|
|
Log in / Subscribe / Register

An update on the Fedora August 2008 intrusion

An update on the Fedora August 2008 intrusion

Posted Apr 6, 2009 8:22 UTC (Mon) by dlang (guest, #313)
In reply to: An update on the Fedora August 2008 intrusion by knobunc
Parent article: An update on the Fedora August 2008 intrusion

keychain works for users (where you can enter the passphrase once per boot), not for tools where you don't have a user to enter the passphrase.

so you end up with either setting up a key that doesn't have a passphrase, or having to store that passphrase in a script (or a bunch of scripts since they don't all run as part of a single user session)

I don't see a big win in security to counter the extra complexity here.

no, this isn't appropriate for cases like what was involved in the Fedora intrusion, but the claim was made (several posts up) that there is no legitimate reason to have a blank passphrase, and that is what I'm disputing.

to post comments

An update on the Fedora August 2008 intrusion

Posted Apr 6, 2009 12:44 UTC (Mon) by knobunc (guest, #4678) [Link]

Obviously, different environments have different requirements. But I use keychain on my servers. They have months, sometimes years of uptime. If one reboots, I find it acceptable that a human needs to enter a password to allow the box to access the other machines again. I can see scenarios where an unprotected key may make sense but it all depends on the environment.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds