From 8c8a56816856f5f2688c812adda309d1fd1dfa09 Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Thu, 3 Apr 2014 18:46:26 +0100 Subject: [PATCH] Publish SSHFP records in the DNS. Machinery for fetching the fingerprints (relying on the existing CA) is also included. I'm checking in the fingerprint files because I want to track how they evolve. --- artist.sshfp | 2 ++ crybaby.sshfp | 2 ++ distorted.lisp | 84 +++++++++++++++++++++++++++--------------------------- fender.sshfp | 2 ++ fetch-sshfp | 24 ++++++++++++++++ gibson.sshfp | 2 ++ ibanez.sshfp | 2 ++ jazz.sshfp | 2 ++ jem.sshfp | 2 ++ orange.sshfp | 2 ++ precision.sshfp | 2 ++ radius.sshfp | 2 ++ roadstar.sshfp | 2 ++ stratocaster.sshfp | 2 ++ telecaster.sshfp | 2 ++ terror.sshfp | 2 ++ vampire.sshfp | 2 ++ 17 files changed, 96 insertions(+), 42 deletions(-) create mode 100644 artist.sshfp create mode 100644 crybaby.sshfp create mode 100644 fender.sshfp create mode 100755 fetch-sshfp create mode 100644 gibson.sshfp create mode 100644 ibanez.sshfp create mode 100644 jazz.sshfp create mode 100644 jem.sshfp create mode 100644 orange.sshfp create mode 100644 precision.sshfp create mode 100644 radius.sshfp create mode 100644 roadstar.sshfp create mode 100644 stratocaster.sshfp create mode 100644 telecaster.sshfp create mode 100644 terror.sshfp create mode 100644 vampire.sshfp diff --git a/artist.sshfp b/artist.sshfp new file mode 100644 index 0000000..da88f62 --- /dev/null +++ b/artist.sshfp @@ -0,0 +1,2 @@ +artist IN SSHFP 1 1 a78d674bd082abd8cfd7535f0ef986ea058b234d +artist IN SSHFP 2 1 e29b1a00c35d1d94b1242531247161cf7185aa1b diff --git a/crybaby.sshfp b/crybaby.sshfp new file mode 100644 index 0000000..81dbe49 --- /dev/null +++ b/crybaby.sshfp @@ -0,0 +1,2 @@ +crybaby IN SSHFP 1 1 e44cdab8f4100865cfb692a317208055d1c65206 +crybaby IN SSHFP 2 1 00831d629d23221f14c1d908fc88db4fd71acee8 diff --git a/distorted.lisp b/distorted.lisp index 0806e78..1fca34e 100644 --- a/distorted.lisp +++ b/distorted.lisp @@ -105,25 +105,25 @@ (evolution :alias evo) ;; Colocated services. - ((irc vox) (colo :svc jazz.colo) - (jump :svc jazz.jump)) - ((git www mail) (colo :svc stratocaster.colo) - (jump :svc stratocaster.jump)) + ((irc vox) (colo :svc jazz.colo :sshfp "jazz.sshfp") + (jump :svc jazz.jump :sshfp "jazz.sshfp")) + ((git www mail) (colo :svc stratocaster.colo :sshfp "stratocaster.sshfp") + (jump :svc stratocaster.jump :sshfp "stratocaster.sshfp")) :svc #+view/inside stratocaster.colo #-view/inside stratocaster.jump - (cabal :svc stratocaster.colo) - ((db ftp) (colo :svc telecaster.colo) - (jump :svc telecaster.jump)) + (cabal :svc stratocaster.colo :sshfp "stratocaster.sshfp") + ((db ftp) (colo :svc telecaster.colo :sshfp "telecaster.sshfp") + (jump :svc telecaster.jump :sshfp "telecaster.sshfp")) ;; Local services. ((rawk pifi) (unsafe :svc artist.unsafe) (dmz :svc artist.dmz)) - (mirror (dmz :svc roadstar.dmz) - (unsafe :svc roadstar.unsafe)) - ((wiki bugs old-mail i2p) :svc vampire) + (mirror (dmz :svc roadstar.dmz :sshfp "roadstar.sshfp") + (unsafe :svc roadstar.unsafe :sshfp "roadstar.sshfp")) + ((wiki bugs old-mail i2p) :svc vampire :sshfp "vampire.sshfp") ;; Internal services. - #+view/inside ((news lpr) :svc vampire.unsafe) + #+view/inside ((news lpr) :svc vampire.unsafe :sshfp "vampire.sshfp") ;; Anonymity services. (anon (colo :svc jazz.colo) @@ -137,19 +137,19 @@ ;; Colocated hosts. (colo :net colo) (jump :net jump) - (fender (colo :a fender.colo) - (jump :a fender.jump)) - (precision (colo :a precision.colo) - (jump :a precision.jump)) - (telecaster (colo :a telecaster.colo) - (jump :a telecaster.jump)) + (fender (colo :a fender.colo :sshfp "fender.sshfp") + (jump :a fender.jump :sshfp "fender.sshfp")) + (precision (colo :a precision.colo :sshfp "precision.sshfp") + (jump :a precision.jump :sshfp "precision.sshfp")) + (telecaster (colo :a telecaster.colo :sshfp "telecaster.sshfp") + (jump :a telecaster.jump :sshfp "telecaster.sshfp")) (telecaster :alias tele) - (stratocaster (colo :a stratocaster.colo) - (jump :a stratocaster.jump)) + (stratocaster (colo :a stratocaster.colo :sshfp "stratocaster.sshfp") + (jump :a stratocaster.jump :sshfp "stratocaster.sshfp")) (stratocaster :alias strat) - (jazz (colo :a jazz.colo) - (jump :a jazz.jump) - (iodine :a jazz.iodine)) + (jazz (colo :a jazz.colo :sshfp "jazz.sshfp") + (jump :a jazz.jump :sshfp "jazz.sshfp") + (iodine :a jazz.iodine :sshfp "jazz.sshfp")) ;; Media server (on loan to Good Technology HSTG). (jaguar (jump :a jaguar.jump)) @@ -161,23 +161,23 @@ (unsafe :net unsafe) (safe :net safe) (untrusted :net untrusted) - (vampire (unsafe :a vampire.unsafe) - (dmz :a vampire.dmz) - (safe :a vampire.safe) - (untrusted :a vampire.untrusted)) - (ibanez (unsafe :a ibanez.unsafe) - (dmz :a ibanez.dmz)) - (radius (unsafe :a radius.unsafe) - (dmz :a radius.dmz) - (safe :a radius.safe) - (untrusted :a radius.untrusted)) - (roadstar (unsafe :a roadstar.unsafe) - (dmz :a roadstar.dmz)) - (jem (unsafe :a jem.unsafe) - (dmz :a jem.dmz)) - (artist (unsafe :a artist.unsafe) - (dmz :a artist.dmz) - (untrusted :a artist.untrusted)) + (vampire (unsafe :a vampire.unsafe :sshfp "vampire.sshfp") + (dmz :a vampire.dmz :sshfp "vampire.sshfp") + (safe :a vampire.safe :sshfp "vampire.sshfp") + (untrusted :a vampire.untrusted :sshfp "vampire.sshfp")) + (ibanez (unsafe :a ibanez.unsafe :sshfp "ibanez.sshfp") + (dmz :a ibanez.dmz :sshfp "ibanez.sshfp")) + (radius (unsafe :a radius.unsafe :sshfp "radius.sshfp") + (dmz :a radius.dmz :sshfp "radius.sshfp") + (safe :a radius.safe :sshfp "radius.sshfp") + (untrusted :a radius.untrusted :sshfp "radius.sshfp")) + (roadstar (unsafe :a roadstar.unsafe :sshfp "roadstar.sshfp") + (dmz :a roadstar.dmz :sshfp "roadstar.sshfp")) + (jem (unsafe :a jem.unsafe :sshfp "jem.sshfp") + (dmz :a jem.dmz :sshfp "jem.sshfp")) + (artist (unsafe :a artist.unsafe :sshfp "artist.sshfp") + (dmz :a artist.dmz :sshfp "artist.sshfp") + (untrusted :a artist.untrusted :sshfp "artist.sshfp")) ;; DHCP hosts. (gibson :cname gibson.dhcp) @@ -188,9 +188,9 @@ ;; Virtual network. (vpn :net vpn) - (crybaby (vpn :a crybaby.vpn)) - (terror (vpn :a terror.vpn)) - (orange (vpn :a orange.vpn)) + (crybaby (vpn :a crybaby.vpn :sshfp "crybaby.sshfp")) + (terror (vpn :a terror.vpn :sshfp "terror.sshfp")) + (orange (vpn :a orange.vpn :sshfp "orange.sshfp")) (iodine :net iodine) ;; ITS. diff --git a/fender.sshfp b/fender.sshfp new file mode 100644 index 0000000..9cdb1bb --- /dev/null +++ b/fender.sshfp @@ -0,0 +1,2 @@ +fender IN SSHFP 1 1 8c4026eae04c6364cfe67eb5084920324652042c +fender IN SSHFP 2 1 814f905c79291477e7c9e883e294983dc6809941 diff --git a/fetch-sshfp b/fetch-sshfp new file mode 100755 index 0000000..21a14f2 --- /dev/null +++ b/fetch-sshfp @@ -0,0 +1,24 @@ +#! /bin/sh + +while read host; do + { ssh $host "ssh-keygen -r$host" >$host.sshfp.new + mv $host.sshfp.new $host.sshfp; }& +done <