[ale] ssh for automated management

[James P. Kinney III]

On Mon, 2004-12-20 at 10:27, Stuffed Crust wrote:
> On Sat, Dec 18, 2004 at 03:28:46PM -0500, James P. Kinney III wrote:
> > ssh keys need to be installed for best security. A single distributed
> > master key and a single distributed slave key, turn off host checking
> > and make key authentication the only method. chroot the rsync servers.
> 
> And what happens when one of these systems is compromised?  You've gotta 
> go change out all of the keys everywhere, and guess what, your whole
> distribution mechanism is compromised.  So much to doing it 
> automatically -- the compromised system will also get the new key.
> 
> Honestly, a system for key distribution is trivial.  When every machine 
> is provisioned (presumably in a controlled environment by a trusted 
> person) its public key gets copied over to the central keyserver.    If 
> a single machine gets it, its corresponding key gets nuked.  
> 
> But if you don't care about unauthorized access to your update server, 
> no big deal, rsync over ssh still secures the transport stream.
> 
> ...straight rsync isn't adequate for anything other than file copies 
> though.  What happens if you need to, say, "run this script on all 
> systems" instead?  That raises a whole new layer of angst.

The rsync is a "pull" from the client system inititated by a cron. There
can be some simple logic in the pull script such as "if (-f post.pl)
{post.pl} and post.pl nukes itself after running.

The keys are _presummed_ safe. Bad form, yes. There are some other
things that can be done to prevent unauth'ed access to updates. md5sum
the previous update pile(s) as a verification that the system doing the
pull has a need, blah, blah, etc...

There is no perfect solution to the remote key problem. Any key stored
can be accessed. The key could be distributed amongst the various files
on the system. Security through obscurity...
> 
>  - Pizza
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part