Subject: IMPORTANT: Mandatory password and ssh key change by 2011-11-30

[Jef Spaleta]

On Fri, Oct 14, 2011 at 8:41 AM, Jeffrey Ollie <jeff at ocjtech.us> wrote:
> I've looked a little at monkeysphere this morning and it looks
> interesting.  It'd be nice if at least the FI folks could publish the
> host keys for the Fedora systems using monkeysphere.  I plan on giving
> monkeysphere a good trial here.  Note that there are a couple of bugs
> currently, but they are fairly easy to work around.

I thought monkeysphere was basically an addon for additional
functionality. I was talking about using gpg-agent to load your
personal keyring on your laptop and generating a gpg subkey from your
private key. Converting that subkey into a ssh key for each system you
remote to.  That way you can revoke/throw away each subkey without
risking your master key and gpg-agent on your local system makes it
easy to load all the keys without a lot of fuss on your part.

Basically what I'm saying is, it looks like Fedora infrastructure
doesn't need to do anything for us to choose to have easier management
of per remote host ssh keys. gpg-agent with gpg subkey usage appears
to be that easier way.  I'm just saying it would be good if Fedora
Intrastructure, as domain experts, provided some best practice
guidance on how to set that up correctly and gave it a thumbs up as a
useful approach.

-jef