Re: Integrity protection of fetches

2010-08-09 Thread Matt McCutchen
On Mon, 2010-08-09 at 12:11 -0700, Adam Williamson wrote: > On Sun, 2010-08-08 at 11:34 -0700, Matt McCutchen wrote: > > On Fri, 2010-08-06 at 11:29 -0500, Steve Bonneville wrote: > > > i.g...@comcast.net wrote: > > > > Ideally (from this perspective), the host would validate the response > > > >

Re: Integrity protection of fetches

2010-08-09 Thread Adam Williamson
On Sun, 2010-08-08 at 11:34 -0700, Matt McCutchen wrote: > On Fri, 2010-08-06 at 11:29 -0500, Steve Bonneville wrote: > > i.g...@comcast.net wrote: > > > Ideally (from this perspective), the host would validate the response > > > itself. > > > > Exactly, if sshd is sufficiently paranoid it should

Re: Integrity protection of fetches

2010-08-08 Thread Matt McCutchen
On Fri, 2010-08-06 at 11:29 -0500, Steve Bonneville wrote: > i.g...@comcast.net wrote: > > Ideally (from this perspective), the host would validate the response > > itself. > > Exactly, if sshd is sufficiently paranoid it should make a query with > CD set in the request and do all the validation

Re: Integrity protection of fetches

2010-08-06 Thread Steve Bonneville
i.g...@comcast.net wrote: > openssh is more paranoid than that. An unsigned, unvalidated SSHFP > record will be treated just like the server response is today -- the > user will be shown the fingerprint and asked if it's correct. > > Only if the response is marked with the AD flag (indicating tha

Re: Integrity protection of fetches

2010-08-06 Thread i . grok
On Fri, Aug 06, 2010 at 12:54:23PM +0200, Till Maas wrote: > On Fri, Aug 06, 2010 at 04:31:00AM -0500, Mike McGrath wrote: > > On Fri, 6 Aug 2010, Till Maas wrote: > > > On Thu, Aug 05, 2010 at 04:32:36PM -0500, Mike McGrath wrote: > > > > We also use SSHFP records for those of you that want to ena

Re: Integrity protection of fetches

2010-08-06 Thread Adam Tkac
On Fri, Aug 06, 2010 at 12:54:23PM +0200, Till Maas wrote: > On Fri, Aug 06, 2010 at 04:31:00AM -0500, Mike McGrath wrote: > > On Fri, 6 Aug 2010, Till Maas wrote: > > > > > On Thu, Aug 05, 2010 at 04:32:36PM -0500, Mike McGrath wrote: > > > > On Thu, 5 Aug 2010, Till Maas wrote: > > > > > > > > Y

Re: Integrity protection of fetches

2010-08-06 Thread i . grok
On Fri, Aug 06, 2010 at 04:34:19AM -0500, Mike McGrath wrote: > On Fri, 6 Aug 2010, Mike McGrath wrote: > > On Fri, 6 Aug 2010, Till Maas wrote: > > > On Thu, Aug 05, 2010 at 04:32:36PM -0500, Mike McGrath wrote: > > > > We also use SSHFP records for those of you that want to enable > > > > VerifyH

Re: Integrity protection of fetches

2010-08-06 Thread Till Maas
On Fri, Aug 06, 2010 at 04:31:00AM -0500, Mike McGrath wrote: > On Fri, 6 Aug 2010, Till Maas wrote: > > > On Thu, Aug 05, 2010 at 04:32:36PM -0500, Mike McGrath wrote: > > > On Thu, 5 Aug 2010, Till Maas wrote: > > > > > > Yes ssh is secure if used properly. To get the proper known_hosts entry, >

Re: Integrity protection of fetches

2010-08-06 Thread Mike McGrath
On Fri, 6 Aug 2010, Mike McGrath wrote: > On Fri, 6 Aug 2010, Till Maas wrote: > > > On Thu, Aug 05, 2010 at 04:32:36PM -0500, Mike McGrath wrote: > > > On Thu, 5 Aug 2010, Till Maas wrote: > > > > > > Yes ssh is secure if used properly. To get the proper known_hosts entry, > > > > one has to down

Re: Integrity protection of fetches

2010-08-06 Thread Mike McGrath
On Fri, 6 Aug 2010, Till Maas wrote: > On Thu, Aug 05, 2010 at 04:32:36PM -0500, Mike McGrath wrote: > > On Thu, 5 Aug 2010, Till Maas wrote: > > > > Yes ssh is secure if used properly. To get the proper known_hosts entry, > > > one has to download https://admin.fedoraproject.org/ssh_known_hosts b

Re: Integrity protection of fetches

2010-08-06 Thread Till Maas
On Thu, Aug 05, 2010 at 04:32:36PM -0500, Mike McGrath wrote: > On Thu, 5 Aug 2010, Till Maas wrote: > > Yes ssh is secure if used properly. To get the proper known_hosts entry, > > one has to download https://admin.fedoraproject.org/ssh_known_hosts btw. > > > > We also use SSHFP records for thos

Re: Integrity protection of fetches

2010-08-05 Thread Mike McGrath
On Thu, 5 Aug 2010, Till Maas wrote: > On Thu, Aug 05, 2010 at 01:11:24PM -0600, Kevin Fenzi wrote: > > On Wed, 04 Aug 2010 22:03:14 +0200 > > Till Maas wrote: > > > > The attack is quite trivial: > > > 1) clone the git pkg Fedora repos > > > 2) commit some nasty change > > > 3) publish the repo

Re: Integrity protection of fetches

2010-08-05 Thread Till Maas
On Thu, Aug 05, 2010 at 01:11:24PM -0600, Kevin Fenzi wrote: > On Wed, 04 Aug 2010 22:03:14 +0200 > Till Maas wrote: > > The attack is quite trivial: > > 1) clone the git pkg Fedora repos > > 2) commit some nasty change > > 3) publish the repo on some server > > 4) if the victim wants to fetch fr

Re: Integrity protection of fetches

2010-08-05 Thread Kevin Fenzi
On Wed, 04 Aug 2010 22:03:14 +0200 Till Maas wrote: > On Wed, Aug 04, 2010 at 09:42:01AM -0700, Adam Williamson wrote: > > > I suspect it might short-circuit the 'ahhh, but what about...' > > 'oooh, but then I can...' nature of the conversation if you just > > put together a proof-of-concept att

Re: Integrity protection of fetches

2010-08-04 Thread Till Maas
On Wed, Aug 04, 2010 at 09:42:01AM -0700, Adam Williamson wrote: > I suspect it might short-circuit the 'ahhh, but what about...' 'oooh, > but then I can...' nature of the conversation if you just put together a > proof-of-concept attack and document it somewhere. I suspect the git > maintainers m

Re: Integrity protection of fetches (Re: The move to git!)

2010-08-04 Thread Adam Williamson
On Wed, 2010-08-04 at 01:33 -0700, Matt McCutchen wrote: > On Tue, 2010-08-03 at 22:09 +, Ben Boeckel wrote: > > Matt McCutchen wrote: > > > No. If the attacker MITMs the entire connection, they can lie about the > > > values of the remote refs too, so there is no need to find a hash > > > co