On Fri, Oct 14, 2011 at 8:41 AM, Jeffrey Ollie <jeff@xxxxxxxxxx> wrote: > I've looked a little at monkeysphere this morning and it looks > interesting. It'd be nice if at least the FI folks could publish the > host keys for the Fedora systems using monkeysphere. I plan on giving > monkeysphere a good trial here. Note that there are a couple of bugs > currently, but they are fairly easy to work around. I thought monkeysphere was basically an addon for additional functionality. I was talking about using gpg-agent to load your personal keyring on your laptop and generating a gpg subkey from your private key. Converting that subkey into a ssh key for each system you remote to. That way you can revoke/throw away each subkey without risking your master key and gpg-agent on your local system makes it easy to load all the keys without a lot of fuss on your part. Basically what I'm saying is, it looks like Fedora infrastructure doesn't need to do anything for us to choose to have easier management of per remote host ssh keys. gpg-agent with gpg subkey usage appears to be that easier way. I'm just saying it would be good if Fedora Intrastructure, as domain experts, provided some best practice guidance on how to set that up correctly and gave it a thumbs up as a useful approach. -jef -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel
