Merge commit 'dkg/master'

3 files changed, 53 insertions, 0 deletions

diff --git a/website/bugs/add-identity-certifier-behaves-oddly-without-pty.mdwn b/website/bugs/add-identity-certifier-behaves-oddly-without-pty.mdwn
new file mode 100644
index 0000000..1962fe5
--- /dev/null
+++ b/website/bugs/add-identity-certifier-behaves-oddly-without-pty.mdwn
@@ -0,0 +1,15 @@
+When executing `monkeysphere-server add-identity-certifier` across a
+link without a pseudo-terminal, it behaves oddly (prompts are created
+that are only halfway-readable, gpg gives error messages about lacking
+access to a `/dev/tty`, etc.
+
+You can try this directly if you have remote ssh access to the
+superuser on a monkeysphere-enabled host, assuming that `$GPGID` is
+set to the full fingerprint of a key you want to add as a trusted
+identity certifier:
+
+	ssh root@example.org monkeysphere-server add-identity-certifier $GPGID
+
+Compare this behavior with:
+
+	ssh -t root@example.org monkeysphere-server add-identity-certifier $GPGID
diff --git a/website/bugs/hostkeyalias-confuses-monkeysphere.mdwn b/website/bugs/hostkeyalias-confuses-monkeysphere.mdwn
new file mode 100644
index 0000000..4f7df66
--- /dev/null
+++ b/website/bugs/hostkeyalias-confuses-monkeysphere.mdwn
@@ -0,0 +1,28 @@
+Consider the following snippet in `~/.ssh/config`:
+
+	 Host foo
+	 HostKeyAlias bar
+
+for a host which is *not* participating in the monkeysphere.
+
+For such a host, when using `monkeysphere-ssh-proxy-command`, the
+public keyservers will be queried on each attempted ssh connection
+(even after a successful connection).
+
+This appears to be because:
+
+* `ssh` itself will write a line to `~/.ssh/known_hosts`, but it will
+  be labeled with `bar` because of the `HostKeyAlias`. 
+
+* `monkeysphere` won't be able to find any mention of it in the
+  keyring (it's not in the monkeysphere)
+
+* `monkeysphere-ssh-proxycommand` won't be able to find it in the
+  `known_hosts` file because it looks for `foo`, which is never
+  matched.
+
+excessive keyserver querying is bad behavior, because it causes delays
+for the users, and puts excessive load on the public keyserver
+infrastructure.
+
+How can we resolve this?
diff --git a/website/bugs/monkeysphere-ignores-HashKnownHosts-directive.mdwn b/website/bugs/monkeysphere-ignores-HashKnownHosts-directive.mdwn
new file mode 100644
index 0000000..6b5b53d
--- /dev/null
+++ b/website/bugs/monkeysphere-ignores-HashKnownHosts-directive.mdwn
@@ -0,0 +1,10 @@
+In `~/.ssh/config`, i have:
+
+	HashKnownHosts No
+
+But when `monkeysphere-ssh-proxycommand` adds new hosts to
+`~/.ssh/known_hosts`, they appear to be added in a hashed form,
+instead of in the clear.
+
+fwiw: i'm using OpenSSH 5.1p1 on a debian lenny system (backported
+from sid)