ibiblio services/changes announcement list

[Cristóbal Palmer <cmpalmer AT metalab.unc.edu>]

Greetings ibiblians!

I have some news regarding secure (ssh/sftp) connections to login.ibiblio.org:

  == EXECUTIVE SUMMARY ==

  * The ssh host keys for login.ibiblio.org have changed.

  * If you are getting a 'key' or 'ssh key' warning when trying to
  connect to login.ibiblio.org and don't know how to delete the keys
  your system has cached, please contact us via the help form.

  * new keys are:
  public DSA 1024 fingerprint: ed:f7:16:8e:da:69:47:31:fd:9c:c0:62:d7:11:2a:e6
  public RSA 1024 fingerprint: 4a:1d:49:83:cd:67:d0:e9:cc:36:fc:d4:cd:0f:84:81

  * If you are still seeing any problems, don't hesitate to contact
  us via the help form.

  == FULL TEXT ==

  Pardon me for not sending out this notice before the switch.

  We decided to make a clean break with our old login server hardware
in several ways. One of those is the host key identification used for
secure ssh connections to the server. The ssh server software uses a
pair of keys, one public and the other private, to negotiate secure
connections with the software that you use. Your client does some
interesting math with the public key that proves our server has the
private key that matches it.

  As protection against certain kinds of attacks, most software will
refuse to connect if the public key offered by a host changes between
connection attempts. Since this is a legitimate change (we replaced
the machine), you will have to manually go in and delete the public
key fingerprints that your software has stored for login.ibiblio.org.

  For many clients, the warning you would get would look something
like this:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
4a:1d:49:83:cd:67:d0:e9:cc:36:fc:d4:cd:0f:84:81.
Please contact your system administrator.
Add correct host key in /home/YOURUSER/.ssh/known_hosts to get rid of this 
message.
Offending key in /home/YOURUSER/.ssh/known_hosts:3
RSA host key for tribal has changed and you have requested strict checking.
Host key verification failed.

  How you get rid of this message depends on your software and your
platform. On a mac, if your user login is 'jane' then the file you
would edit would be /Users/jane/.ssh/known_hosts and on linux
machines, as seen above, it would usually be the 
/home/jane/.ssh/known_hosts file.

  If the above was unclear or you have a different platform, please
contact us via the help form (link in the footer).

  Ideally you'll confirm when you reconnect that the host key
fingerprint matches one of the following two:

  public DSA 1024 fingerprint: ed:f7:16:8e:da:69:47:31:fd:9c:c0:62:d7:11:2a:e6
  public RSA 1024 fingerprint: 4a:1d:49:83:cd:67:d0:e9:cc:36:fc:d4:cd:0f:84:81

with the second one being the more common. For the truly paranoid,
we'll publish the above keys in two distinct locations:

https://secure.ibiblio.org/keys/
http://www.ibiblio.org/faq/search.php?sid=0&q=keys

  Please don't hesitate to contact us if you're having trouble
connecting to login.ibiblio.org. If you're curious about what I've
been talking about and want to read more, this might be a good place
to start: http://www.securityfocus.com/infocus/1806

Cheers,
-- 
Cristóbal Palmer
ibiblio.org systems administrator