Mass Password/ssh Key change announcement DRAFT
by Kevin Fenzi
Greetings.
Here's what I have so far on an announcement for the mass password
change/ssh key change. Suggestions for improvement very welcome. In
particular more resources we could point people to, or common questions
you think people will come up with that we could answer would be great.
Also, we need to decide what exactly we do to accounts that fail to
meet the deadline. Are we just marking them inactive? Do we have any
way to force them to change the password and upload a new key if they
reactivate the account?
kevin
--
DRAFT DRAFT DRAFT
Subject: IMPORTANT: Manditory password and ssh key change by 2011-11-30
Summary:
All existing users of the Fedora Account System (FAS) at
https://admin.fedoraproject.org/accounts are required to change their
password and upload a NEW ssh public key by 2011-11-30. Failure to do so
may result in your account being marked inactive.
Backgound and reasoning:
This change event has NOT been triggered by any specific compromise or
vulnerability in Fedora Infrastructure, rather we feel that due to the
large number of high profile sites with security breaches in recent
months that this is a great time for all Fedora contributors and users
to review their security settings and move to "best practices" on their
machines. Additionally, we are putting in place new rules for passwords
to increase their entropy and make them less guessable.
New Password Rules:
* Nine or more characters with lower and upper case letters, digits and
punctuation marks.
* Ten or more characters with lower and upper case letters and digits.
* Twelve or more characters with lower case letters and digits
* Twenty or more characters with all lower case letters.
* No maximum length.
Some Do's and Don'ts:
* NEVER store your ssh private key on a shared or public system.
* ALWAYS use a strong passphrase on your ssh key.
* if you must store passwords, use a application specifically for this
purpose like revelation, gnome-keyring, seahorse, or keepassx.
* Regularly apply your OSes security related updates.
* Only use ssh agent forwarding when needed ( .ssh/config:
"ForwardAgent no")
* DO verify ssh host keys via dnssec protected dns. ( .ssh/config:
"VerifyHostKeyDNS yes")
* DO consider a seperate ssh key for Fedora Infrastructure.
* Work with and use security features like SELinux and iptables.
* Review the Community Standard Infrastructure security document (link
below)
Q&A:
Q: My password and ssh private key are fine and secure! Can't I just
skip this change?
A: No. We very much hope everyone's password and ssh keys are fine, but
we would like everyone to take this chance to review security and
change things. In the event of a triggering event everyone will know
the process.
Q: Can I just change my password and re-upload my same ssh public key?
Or upload a bogus ssh public key and then re-upload my old one?
A: No. We will be checking to ensure that your ssh public key is
different from your old one.
Q: This is a hassle. How often is this going to happen?
A: The last mass password change in Fedora was more than 3 years ago.
Absent a triggering event, these mass changes will be infrequent.
More reading:
http://infrastructure.fedoraproject.org/csi/security-policy/en-US/html-si...
https://fedoraproject.org/wiki/Infrastructure_mass_password_update
12 years, 6 months
Re: [Fedora people] - Public key denied
by Jose Manimala
The output is below,
OpenSSH_5.5p1 Debian-6, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to fedorapeople.org [85.236.55.7] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug3: Not a RSA1 key file /home/jose/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/jose/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/jose/.ssh/id_rsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.5p1 Debian-6
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00(a)openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib(a)openssh.com
debug2: kex_parse_kexinit: none,zlib(a)openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 126/256
debug2: bits set: 504/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: host fedorapeople.org filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: host fedorapeople.org filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 3
debug3: check_host_in_hostfile: host 85.236.55.7 filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: host 85.236.55.7 filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 4
debug1: Host 'fedorapeople.org' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:3
debug2: bits set: 485/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/jose/.ssh/id_rsa (0x7f87ca789e20)
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/jose/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
Thanks,
Jose
Ricky Elrod <codeblock(a)elrod.me> wrote ..
> Can you give us the output of: ssh -vvvvv -i /path/to/your/fedora/id_rsa
> your_username(a)fedorapeople.org
>
> -re
>
> On Fri, Oct 7, 2011 at 12:41 AM, <josemanimala(a)gmail.com> wrote:
>
> > Hello,
> > I tried updating my keys five days ago, and logging into
> > fedora people to update my blog feed as the current one lists the whole blog
> > and has a lot of irrelevant content in it. I get a public key denied message
> > when ever I try to loging to fpeople.o. Can someone help me out with why I
> > cant login. Any help is appreciated.
> >
> > Thank you,
> > Jose
> >
> > _______________________________________________
> > infrastructure mailing list
> > infrastructure(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/infrastructure
> >
12 years, 6 months
[Fedora people] - Public key denied
by Jose Manimala
Hello,
I tried updating my keys five days ago, and logging into fedora people to update my blog feed as the current one lists the whole blog and has a lot of irrelevant content in it. I get a public key denied message when ever I try to loging to fpeople.o. Can someone help me out with why I cant login. Any help is appreciated.
Thank you,
Jose
12 years, 6 months
Plan for tomorrow's Fedora Infrastructure meeting (2011-10-06)
by Kevin Fenzi
The infrastructure team will be having it's weekly meeting tomorrow
2011-09-29 at 1900 UTC in #fedora-meeting on the freenode network.
Suggested topics (suggested by whom):
* New folks introductions and Apprentice tasks.
* Password/Ssh-key/Cert reset flag day discussion.
* Upcoming Tasks/Items (nirik)
? - swap proxy08 in for proxy01.
? - make a new bastion02/nuke bastion04
? - move app02/04
2011-10-09 Remove inactive fi-apprentice people.
2011-10-25 - 2011-11-08: Final change freeze
2011-11-01 mail fi-apprentice folks.
2011-11-08: Fedora 16 release.
* Meeting tagged tickets:
https://fedorahosted.org/fedora-infrastructure/report/10
Submit your agenda items, as tickets in the trac instance and send a
note replying to this thread.
More info here:
https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings
Thanks
kevin
12 years, 6 months
Re: Problem signing FPCA
by Kévin Raymond
On Thu, Oct 6, 2011 at 5:39 PM, Łukasz Redynk <mr.erdk(a)gmail.com> wrote:
> Hello
>
> Today I've created account on admin.fedoraproject.org and tried to
> complete FPCA - but every time I clied link (from my profile home) I saw
> 'error 500' - both on Firefox (7.x) and Chrome (15.x). I'd appreciate
> any help you can provide to bypass this problem.
>
> --
> Best regards
> Łukasz Redynk
Hi, the FAS has more to do with the infra.
Infra cced.
Regards,
--
Kévin Raymond
User:shaiton
GPG-Key: A5BCB3A2
12 years, 6 months
FW: serverbeach maint on 2011-10-17
by Kevin Fenzi
Forwarding on from serverbeach:
Please be advised that on October 17th, 2011 between 12:01am ET and
ending at 04:00am ET, we will be conducting network maintenance within
our Herndon, VA (IAD) Datacenter. This work is being done to combine a
small number of our network VLANs into a single, larger VLAN in an
effort to make more efficient use of our IPv4 allocations.
During the maintenance window you may see up to 20 minutes of network
connectivity interruption to these services:
70094 :: serverbeach1
70101 :: serverbeach2
70102 :: serverbeach3
Again this will only briefly affect network connectivity to these
services; power to the machines will not be interrupted and they will
not be rebooted. This change will result in better utilization of our
IPv4 address space at ServerBeach, which will help us continue to
provide IPv4 space to our customers far into the future.
12 years, 6 months
Meeting Agenda Item: Introduction Andrew Smillie
by Andrew Smillie
Hi,
I'm Andrew, a final year computer science student who has been quite active the student run computing facility hosted by GeekSoc [1]. Through this I have gained experience administering CentOS systems set up for a variety of purposes including Joomla and Wordpress on Apache, MySQL, SSH, OpenLDAP, BIND, and NFS.
I'll admit that I have a lot to learn about professional system administration - working with a student group providing services to other students is vastly different that a production system used by a *lot* of people - but I am willing to learn and would really like to improve my sysadmin skills.
I imagine the best place for me to start would be to poke around the systems a bit to try and better undertand the setup you have and slowly start working on some of the simpler issues.
Thanks,
Andrew Smillie
IRC: Smilers_ (Freenode)
FAS: smillie
Location: Scotland, UK
[1] http://www.geeksoc.org/
12 years, 6 months
