search

ocf / ocfweb

The main ocf website
https://www.ocf.berkeley.edu
Other
40 stars 91 forks source link

add ssh host key fingerprints to server listing #437

Open abizer opened 5 years ago

abizer commented 5 years ago

we list tsunami's host key fingerprint at ocf.io/ssh but it would be useful to have the other machine's fingerprints listed somewhere publically as well so we can verify them externally if we get a key mismatch or something like that

jvperrin commented 5 years ago

This should be pretty easy to do if we use puppetdb for the server list, since there's a bunch of SSH key fingerprint facts:

sshdsakey
sshecdsakey
sshed25519key
sshfp_dsa
sshfp_ecdsa
sshfp_ed25519
sshfp_rsa
sshrsakey

(we probably don't want the sshfp ones though since those are for usage in DNS and we don't currently use them)

dkess commented 5 years ago

With #406, ocfweb will have its own Puppet cert which will make this even easier. Perhaps we should even list them on the servers page?

cg505 commented 5 years ago

I'm currently just hosting the actual known_hosts file we use at https://failure.ocf.berkeley.edu/ssh_known_hosts so that I can pull it into the known hosts file on my machine. We should consider making such a file available on www.o.b.e, possibly only including non-staff hosts (segfault, werewolves, tsunami, etc).