From: Mark Wooding Date: Thu, 3 Apr 2014 17:46:26 +0000 (+0100) Subject: Publish SSHFP records in the DNS. X-Git-Url: https://git.distorted.org.uk/~mdw/zones/commitdiff_plain/8c8a56816856f5f2688c812adda309d1fd1dfa09 Publish SSHFP records in the DNS. Machinery for fetching the fingerprints (relying on the existing CA) is also included. I'm checking in the fingerprint files because I want to track how they evolve. --- diff --git a/artist.sshfp b/artist.sshfp new file mode 100644 index 0000000..da88f62 --- /dev/null +++ b/artist.sshfp @@ -0,0 +1,2 @@ +artist IN SSHFP 1 1 a78d674bd082abd8cfd7535f0ef986ea058b234d +artist IN SSHFP 2 1 e29b1a00c35d1d94b1242531247161cf7185aa1b diff --git a/crybaby.sshfp b/crybaby.sshfp new file mode 100644 index 0000000..81dbe49 --- /dev/null +++ b/crybaby.sshfp @@ -0,0 +1,2 @@ +crybaby IN SSHFP 1 1 e44cdab8f4100865cfb692a317208055d1c65206 +crybaby IN SSHFP 2 1 00831d629d23221f14c1d908fc88db4fd71acee8 diff --git a/distorted.lisp b/distorted.lisp index 0806e78..1fca34e 100644 --- a/distorted.lisp +++ b/distorted.lisp @@ -105,25 +105,25 @@ (evolution :alias evo) ;; Colocated services. - ((irc vox) (colo :svc jazz.colo) - (jump :svc jazz.jump)) - ((git www mail) (colo :svc stratocaster.colo) - (jump :svc stratocaster.jump)) + ((irc vox) (colo :svc jazz.colo :sshfp "jazz.sshfp") + (jump :svc jazz.jump :sshfp "jazz.sshfp")) + ((git www mail) (colo :svc stratocaster.colo :sshfp "stratocaster.sshfp") + (jump :svc stratocaster.jump :sshfp "stratocaster.sshfp")) :svc #+view/inside stratocaster.colo #-view/inside stratocaster.jump - (cabal :svc stratocaster.colo) - ((db ftp) (colo :svc telecaster.colo) - (jump :svc telecaster.jump)) + (cabal :svc stratocaster.colo :sshfp "stratocaster.sshfp") + ((db ftp) (colo :svc telecaster.colo :sshfp "telecaster.sshfp") + (jump :svc telecaster.jump :sshfp "telecaster.sshfp")) ;; Local services. ((rawk pifi) (unsafe :svc artist.unsafe) (dmz :svc artist.dmz)) - (mirror (dmz :svc roadstar.dmz) - (unsafe :svc roadstar.unsafe)) - ((wiki bugs old-mail i2p) :svc vampire) + (mirror (dmz :svc roadstar.dmz :sshfp "roadstar.sshfp") + (unsafe :svc roadstar.unsafe :sshfp "roadstar.sshfp")) + ((wiki bugs old-mail i2p) :svc vampire :sshfp "vampire.sshfp") ;; Internal services. - #+view/inside ((news lpr) :svc vampire.unsafe) + #+view/inside ((news lpr) :svc vampire.unsafe :sshfp "vampire.sshfp") ;; Anonymity services. (anon (colo :svc jazz.colo) @@ -137,19 +137,19 @@ ;; Colocated hosts. (colo :net colo) (jump :net jump) - (fender (colo :a fender.colo) - (jump :a fender.jump)) - (precision (colo :a precision.colo) - (jump :a precision.jump)) - (telecaster (colo :a telecaster.colo) - (jump :a telecaster.jump)) + (fender (colo :a fender.colo :sshfp "fender.sshfp") + (jump :a fender.jump :sshfp "fender.sshfp")) + (precision (colo :a precision.colo :sshfp "precision.sshfp") + (jump :a precision.jump :sshfp "precision.sshfp")) + (telecaster (colo :a telecaster.colo :sshfp "telecaster.sshfp") + (jump :a telecaster.jump :sshfp "telecaster.sshfp")) (telecaster :alias tele) - (stratocaster (colo :a stratocaster.colo) - (jump :a stratocaster.jump)) + (stratocaster (colo :a stratocaster.colo :sshfp "stratocaster.sshfp") + (jump :a stratocaster.jump :sshfp "stratocaster.sshfp")) (stratocaster :alias strat) - (jazz (colo :a jazz.colo) - (jump :a jazz.jump) - (iodine :a jazz.iodine)) + (jazz (colo :a jazz.colo :sshfp "jazz.sshfp") + (jump :a jazz.jump :sshfp "jazz.sshfp") + (iodine :a jazz.iodine :sshfp "jazz.sshfp")) ;; Media server (on loan to Good Technology HSTG). (jaguar (jump :a jaguar.jump)) @@ -161,23 +161,23 @@ (unsafe :net unsafe) (safe :net safe) (untrusted :net untrusted) - (vampire (unsafe :a vampire.unsafe) - (dmz :a vampire.dmz) - (safe :a vampire.safe) - (untrusted :a vampire.untrusted)) - (ibanez (unsafe :a ibanez.unsafe) - (dmz :a ibanez.dmz)) - (radius (unsafe :a radius.unsafe) - (dmz :a radius.dmz) - (safe :a radius.safe) - (untrusted :a radius.untrusted)) - (roadstar (unsafe :a roadstar.unsafe) - (dmz :a roadstar.dmz)) - (jem (unsafe :a jem.unsafe) - (dmz :a jem.dmz)) - (artist (unsafe :a artist.unsafe) - (dmz :a artist.dmz) - (untrusted :a artist.untrusted)) + (vampire (unsafe :a vampire.unsafe :sshfp "vampire.sshfp") + (dmz :a vampire.dmz :sshfp "vampire.sshfp") + (safe :a vampire.safe :sshfp "vampire.sshfp") + (untrusted :a vampire.untrusted :sshfp "vampire.sshfp")) + (ibanez (unsafe :a ibanez.unsafe :sshfp "ibanez.sshfp") + (dmz :a ibanez.dmz :sshfp "ibanez.sshfp")) + (radius (unsafe :a radius.unsafe :sshfp "radius.sshfp") + (dmz :a radius.dmz :sshfp "radius.sshfp") + (safe :a radius.safe :sshfp "radius.sshfp") + (untrusted :a radius.untrusted :sshfp "radius.sshfp")) + (roadstar (unsafe :a roadstar.unsafe :sshfp "roadstar.sshfp") + (dmz :a roadstar.dmz :sshfp "roadstar.sshfp")) + (jem (unsafe :a jem.unsafe :sshfp "jem.sshfp") + (dmz :a jem.dmz :sshfp "jem.sshfp")) + (artist (unsafe :a artist.unsafe :sshfp "artist.sshfp") + (dmz :a artist.dmz :sshfp "artist.sshfp") + (untrusted :a artist.untrusted :sshfp "artist.sshfp")) ;; DHCP hosts. (gibson :cname gibson.dhcp) @@ -188,9 +188,9 @@ ;; Virtual network. (vpn :net vpn) - (crybaby (vpn :a crybaby.vpn)) - (terror (vpn :a terror.vpn)) - (orange (vpn :a orange.vpn)) + (crybaby (vpn :a crybaby.vpn :sshfp "crybaby.sshfp")) + (terror (vpn :a terror.vpn :sshfp "terror.sshfp")) + (orange (vpn :a orange.vpn :sshfp "orange.sshfp")) (iodine :net iodine) ;; ITS. diff --git a/fender.sshfp b/fender.sshfp new file mode 100644 index 0000000..9cdb1bb --- /dev/null +++ b/fender.sshfp @@ -0,0 +1,2 @@ +fender IN SSHFP 1 1 8c4026eae04c6364cfe67eb5084920324652042c +fender IN SSHFP 2 1 814f905c79291477e7c9e883e294983dc6809941 diff --git a/fetch-sshfp b/fetch-sshfp new file mode 100755 index 0000000..21a14f2 --- /dev/null +++ b/fetch-sshfp @@ -0,0 +1,24 @@ +#! /bin/sh + +while read host; do + { ssh $host "ssh-keygen -r$host" >$host.sshfp.new + mv $host.sshfp.new $host.sshfp; }& +done <