DNSSEC+SSHFP for SSH key fingerprints of Codeberg? #89

ikselven commented 2019年09月28日 16:35:54 +02:00

Searching the Codeberg website and the internet unfortunately didn't come up with any results.

Searching the Codeberg website and the internet unfortunately didn't come up with any results.

Aminda commented 2019年09月29日 12:36:18 +02:00

Do you have any plans for enabling DNSSEC and adding SSHFP records so SSH config could just be told VerifyHostKeyDNS yes ?

Do you have any plans for enabling DNSSEC and adding SSHFP records so SSH config could just be told `VerifyHostKeyDNS yes` ?

hw commented 2019年09月29日 21:31:24 +02:00

@Mikaela : good idea, we will definitely discuss this!

@Mikaela : good idea, we will definitely discuss this!

hw commented 2019年09月29日 21:32:05 +02:00

@ikselven : thank you for bringing this up, we will post these with the next website update!

@ikselven : thank you for bringing this up, we will post these with the next website update!

hw commented 2019年10月08日 16:27:48 +02:00

@ikselven : Fingerprints are now added to the imprint page (accessible from the footer link):

https://codeberg.org/Codeberg/org/src/branch/master/Imprint.md

@ikselven : Fingerprints are now added to the imprint page (accessible from the footer link): https://codeberg.org/Codeberg/org/src/branch/master/Imprint.md

ikselven commented 2019年10月19日 14:33:48 +02:00

Thanks :)

Thanks :)

Ghost commented 2019年10月25日 23:21:28 +02:00

I'm getting this message when I try to verify the SSH connection. The fingerprint shown doesn't match the fingerprint on the Imprint page.

$ ssh -T git@codeberg.org
The authenticity of host 'codeberg.org (159.69.0.178)' can't be established.
ECDSA key fingerprint is SHA256:T9FYDEHELhVkulEKKwge5aVhVTbqCW0MIRwAfpARs/E.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Am I missing something here?

I'm getting this message when I try to verify the SSH connection. The fingerprint shown doesn't match the fingerprint on the Imprint page. ``` $ ssh -T git@codeberg.org The authenticity of host 'codeberg.org (159.69.0.178)' can't be established. ECDSA key fingerprint is SHA256:T9FYDEHELhVkulEKKwge5aVhVTbqCW0MIRwAfpARs/E. Are you sure you want to continue connecting (yes/no/[fingerprint])? ``` Am I missing something here?

hw commented 2019年10月25日 23:44:33 +02:00

The fingerprint is SHA256-encoded, the table on the imprint page lists the base64 format as used for example by ssh-keyscan.

Your key is correct.

The fingerprint is SHA256-encoded, the table on the imprint page lists the base64 format as used for example by ssh-keyscan. Your key is correct.

Ghost commented 2019年10月26日 09:01:02 +02:00

Thank you!

Thank you!

douram commented 2020年12月17日 21:18:20 +01:00

Why was this closed? SSHFP is still missing and a wanted feature

Why was this closed? SSHFP is still missing and a wanted feature

hw commented 2020年12月17日 21:42:12 +01:00

SSHFP only or DNSSEC+SSHFP? (The former probably quick'n'easy, the latter quite some effort)

SSHFP only or DNSSEC+SSHFP? (The former probably quick'n'easy, the latter quite some effort)

douram commented 2020年12月17日 22:18:05 +01:00

SSHFP without DNSSEC is quite pointless since it could be spoofed then

SSHFP without DNSSEC is quite pointless since it could be spoofed then

diffrentcolours commented 2023年11月12日 14:13:40 +01:00

As a new user I was curious about this. I looked into it - it seems that codeberg.org's DNS records live on ns{1,2,3}.dnsowl.com. which is provided by Namesilo as a registrar.

Looking at Namesilo's support, they allow customers to add their own DS records, but they don't seem to manage DNSSEC for you. My own registrar, Mythic Beasts, provides managed DNSSEC.

If Codeberg wanted to provide DNSSEC, it may be easier to switch registrar than attempt to manage it directly. But once DNSSEC is provided, SSHFP records become useful.

As a new user I was curious about this. I looked into it - it seems that codeberg.org's DNS records live on `ns{1,2,3}.dnsowl.com.` which is provided by [Namesilo](https://www.namesilo.com/) as a registrar. Looking at Namesilo's support, they allow customers to [add their own DS records](https://www.namesilo.com/support/v2/articles/domain-manager/ds-records), but they don't seem to manage DNSSEC for you. My own registrar, Mythic Beasts, provides [managed DNSSEC](https://www.mythic-beasts.com/blog/2016/03/04/one-click-dnssec-public-beta/). If Codeberg wanted to provide DNSSEC, it may be easier to switch registrar than attempt to manage it directly. But once DNSSEC is provided, SSHFP records become useful.