From dcba8ebebf480a051f2b872f89ccbe68ad642f61 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Jun 2008 23:48:37 -0400 Subject: Update to new agreed default host key usage flag (only "a" required for users and hosts). Update TODO file. Some other small changes. --- doc/TODO | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) (limited to 'doc') diff --git a/doc/TODO b/doc/TODO index 905d198..0402b46 100644 --- a/doc/TODO +++ b/doc/TODO @@ -4,13 +4,11 @@ Next-Steps Monkeysphere Projects: Handle unknown hosts in such a way that they're not always removed from known_hosts file. Ask user to lsign the host key? -Handle multiple multiple hostnames (multiple user IDs?) when - generating host keys with gen-key. +Handle multiple hostnames (multiple user IDs?) when generating host + keys with gen-key. Make sure alternate ports are handled for known_hosts. -Add environment variables sections to man pages. - Script to import private key into ssh agent. Provide a friendly interactive UI for marginal or failing client-side @@ -49,3 +47,28 @@ Make it easier to do domain-relative ssh host trust signatures with "tsign" in gpg(1). Fix the order of questions when user does a tsign in gpg or gpg2. + +File bug against ssh-keygen about how "-R" option removes comments + from known_hosts file. + +File bug against ssh-keygen to see if we can get it to write to hash a + known_hosts file to/from stdout/stdin. + +Note all threat model reductions (with diagrams). + +Add environment variables sections to man pages. + +Environment variable scoping. + +Move environment variable precedence before conf file. + +Handle lockfiles when modifying known_hosts or authorized_keys. + +When using ssh-proxycommand, if only host keys found are expired or + revoked, then output loud warning with prompt, or fail hard. + +Update monkeysphere-ssh-proxycommand man page with new keyserver + checking policy info. + +Update monkeysphere-ssh-proxycommand man page with info about + no-connect option. -- cgit v1.2.3 From 6ee67a218916f6f9c30dfe9787109017c11e8185 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Jun 2008 23:53:09 -0400 Subject: Update TODO after merge. --- doc/TODO | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) (limited to 'doc') diff --git a/doc/TODO b/doc/TODO index c17ef61..3538fbf 100644 --- a/doc/TODO +++ b/doc/TODO @@ -3,10 +3,10 @@ Next-Steps Monkeysphere Projects: Detail advantages of monkeysphere: detail the race conditions in ssh, and how the monkeysphere can help you reduce these threat vectors: - threat model reduction diagrams + threat model reduction diagrams. Determine how openssh handles multiple processes writing to - known_hosts file (atomic appends?) + known_hosts/authorized_keys files (lockfile, atomic appends?) Handle unknown hosts in such a way that they're not always removed from known_hosts file. Ask user to lsign the host key? @@ -61,16 +61,12 @@ File bug against ssh-keygen about how "-R" option removes comments File bug against ssh-keygen to see if we can get it to write to hash a known_hosts file to/from stdout/stdin. -Note all threat model reductions (with diagrams). - Add environment variables sections to man pages. Environment variable scoping. Move environment variable precedence before conf file. -Handle lockfiles when modifying known_hosts or authorized_keys. - When using ssh-proxycommand, if only host keys found are expired or revoked, then output loud warning with prompt, or fail hard. -- cgit v1.2.3 From fadd814ce4351c3869e49d91b31aa5b2efc68a01 Mon Sep 17 00:00:00 2001 From: Jameson Graef Rollins Date: Wed, 18 Jun 2008 23:58:01 -0400 Subject: update george changelog --- doc/george/changelog | 3 +++ 1 file changed, 3 insertions(+) (limited to 'doc') diff --git a/doc/george/changelog b/doc/george/changelog index 2442061..5d35355 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -7,6 +7,9 @@ * changes to this system * ****************************************************************************** +2008-06-18 - jrollins + * installed less, emacs; + * aptitude update && aptitude dist-upgrade 2008-06-18 - micah * debootstrap'd debian etch install -- cgit v1.2.3