<TMPL_VAR TITLE>

Date: Mon, 1 Sep 2008 23:08:53 -0400 Subject: unhide standared ikiwiki header and actions. --- website/local.css | 8 -------- 1 file changed, 8 deletions(-) (limited to 'website') diff --git a/website/local.css b/website/local.css index 11b6caf..6e8756d 100644 --- a/website/local.css +++ b/website/local.css @@ -58,11 +58,3 @@ table.sitenav img.logo { vertical-align: bottom; } - -div.header { - display: none; - } - -div.actions { - display: none; - } -- cgit v1.2.3 From 36c9dcc53edb5a202151ee5dcea641eb51368d55 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Mon, 1 Sep 2008 23:11:45 -0400 Subject: cleaning up page.tmpl. --- website/templates/page.tmpl | 3 --- 1 file changed, 3 deletions(-) (limited to 'website') diff --git a/website/templates/page.tmpl b/website/templates/page.tmpl index 8265f93..62da352 100644 --- a/website/templates/page.tmpl +++ b/website/templates/page.tmpl @@ -17,9 +17,6 @@ - - -

-- cgit v1.2.3 From 34f03fb0dd437bbed1c0b94aa9430131583183c4 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:00:24 -0400 Subject: more tweaks to nav to match the suggested design. --- website/templates/page.tmpl | 121 -------------------------------------------- 1 file changed, 121 deletions(-) delete mode 100644 website/templates/page.tmpl (limited to 'website') diff --git a/website/templates/page.tmpl b/website/templates/page.tmpl deleted file mode 100644 index 62da352..0000000 --- a/website/templates/page.tmpl +++ /dev/null @@ -1,121 +0,0 @@ - - - - -<TMPL_VAR TITLE> - - - - - - - - - - - - - - - -

monkeys!

- - -

- - - - - - -

- -

- - - - - -- cgit v1.2.3 From 878d43b2fc5f56644bbb6052a39177282099ea62 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:01:51 -0400 Subject: more tweaks to nav to match the suggested design. --- website/local.css | 1 + website/templates/nav.mdwn | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) (limited to 'website') diff --git a/website/local.css b/website/local.css index 6e8756d..5764265 100644 --- a/website/local.css +++ b/website/local.css @@ -50,6 +50,7 @@ table.sitenav { border-bottom: 2px solid black; padding: 0px; width: 100%; + font-size: larger; } table.sitenav img.logo { diff --git a/website/templates/nav.mdwn b/website/templates/nav.mdwn index c8babb5..0caec59 100644 --- a/website/templates/nav.mdwn +++ b/website/templates/nav.mdwn @@ -2,5 +2,5 @@

-[[why?|why]] | [[download]] | [[documentation|doc]] | [[news]] | [[community]] | [[bugs]] +[[WHY?|why]] | [[DOWNLOAD|download]] | [[DOCUMENTATION|doc]] | [[NEWS|news]] | [[COMMUNITY|community]] | [[BUGS|bugs]] -- cgit v1.2.3 From 3e5217b420f8fe6efac3c7e96f6cd82394541465 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:03:50 -0400 Subject: switched nav to list for easier manipulation via CSS. --- website/local.css | 6 +++++- website/templates/nav.mdwn | 7 ++++++- 2 files changed, 11 insertions(+), 2 deletions(-) (limited to 'website') diff --git a/website/local.css b/website/local.css index 5764265..19b05f2 100644 --- a/website/local.css +++ b/website/local.css @@ -50,7 +50,6 @@ table.sitenav { border-bottom: 2px solid black; padding: 0px; width: 100%; - font-size: larger; } table.sitenav img.logo { @@ -59,3 +58,8 @@ table.sitenav img.logo { vertical-align: bottom; } +table.sitenav li { + display: inline; + margin: 1em; + font-size: larger; +} diff --git a/website/templates/nav.mdwn b/website/templates/nav.mdwn index 0caec59..0345919 100644 --- a/website/templates/nav.mdwn +++ b/website/templates/nav.mdwn @@ -2,5 +2,10 @@

+ * [[WHY?|why]] * [[DOWNLOAD|download]] * [[DOCUMENTATION|doc]] * [[NEWS|news]] * [[COMMUNITY|community]] * [[BUGS|bugs]] + -- cgit v1.2.3 From 6df368aae1e2d929a7c91b72de0d79c875701b63 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:06:51 -0400 Subject: still trying to switch to list items. --- website/templates/nav.mdwn | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'website') diff --git a/website/templates/nav.mdwn b/website/templates/nav.mdwn index 4664680..e61a84b 100644 --- a/website/templates/nav.mdwn +++ b/website/templates/nav.mdwn @@ -3,11 +3,11 @@

-* [[WHY?|why]] -* [[DOWNLOAD|download]] -* [[DOCUMENTATION|doc]] -* [[NEWS|news]] -* [[COMMUNITY|community]] -* [[BUGS|bugs]] + + [[WHY?|why]] + + [[DOWNLOAD|download]] + + [[DOCUMENTATION|doc]] + + [[NEWS|news]] + + [[COMMUNITY|community]] + + [[BUGS|bugs]] -- cgit v1.2.3 From 0868e442ce10e983db2401c07011ea456e8f4a52 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:09:06 -0400 Subject: reverting to regular text in nav, since list items do not show up as expected in markdown. --- website/local.css | 6 +----- website/templates/nav.mdwn | 12 ++++++------ 2 files changed, 7 insertions(+), 11 deletions(-) (limited to 'website') diff --git a/website/local.css b/website/local.css index 19b05f2..5764265 100644 --- a/website/local.css +++ b/website/local.css @@ -50,6 +50,7 @@ table.sitenav { border-bottom: 2px solid black; padding: 0px; width: 100%; + font-size: larger; } table.sitenav img.logo { @@ -58,8 +59,3 @@ table.sitenav img.logo { vertical-align: bottom; } -table.sitenav li { - display: inline; - margin: 1em; - font-size: larger; -} diff --git a/website/templates/nav.mdwn b/website/templates/nav.mdwn index e61a84b..33ab8ce 100644 --- a/website/templates/nav.mdwn +++ b/website/templates/nav.mdwn @@ -3,11 +3,11 @@

- + [[WHY?|why]] - + [[DOWNLOAD|download]] - + [[DOCUMENTATION|doc]] - + [[NEWS|news]] - + [[COMMUNITY|community]] - + [[BUGS|bugs]] +[[WHY?|why]] +[[DOWNLOAD|download]] +[[DOCUMENTATION|doc]] +[[NEWS|news]] +[[COMMUNITY|community]] +[[BUGS|bugs]] -- cgit v1.2.3 From b51aef93f969d302a25aff3a734079d91887ac5b Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:14:17 -0400 Subject: bolding links in header, and removing underlines from them to match proposed site design. --- website/local.css | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'website') diff --git a/website/local.css b/website/local.css index 5764265..04f336c 100644 --- a/website/local.css +++ b/website/local.css @@ -59,3 +59,12 @@ table.sitenav img.logo { vertical-align: bottom; } +table.sitenav a { + font-weight: bold; + text-decoration: none; +} + +table.sitenav a:hover { + font-weight: bold; + text-decoration: underline; +} -- cgit v1.2.3 From 6d416661c4bfd02f8f4bbb1d9d990e7e9bf38827 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:15:48 -0400 Subject: increasing gap between header links. --- website/local.css | 1 + 1 file changed, 1 insertion(+) (limited to 'website') diff --git a/website/local.css b/website/local.css index 04f336c..0cebb50 100644 --- a/website/local.css +++ b/website/local.css @@ -62,6 +62,7 @@ table.sitenav img.logo { table.sitenav a { font-weight: bold; text-decoration: none; + margin-left: 1em; } table.sitenav a:hover { -- cgit v1.2.3 From b31345332bd3b1581ae46facd6343fe4946ae1b0 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:17:08 -0400 Subject: making navigation header links behave sanely when selected. --- website/local.css | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'website') diff --git a/website/local.css b/website/local.css index 0cebb50..c398155 100644 --- a/website/local.css +++ b/website/local.css @@ -65,6 +65,12 @@ table.sitenav a { margin-left: 1em; } +table.sitenav span.selflink { + font-weight: bold; + text-decoration: underline; + margin-left: 1em; +} + table.sitenav a:hover { font-weight: bold; text-decoration: underline; -- cgit v1.2.3 From 112ab1ba206dbfc3a4d983ec798000da9699f7b6 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:18:38 -0400 Subject: nav header links margin is on right instead of left to keep image in the correct spot. --- website/local.css | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'website') diff --git a/website/local.css b/website/local.css index c398155..878cd11 100644 --- a/website/local.css +++ b/website/local.css @@ -62,13 +62,13 @@ table.sitenav img.logo { table.sitenav a { font-weight: bold; text-decoration: none; - margin-left: 1em; + margin-right: 1em; } table.sitenav span.selflink { font-weight: bold; text-decoration: underline; - margin-left: 1em; + margin-right: 1em; } table.sitenav a:hover { -- cgit v1.2.3 From 48f308ae5221270ccb96e0e9c8cf797dd67c7a3b Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:21:29 -0400 Subject: switching ikiwiki default headers to the right-hand side of the page. --- website/local.css | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'website') diff --git a/website/local.css b/website/local.css index 878cd11..1e9f2df 100644 --- a/website/local.css +++ b/website/local.css @@ -75,3 +75,11 @@ table.sitenav a:hover { font-weight: bold; text-decoration: underline; } + +div.header { + text-align: right; +} + +div.actions { + text-align: right; +} -- cgit v1.2.3 From 9b15338ec99c620a248950f1cf6e51c0a463f071 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:23:57 -0400 Subject: reorganize headers on documentation page, try out table of contents plugin. --- website/doc.mdwn | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'website') diff --git a/website/doc.mdwn b/website/doc.mdwn index 6a978ce..a7d2229 100644 --- a/website/doc.mdwn +++ b/website/doc.mdwn @@ -1,7 +1,9 @@ [[!template id="nav"]] [[meta title="Documentation"]] +# Monkeysphere Documentation # +[[!toc]] -# Dependencies # +## Dependencies ## Monkeysphere relies on: @@ -9,19 +11,19 @@ Monkeysphere relies on: * [OpenSSH](http://openssh.com/) * [GnuPG](http://gnupg.org/) -# Getting started # +## Getting started ## * Getting started as a [user](/getting-started-user) * Getting started as a [server admin](/getting-started-admin) -# References # +## References ## * [Initial specifications at CMRG](http://cmrg.fifthhorseman.net/wiki/OpenPGPandSSH) * [OpenPGP (RFC 4880)](http://tools.ietf.org/html/rfc4880) * [Secure Shell Authentication Protocol (RFC 4252)](http://tools.ietf.org/html/rfc4252) * [URI scheme for SSH, RFC draft](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/) -# Similar Projects # +## Similar Projects ## The monkeysphere isn't the only project intending to implement a PKI for OpenSSH. We provide links to these other projects because they're -- cgit v1.2.3 From 4a1cca41252e9b3ff54dc1a1a5aa05ab2ce06878 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:26:03 -0400 Subject: fix usage of table of contents plugin. --- website/doc.mdwn | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'website') diff --git a/website/doc.mdwn b/website/doc.mdwn index a7d2229..da955ac 100644 --- a/website/doc.mdwn +++ b/website/doc.mdwn @@ -1,7 +1,7 @@ [[!template id="nav"]] [[meta title="Documentation"]] # Monkeysphere Documentation # -[[!toc]] +[[toc ]] ## Dependencies ## -- cgit v1.2.3 From 640c122ce3bbd25139fb39cdd1312ac4c842665f Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:29:30 -0400 Subject: broke out similar projects to separate page. --- website/doc.mdwn | 124 +-------------------------------------------------- website/similar.mdwn | 121 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 123 insertions(+), 122 deletions(-) create mode 100644 website/similar.mdwn (limited to 'website') diff --git a/website/doc.mdwn b/website/doc.mdwn index da955ac..cec29ec 100644 --- a/website/doc.mdwn +++ b/website/doc.mdwn @@ -1,8 +1,5 @@ [[!template id="nav"]] [[meta title="Documentation"]] -# Monkeysphere Documentation # -[[toc ]] - ## Dependencies ## Monkeysphere relies on: @@ -23,123 +20,6 @@ Monkeysphere relies on: * [Secure Shell Authentication Protocol (RFC 4252)](http://tools.ietf.org/html/rfc4252) * [URI scheme for SSH, RFC draft](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/) -## Similar Projects ## - -The monkeysphere isn't the only project intending to implement a PKI -for OpenSSH. We provide links to these other projects because they're -interesting, though we have concerns with their approaches. - -All of the other projects we've found so far require a patched version -of OpenSSH, which makes adoption more difficult. Most people don't -build their own software, and simply overlaying a patched binary is -associated with significant maintenance (and therefore security) -problems. - -While ultimately contributing a patch to -[OpenSSH](http://openssh.com/) (or any -[free](http://www.chiark.greenend.org.uk/~sgtatham/putty/) -[SSH](http://www.lysator.liu.se/~nisse/lsh/) -[implementation](http://matt.ucc.asn.au/dropbear/dropbear.html)) is -not a bad thing, we hope to be able to better establish the use of a -PKI without resorting to source modification. - -### openssh-gpg ### - -[openssh-gpg](http://www.red-bean.com/~nemo/openssh-gpg/) is a patch -against OpenSSH to support OpenPGP certificates. According to its -documentation, it is intended to support [`pgp-sign-rsa` and -`pgp-sign-dss` public key algorithms for hosts, as specified by the -IETF](http://tools.ietf.org/html/rfc4253#section-6.6). - -Some concerns with `openssh-gpg`: - - * This patch is old; it doesn't appear to have been maintained beyond - OpenSSH 3.6p1. As of this writing, OpenSSH 5.1p1 is current. - - * It only provides infrastructure in one direction: the user - authenticating the host by name. There doesn't seem to be a - mechanism for dealing with identifying users by name, or allowing - users to globally revoke or update keys. - - * The choice of User ID (`anything goes here (and here!) - `) for host keys overlaps with the current use - of the User ID space. While it's unlikely that someone actually - uses this e-mail address in the web of trust, it would be a nasty - collision, as the holder of that key could impersonate the server - in question. The monkeysphere uses [User IDs of the form - `ssh://foo.example.net`](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/) - to avoid collisions with existing use. - - * It's not clear that `openssh-gpg` acknowledges or respects the - [usage flags](http://tools.ietf.org/html/rfc4880#section-5.2.3.21) - on the host keys. This means that it could accept a "sign-only" - key as suitable for authenticating a host, despite the - clearly-marked intentions of the key-holder. - -### Perspectives OpenSSH client ### - -[The Perspectives project](http://www.cs.cmu.edu/~perspectives/) at -CMU has released an [openssh client that uses network -notaries](http://www.cs.cmu.edu/~perspectives/openssh.html) to bolster -your confidence in newly-seen keys. This offers a defense against a -narrow MITM attack (e.g. by someone who controls your local gateway) -by simply verifying that other machines from around the network see -the same keys for the remote host that you're seeing. - -This tactic is quite useful, but doesn't take the system as far as it -could go, and doesn't tie into any existing web of trust. - -Some concerns with the Perspectives OpenSSH client: - - * This client won't help if you are connecting to machines behind - firewalls, on NAT'ed LANs, with source IP filtering, or otherwise - in a restricted network state. - - * There is still a question of why you should trust these particular - notaries during your verification. Who are the notaries? How - could they be compromised? - - * It only provides infrastructure in one direction: the user - authenticating the host by name. There is no mechanism for dealing - with identifying users by name, or allowing users to globally - revoke or change keys. - - * It doesn't provide any mechanism for key rotation or revocation: - Perspectives won't help you if you need to re-key your machine. - -### OpenSSH with X.509v3 certificates ### - -Roumen Petrov [maintains a patch to OpenSSH that works with the X.509 -PKI model](http://www.roumenpetrov.info/openssh/). This is the -certificate hierarchy commonly used by TLS (and SSL). - -Some concerns about OpenSSH with X.509v3: - - * the X.509 certificate specification itself [encourages corporate - consolidation and centralized global "trust" because of its - single-issuer architectural - limitation](http://lair.fifthhorseman.net/~dkg/tls-centralization/). - This results in an expensive and cumbersome system for smaller - players, and it also doesn't correspond to the true distributed - nature of human-to-human trust. Furthermore, centralized global - "trusted authorities" create a tempting target for attack, and a - single-point-of-failure if an attack is successful. - - Depending on how you declare your trust relationships, OpenPGP is - capable of providing the same hierarchical structure as X.509, but - it is not limited to such a structure. The OpenPGP Web of Trust - model is more flexible and more adaptable to represent real-world - trust than X.509's rigid hierarchy. - - * X.509 certificates can identify hosts by name, but not by - individual service. This means that a compromised web or e-mail - server with access to the X.509 key for that service could re-use - its certificate as an SSH server, and it would be able to - masquerade successfully. +## Other ## - The monkeysphere uses [User IDs of the form - `ssh://foo.example.net`](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/), - so they are not by-default shared across services on the same host - (you can still share a key across services on the same host if you - like, but the service User IDs can be certified independently of - one another). + * [Similar Projects](/similar) diff --git a/website/similar.mdwn b/website/similar.mdwn new file mode 100644 index 0000000..5bfd4b2 --- /dev/null +++ b/website/similar.mdwn @@ -0,0 +1,121 @@ +[[!template id="nav"]] +[[meta title="Similar Projects"]] + +The monkeysphere isn't the only project intending to implement a PKI +for OpenSSH. We provide links to these other projects because they're +interesting, though we have concerns with their approaches. + +All of the other projects we've found so far require a patched version +of OpenSSH, which makes adoption more difficult. Most people don't +build their own software, and simply overlaying a patched binary is +associated with significant maintenance (and therefore security) +problems. + +While ultimately contributing a patch to +[OpenSSH](http://openssh.com/) (or any +[free](http://www.chiark.greenend.org.uk/~sgtatham/putty/) +[SSH](http://www.lysator.liu.se/~nisse/lsh/) +[implementation](http://matt.ucc.asn.au/dropbear/dropbear.html)) is +not a bad thing, we hope to be able to better establish the use of a +PKI without resorting to source modification. + +## openssh-gpg ## + +[openssh-gpg](http://www.red-bean.com/~nemo/openssh-gpg/) is a patch +against OpenSSH to support OpenPGP certificates. According to its +documentation, it is intended to support [`pgp-sign-rsa` and +`pgp-sign-dss` public key algorithms for hosts, as specified by the +IETF](http://tools.ietf.org/html/rfc4253#section-6.6). + +Some concerns with `openssh-gpg`: + + * This patch is old; it doesn't appear to have been maintained beyond + OpenSSH 3.6p1. As of this writing, OpenSSH 5.1p1 is current. + + * It only provides infrastructure in one direction: the user + authenticating the host by name. There doesn't seem to be a + mechanism for dealing with identifying users by name, or allowing + users to globally revoke or update keys. + + * The choice of User ID (`anything goes here (and here!) + `) for host keys overlaps with the current use + of the User ID space. While it's unlikely that someone actually + uses this e-mail address in the web of trust, it would be a nasty + collision, as the holder of that key could impersonate the server + in question. The monkeysphere uses [User IDs of the form + `ssh://foo.example.net`](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/) + to avoid collisions with existing use. + + * It's not clear that `openssh-gpg` acknowledges or respects the + [usage flags](http://tools.ietf.org/html/rfc4880#section-5.2.3.21) + on the host keys. This means that it could accept a "sign-only" + key as suitable for authenticating a host, despite the + clearly-marked intentions of the key-holder. + +## Perspectives OpenSSH client ## + +[The Perspectives project](http://www.cs.cmu.edu/~perspectives/) at +CMU has released an [openssh client that uses network +notaries](http://www.cs.cmu.edu/~perspectives/openssh.html) to bolster +your confidence in newly-seen keys. This offers a defense against a +narrow MITM attack (e.g. by someone who controls your local gateway) +by simply verifying that other machines from around the network see +the same keys for the remote host that you're seeing. + +This tactic is quite useful, but doesn't take the system as far as it +could go, and doesn't tie into any existing web of trust. + +Some concerns with the Perspectives OpenSSH client: + + * This client won't help if you are connecting to machines behind + firewalls, on NAT'ed LANs, with source IP filtering, or otherwise + in a restricted network state. + + * There is still a question of why you should trust these particular + notaries during your verification. Who are the notaries? How + could they be compromised? + + * It only provides infrastructure in one direction: the user + authenticating the host by name. There is no mechanism for dealing + with identifying users by name, or allowing users to globally + revoke or change keys. + + * It doesn't provide any mechanism for key rotation or revocation: + Perspectives won't help you if you need to re-key your machine. + +## OpenSSH with X.509v3 certificates ## + +Roumen Petrov [maintains a patch to OpenSSH that works with the X.509 +PKI model](http://www.roumenpetrov.info/openssh/). This is the +certificate hierarchy commonly used by TLS (and SSL). + +Some concerns about OpenSSH with X.509v3: + + * the X.509 certificate specification itself [encourages corporate + consolidation and centralized global "trust" because of its + single-issuer architectural + limitation](http://lair.fifthhorseman.net/~dkg/tls-centralization/). + This results in an expensive and cumbersome system for smaller + players, and it also doesn't correspond to the true distributed + nature of human-to-human trust. Furthermore, centralized global + "trusted authorities" create a tempting target for attack, and a + single-point-of-failure if an attack is successful. + + Depending on how you declare your trust relationships, OpenPGP is + capable of providing the same hierarchical structure as X.509, but + it is not limited to such a structure. The OpenPGP Web of Trust + model is more flexible and more adaptable to represent real-world + trust than X.509's rigid hierarchy. + + * X.509 certificates can identify hosts by name, but not by + individual service. This means that a compromised web or e-mail + server with access to the X.509 key for that service could re-use + its certificate as an SSH server, and it would be able to + masquerade successfully. + + The monkeysphere uses [User IDs of the form + `ssh://foo.example.net`](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/), + so they are not by-default shared across services on the same host + (you can still share a key across services on the same host if you + like, but the service User IDs can be certified independently of + one another). -- cgit v1.2.3 From 7dfc00c5e8f11b0513d6d842196c6f43046f5309 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:30:52 -0400 Subject: more documentation cleanup. --- website/doc.mdwn | 2 +- website/similar.mdwn | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) (limited to 'website') diff --git a/website/doc.mdwn b/website/doc.mdwn index cec29ec..e3f8854 100644 --- a/website/doc.mdwn +++ b/website/doc.mdwn @@ -22,4 +22,4 @@ Monkeysphere relies on: ## Other ## - * [Similar Projects](/similar) + * [Similar Projects](/similar) (other attempts at a PKI for SSH) diff --git a/website/similar.mdwn b/website/similar.mdwn index 5bfd4b2..1a33b06 100644 --- a/website/similar.mdwn +++ b/website/similar.mdwn @@ -5,6 +5,8 @@ The monkeysphere isn't the only project intending to implement a PKI for OpenSSH. We provide links to these other projects because they're interesting, though we have concerns with their approaches. +[[toc ]] + All of the other projects we've found so far require a patched version of OpenSSH, which makes adoption more difficult. Most people don't build their own software, and simply overlaying a patched binary is -- cgit v1.2.3 From 24b310edc96870d0bdde4c80ff8e4b75146a5943 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:40:11 -0400 Subject: standardizing on h2 as the section header across web site documentation. --- website/community.mdwn | 8 ++++---- website/download.mdwn | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) (limited to 'website') diff --git a/website/community.mdwn b/website/community.mdwn index f2c5fc7..4cbd9cd 100644 --- a/website/community.mdwn +++ b/website/community.mdwn @@ -2,7 +2,7 @@ [[meta title="Monkeysphere community"]] -# Mailing list # +## Mailing list ## The Monkeysphere project is a new project with just one mailing list at the moment. Its where we roll our sphere, discuss development @@ -14,7 +14,7 @@ friendly bunch. You can also [look through our archives](https://lists.riseup.net/www/arc/monkeysphere) if you don't believe us. -# Development # +## Development ## The Monkeysphere uses a distributed development model with [git](http://git.or.cz/). Once you've [installed @@ -24,7 +24,7 @@ from this web site: git clone git://monkeysphere.info/monkeysphere -## Individual developer repositories ## +### Individual developer repositories ### You might also be interested in the repositories of individual developers, which may contain branches or features not yet in the main @@ -43,7 +43,7 @@ Micah Anderson git clone git://labs.riseup.net/~micah/monkeysphere -# Contact # +## Contact ## Please feel free to contact any of the Monkeysphere developers or post to the mailing list with questions, comments, bug reports, requests, diff --git a/website/download.mdwn b/website/download.mdwn index b503c03..9986a04 100644 --- a/website/download.mdwn +++ b/website/download.mdwn @@ -23,7 +23,7 @@ Once you've installed the packages, you might want to read up on how to get started [as a regular user](/getting-started-user) or [as a systems administrator](/getting-started-admin). -### Enhancements ### +## Enhancements ## As of 2008-08-22, If you run debian lenny you're very close to being able to run a fully monkeysphere-enabled system. One gap in the -- cgit v1.2.3 From 42f95c0cc0fb52f3711278c3846373044d9da085 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:43:41 -0400 Subject: linking to getting started docs from why page; set up TOC on why page. --- website/why.mdwn | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'website') diff --git a/website/why.mdwn b/website/why.mdwn index 989c4eb..b77a9a8 100644 --- a/website/why.mdwn +++ b/website/why.mdwn @@ -2,7 +2,7 @@ [[meta title="Why should you be interested in the MonkeySphere?"]] -# Why should you be interested in the MonkeySphere? # +[[toc ]] ## As an `ssh` user ## @@ -31,6 +31,8 @@ Have you ever wished you could phase out an old key and start using a new one without having to comb through every single account you have ever connected to? +[Get started with the monkeysphere as a user](getting-started-user)! + ## As an system administrator ## As a system administrator, have you ever tried to re-key an SSH @@ -45,6 +47,8 @@ Have you ever wanted to be able to add or revoke the ability of a user's key to authenticate across an entire infrastructure you manage, without touching each host by hand? +[Get started with the monkeysphere as an administrator](getting-started-admin)! + ## What's the connection? ## All of these issues are related to a lack of a [Public Key -- cgit v1.2.3 From c4b1ec9c747de38b7492577a3f52fbf14ad054af Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:45:01 -0400 Subject: fixing broken links in why page. --- website/why.mdwn | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'website') diff --git a/website/why.mdwn b/website/why.mdwn index b77a9a8..5dc0e05 100644 --- a/website/why.mdwn +++ b/website/why.mdwn @@ -31,7 +31,7 @@ Have you ever wished you could phase out an old key and start using a new one without having to comb through every single account you have ever connected to? -[Get started with the monkeysphere as a user](getting-started-user)! +[Get started with the monkeysphere as a user!](/getting-started-user) ## As an system administrator ## @@ -47,7 +47,7 @@ Have you ever wanted to be able to add or revoke the ability of a user's key to authenticate across an entire infrastructure you manage, without touching each host by hand? -[Get started with the monkeysphere as an administrator](getting-started-admin)! +[Get started with the monkeysphere as an administrator!](/getting-started-admin) ## What's the connection? ## -- cgit v1.2.3 From e6d6c460cbe45ef8e87020bc775772cb71a5b861 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 00:59:16 -0400 Subject: moved all apt repository references to archive.monkeysphere.info. --- doc/george/changelog | 5 +++++ website/download.mdwn | 8 ++++---- website/getting-started-user.mdwn | 4 ++-- website/news/apt-repo-moved.mdwn | 8 ++++++++ website/news/modified-gnutls-2.4.x-available.mdwn | 4 ++-- 5 files changed, 21 insertions(+), 8 deletions(-) create mode 100644 website/news/apt-repo-moved.mdwn (limited to 'website') diff --git a/doc/george/changelog b/doc/george/changelog index fcd5a12..1ed81d4 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -7,6 +7,11 @@ * changes to this system (first command at top, last at bottom) * ****************************************************************************** +2008-09-01 - dkg + * set up http://dkg.monkeysphere.info so that i could play around + with ikiwiki updates + * moved apt repository over to http://archive.monkeysphere.info/ + 2008-08-26 - dkg * aptitude update && aptitude full-upgrade * added account 'daniel' for Dan Scott, and set him up with a way diff --git a/website/download.mdwn b/website/download.mdwn index 9986a04..b64711d 100644 --- a/website/download.mdwn +++ b/website/download.mdwn @@ -8,8 +8,8 @@ by following these directions: You can add this repo to your system by putting the following lines in /etc/apt/sources.list.d/monkeysphere.list: - deb http://monkeysphere.info/debian experimental monkeysphere - deb-src http://monkeysphere.info/debian experimental monkeysphere + deb http://archive.monkeysphere.info/debian experimental monkeysphere + deb-src http://archive.monkeysphere.info/debian experimental monkeysphere The repository is currently signed by [Daniel Kahn Gillmor's OpenPGP key](http://fifthhorseman.net/dkg.gpg "dkg's key"), key id D21739E9 @@ -34,7 +34,7 @@ You can install a patched version of GnuTLS to enable this feature of the MonkeySphere by adjusting the monkeysphere `sources.list` lines to include the `gnutls` component. So they'd look like this instead: - deb http://monkeysphere.info/debian experimental monkeysphere gnutls - deb-src http://monkeysphere.info/debian experimental monkeysphere gnutls + deb http://archive.monkeysphere.info/debian experimental monkeysphere gnutls + deb-src http://archive.monkeysphere.info/debian experimental monkeysphere gnutls You can [read more about this offering](/news/modified-gnutls-2.4.x-available). diff --git a/website/getting-started-user.mdwn b/website/getting-started-user.mdwn index 5cb96b9..3f7b689 100644 --- a/website/getting-started-user.mdwn +++ b/website/getting-started-user.mdwn @@ -92,8 +92,8 @@ to take this step, you will need to upgrade to a patched version of gnutls. You can easily upgrade a Debian system by adding the following to `/etc/apt/sources.list.d/monkeysphere.list`: - deb http://monkeysphere.info/debian experimental gnutls - deb-src http://monkeysphere.info/debian experimental gnutls + deb http://archive.monkeysphere.info/debian experimental gnutls + deb-src http://archive.monkeysphere.info/debian experimental gnutls Next, run `aptitude update; aptitude install libgnutls26`. diff --git a/website/news/apt-repo-moved.mdwn b/website/news/apt-repo-moved.mdwn new file mode 100644 index 0000000..8f0bf81 --- /dev/null +++ b/website/news/apt-repo-moved.mdwn @@ -0,0 +1,8 @@ +[[meta title="APT repository moved"]] + +The monkeysphere APT repository has been moved from +`http://monkeysphere.info/debian` to +`http://archive.monkeysphere.info/debian`. You'll probably want to +update your `sources.list` to match the [official lines](/download). + +Apologies for any confusion or hassle this causes! diff --git a/website/news/modified-gnutls-2.4.x-available.mdwn b/website/news/modified-gnutls-2.4.x-available.mdwn index b3db308..44e08d0 100644 --- a/website/news/modified-gnutls-2.4.x-available.mdwn +++ b/website/news/modified-gnutls-2.4.x-available.mdwn @@ -9,8 +9,8 @@ circumstances. You can track this package in debian lenny by adding the following lines to `/etc/apt/sources.list`: - deb http://monkeysphere.info/debian experimental gnutls - deb-src http://monkeysphere.info/debian experimental gnutls + deb http://archive.monkeysphere.info/debian experimental gnutls + deb-src http://archive.monkeysphere.info/debian experimental gnutls Or you can patch and build the packages yourself with the patches and scripts provided in [the MonkeySphere git repo](/download). -- cgit v1.2.3 From 76e67ee7418efcb51788e5577f3f09d28c02709a Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 01:05:33 -0400 Subject: more updates as i pursue service-specific hostnames. --- debian/changelog | 2 ++ debian/control | 4 ++-- doc/george/changelog | 1 + website/community.mdwn | 2 +- 4 files changed, 6 insertions(+), 3 deletions(-) (limited to 'website') diff --git a/debian/changelog b/debian/changelog index 9a46d9e..76e4d04 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,8 @@ monkeysphere (0.12-1) UNRELEASED; urgency=low * Improved output handling. + * debian/control: switched Homepage: and Vcs-Git: to canonicalized + upstream hostnames. -- Jameson Graef Rollins Sun, 24 Aug 2008 23:49:23 -0700 diff --git a/debian/control b/debian/control index 2984464..ca07a5d 100644 --- a/debian/control +++ b/debian/control @@ -5,8 +5,8 @@ Maintainer: Daniel Kahn Gillmor Uploaders: Jameson Rollins Build-Depends: debhelper (>= 7.0), libgnutls-dev (>= 2.4.0), git-core Standards-Version: 3.8.0.1 -Homepage: http://monkeysphere.info/ -Vcs-Git: git://monkeysphere.info/monkeysphere +Homepage: http://web.monkeysphere.info/ +Vcs-Git: git://git.monkeysphere.info/monkeysphere Dm-Upload-Allowed: yes Format: 3.0 (git) diff --git a/doc/george/changelog b/doc/george/changelog index 1ed81d4..5c2f010 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -11,6 +11,7 @@ * set up http://dkg.monkeysphere.info so that i could play around with ikiwiki updates * moved apt repository over to http://archive.monkeysphere.info/ + * aptitude update && aptitude dist-upgrade 2008-08-26 - dkg * aptitude update && aptitude full-upgrade diff --git a/website/community.mdwn b/website/community.mdwn index 4cbd9cd..c878fc2 100644 --- a/website/community.mdwn +++ b/website/community.mdwn @@ -22,7 +22,7 @@ git](http://www.spheredev.org/wiki/Git_for_the_lazy), you can [git clone](http://www.kernel.org/pub/software/scm/git/docs/git-clone.html) from this web site: - git clone git://monkeysphere.info/monkeysphere + git clone git://git.monkeysphere.info/monkeysphere ### Individual developer repositories ### -- cgit v1.2.3 From e2e87dd0cba22432aa16151bafe5db0b145a3478 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 01:12:52 -0400 Subject: completing the service-specific hostname canonicalization (i think). --- doc/announcement.html | 13 ++++++++----- doc/george/changelog | 2 ++ src/monkeysphere-server | 2 +- website/bugs/add-man-pages-to-website.mdwn | 2 +- 4 files changed, 12 insertions(+), 7 deletions(-) (limited to 'website') diff --git a/doc/announcement.html b/doc/announcement.html index 1787142..68607ac 100644 --- a/doc/announcement.html +++ b/doc/announcement.html @@ -30,8 +30,8 @@ key) across a group of machines by disabling authentication for that user?

A group of us have been working on a public key infrastructure for -SSH. Monkeysphere makes use of -the existing OpenPGP web-of-trust to fetch and cryptographically +SSH. Monkeysphere makes use +of the existing OpenPGP web-of-trust to fetch and cryptographically validate (and revoke!) keys. This works in either directions: both authorized_keys and known_hosts are handled. Monkeysphere gives users and admins tools to deal with SSH @@ -39,14 +39,17 @@ keys by thinking about the people and machines to whom the keys belong, instead of requiring humans to do tedious (and error-prone) manual key verification.

We have debian packages +

We have debian packages available which should install against lenny, a mailing list, and open ears for good questions, suggestions and criticism.

If you have a chance to give it a try (as a user -or as an admin), it would be great to If you have a chance to give it a try (as a +user or as an +admin), it would be great to get feedback.

diff --git a/doc/george/changelog b/doc/george/changelog index 5c2f010..8b03a7f 100644 --- a/doc/george/changelog +++ b/doc/george/changelog @@ -12,6 +12,8 @@ with ikiwiki updates * moved apt repository over to http://archive.monkeysphere.info/ * aptitude update && aptitude dist-upgrade + * canonicalizing hostname for normal web access to + http://web.monkeysphere.info 2008-08-26 - dkg * aptitude update && aptitude full-upgrade diff --git a/src/monkeysphere-server b/src/monkeysphere-server index 4c8ecdc..2966f7c 100755 --- a/src/monkeysphere-server +++ b/src/monkeysphere-server @@ -469,7 +469,7 @@ revoke_hostname() { echo "WARNING: There is a known bug in this function." echo "This function has been known to occasionally revoke the wrong user ID." echo "Please see the following bug report for more information:" - echo "http://monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/" + echo "http://web.monkeysphere.info/bugs/revoke-hostname-revoking-wrong-userid/" read -p "Are you sure you would like to proceed? (y/N) " OK; OK=${OK:=N} if [ ${OK/y/Y} != 'Y' ] ; then failure "aborting." diff --git a/website/bugs/add-man-pages-to-website.mdwn b/website/bugs/add-man-pages-to-website.mdwn index 4a8d2e2..399438a 100644 --- a/website/bugs/add-man-pages-to-website.mdwn +++ b/website/bugs/add-man-pages-to-website.mdwn @@ -1,7 +1,7 @@ [[meta title="Add man pages to web site"]] We should publish the various monkeysphere man pages in browsable form -somewhere under http://monkeysphere.info/. Ideally, this would be +somewhere under http://web.monkeysphere.info/. Ideally, this would be updated automatically from the sources for the official man pages themselves. -- cgit v1.2.3 From 34029d16ecb6a369a590c3d452938f211477ddff Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 01:17:51 -0400 Subject: documenting the change for the git repository. --- website/news/git-repo-moved.mdwn | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 website/news/git-repo-moved.mdwn (limited to 'website') diff --git a/website/news/git-repo-moved.mdwn b/website/news/git-repo-moved.mdwn new file mode 100644 index 0000000..c2755d1 --- /dev/null +++ b/website/news/git-repo-moved.mdwn @@ -0,0 +1,9 @@ +[[meta title="git repository moved"]] + +The monkeysphere git repository has been moved from +`git://monkeysphere.info/monkeysphere` to +`git://git.monkeysphere.info/monkeysphere`. You'll probably want to +update your `.git/config` to match the [official clone +target](/community). + +Apologies for any confusion or hassle this causes! -- cgit v1.2.3 From b03fc4b79643fd5068d12fa66909e9909668f422 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 01:32:17 -0400 Subject: cleaning up titles of web site pages. --- website/bugs.mdwn | 2 +- website/community.mdwn | 2 +- website/news.mdwn | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) (limited to 'website') diff --git a/website/bugs.mdwn b/website/bugs.mdwn index e0fc477..06a4d3a 100644 --- a/website/bugs.mdwn +++ b/website/bugs.mdwn @@ -1,5 +1,5 @@ [[!template id="nav"]] - +[[meta title="Bugs"]] This is Monkeysphere's bug list. You can also browse our [completed bugs](done). If you don't have commit access to the public repo, we'd appreciate diff --git a/website/community.mdwn b/website/community.mdwn index c878fc2..3c6c691 100644 --- a/website/community.mdwn +++ b/website/community.mdwn @@ -1,6 +1,6 @@ [[!template id="nav"]] -[[meta title="Monkeysphere community"]] +[[meta title="Community"]] ## Mailing list ## diff --git a/website/news.mdwn b/website/news.mdwn index 4f8a638..0cf8d10 100644 --- a/website/news.mdwn +++ b/website/news.mdwn @@ -1,5 +1,5 @@ [[!template id="nav"]] - +[[meta title="News]] Here are the latest announcements about the Monkeysphere. [[inline pages="./news/* and !*/Discussion" rootpage="news" show="30"]] -- cgit v1.2.3 From 90568be082e730053e54ecdcd71bf81d719481f8 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 01:34:43 -0400 Subject: simplifying stylesheet, returning underscores to nav links --- website/local.css | 6 ------ 1 file changed, 6 deletions(-) (limited to 'website') diff --git a/website/local.css b/website/local.css index 1e9f2df..b9d7287 100644 --- a/website/local.css +++ b/website/local.css @@ -61,7 +61,6 @@ table.sitenav img.logo { table.sitenav a { font-weight: bold; - text-decoration: none; margin-right: 1em; } @@ -71,11 +70,6 @@ table.sitenav span.selflink { margin-right: 1em; } -table.sitenav a:hover { - font-weight: bold; - text-decoration: underline; -} - div.header { text-align: right; } -- cgit v1.2.3 From 744600b656ea7c772c80ea7ab50514f63bea50a4 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 2 Sep 2008 01:35:32 -0400 Subject: fixed bug in news aggregation page --- website/news.mdwn | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'website') diff --git a/website/news.mdwn b/website/news.mdwn index 0cf8d10..7380eff 100644 --- a/website/news.mdwn +++ b/website/news.mdwn @@ -1,5 +1,5 @@ [[!template id="nav"]] -[[meta title="News]] +[[meta title="News"]] Here are the latest announcements about the Monkeysphere. [[inline pages="./news/* and !*/Discussion" rootpage="news" show="30"]] -- cgit v1.2.3