usr/share/doc/monkeysphere/copyright + + * configured authorized_user_ids for every user account based on + my best guess at their OpenPGP User ID. 2008-06-18 - jrollins * installed less, emacs; diff --git a/doc/george/user-id-configuration b/doc/george/user-id-configuration new file mode 100644 index 0000000..d95279d --- /dev/null +++ b/doc/george/user-id-configuration @@ -0,0 +1,21 @@ +2008-06-19 03:00:58-0400 +------------------------ + +setting up authorized_user_id configuration on george was also more +cumbersome than it needs to be. Here's what i (dkg) did: + + GNUPGHOME=/etc/monkeysphere/gnupg gpg --keyserver subkeys.pgp.net --search dkg@fifthhorseman.net + GNUPGHOME=/etc/monkeysphere/gnupg gpg --fingerprint dkg@fifthhorseman.net + +set up the authorized_user_ids (why are these in /etc/ and not in +people's home directories?) + +echo 'Daniel Kahn Gillmor ' > /etc/monkeysphere/authorized_user_ids/dkg +echo 'Jameson Rollins ' > /etc/monkeysphere/authorized_user_ids/jrollins +echo 'Micah Anderson ' > /etc/monkeysphere/authorized_user_ids/micah +echo 'Matthew Goins ' > /etc/monkeysphere/authorized_user_ids/mjgoins +echo 'Ross Glover ' > /etc/monkeysphere/authorized_user_ids/ross +echo 'Jamie McClelland ' > /etc/monkeysphere/authorized_user_ids/jamie +echo 'mike castleman ' > /etc/monkeysphere/authorized_user_ids/mlcastle +echo 'Elliot Winard ' > /etc/monkeysphere/authorized_user_ids/enw +echo 'Greg Lyle ' > /etc/monkeysphere/authorized_user_ids/greg -- 2.25.1