one of the primary things preventing me from encouraging use of monkeysphere
here at freegeek is that it requires use of fully qualified domain names.

while i understand the desire to not add many potentially non-unique UIDs to
the keyring, i'm wondering if it would be possible (perhaps with a commandline
option) for the monkeysphere ssh-proxycommand to append the search domain(s)
when someone attempts to connect to ssh without a FQDN. i.e.

if someone types:

  ssh foo

and the search domain was example.net, then the monkeysphere proxy would look
for:

  gpg --search '=ssh://foo.example.net'

and append the key appropriately to known_hosts if it verifies correctly?


at the very least, it shouldn't try any monkeysphere magic when not ssh'ing to
a FQDN.


this comes up for me fairly often, as i sometimes connect to a service via
"foo.example.net", but sometimes connect to "foo" and manually verify the key.
monkeysphere deletes the entry for "foo" when i connect to "foo.example.net"
later.  this makes it difficult to use monkeysphere, unfortunately.


live well,
  vagrant

here's an ugly hack to at least partially work around this limitation... by
using the following as the ssh ProxyCommand:


#!/bin/sh

case $1 in
    *.*) exec monkeysphere ssh-proxycommand "$1" "$2" ;;
    *)
    if [ -z "$(ssh-keygen -F $1)" ]; then
        # FIXME: deal with multiple lines returned by host
        fq=$(host $1 | awk '{print $1}' | head -n 1)
        if [ -n "$fq" ]; then
            if monkeysphere update-known_hosts $fq ; then
                ssh-keygen -F "$fq" | egrep -v ^# | awk '{print $2" "$3}' | sed -e "s,^,$1 ,g" >> ~/.ssh/known_hosts
                ssh-keygen -H
                # FIXME: clean up known_hosts.old
            fi
        fi
    fi
    exec nc "$1" "$2"
    ;;
esac


seems like it may run into trouble if you switch domains and they have the same
hostnames, not sure if there are other potential problems with this sort of
behavior...


live well,
  vagrant

Dear submitter,

as the package monkeysphere has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1085868

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Thorsten Alteholz (the ftpmaster behind the curtain)