- Next-Steps Monkeysphere Projects:
- ---------------------------------
- Detail advantages of monkeysphere: detail the race conditions in ssh,
- and how the monkeysphere can help you reduce these threat vectors:
- threat model reduction diagrams.
- Handle unverified monkeysphere hosts in such a way that they're not
- always removed from known_hosts file. Ask user to lsign the host
- key?
- Work out the details (and describe a full use case) for assigning a
- REVOKER during monkeysphere-server gen_key -- how is this set? How
- do we export it so it's available when a second-party revocation is
- needed?
- Provide a friendly interactive UI for marginal or failing client-side
- hostkey verifications. Handle the common cases smoothly, and
- provide good debugging info for the unusual cases.
- Create ssh2openpgp or convert to full-fledged keytrans.
- Resolve the bugs listed in openpgp2ssh(1):BUGS.
- Understand and document the output of gpg --check-trustdb:
- gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
- gpg: depth: 0 valid: 2 signed: 20 trust: 0-, 0q, 0n, 0m, 0f, 2u
- gpg: depth: 1 valid: 20 signed: 67 trust: 15-, 0q, 1n, 3m, 1f, 0u
- gpg: next trustdb check due at 2008-10-09
- Understand and document the numeric values between sig! and the keyid
- in "gpg --check-sigs $KEYID" . Compare with the details found from
- "gpg --with-colons --check-sigs $KEYID". This has to do with trust
- signatures.
- Fix gpg's documentation to clarify the difference between validity and
- ownertrust. Include better documentation for trust signatures.
- Make it easier to do domain-relative ssh host trust signatures with
- gnupg. (e.g. "i trust Jamie McClelland (keyID 76CC057D) to properly
- identify ssh servers in the mayfirst.org domain") See:
- http://tools.ietf.org/html/rfc4880#section-5.2.3.21 and grep for
- "tsign" in gpg(1).
- Fix the order of questions when user does a tsign in gpg or gpg2.
- File bug against ssh-keygen about how "-R" option removes comments
- from known_hosts file.
- File bug against ssh-keygen to see if we can get it to write to hash a
- known_hosts file to/from stdout/stdin.
- When using ssh-proxycommand, if only host keys found are expired or
- revoked, then output loud warning with prompt, or fail hard.
- File bug against enigmail about lack of ability to create subkeys.
- Test and document what happens when any filesystem that the
- monkeysphere-server relies on and modifies (/tmp, /etc, and /var?)
- fills up.
- Optimize keyserver access, particularly on monkeysphere-server
- update-users -- is there a way to query the keyserver all in a
- chunk?
- Create DSA authentication subkey for server during gen-key
- Fix behavior when add-identity-certifier fails to fetch a key from the
- keyserver.
- Allow server administrators to add-identity-certifier from a key in
- the filesystem (or on stdin, etc)
- Think about packaging monkeysphere for other (non-apt-based) operating
- systems. RPM-based linux systems, FreeBSD ports, and Mac OS X seem
- like the most likely candidates.
|
