[Yum] yum's awesome, ideas

[Robert G. Brown]

On 30 Jul 2003, seth vidal wrote:

> 
> > 
> > Redhat's up2date requires the key, and displays a nice message/offers to
> > do it ("rpm --import /usr/share/rhn/RPM-GPG-KEY") for you. yum could do
> > something similar, I guess, but now we're getting distro specific.
> > 
> > Definitely a trade off.
> 
> well if its going to import the key for you what's the point of having
> it on? an attacker can just trojan the key, right?
> 
> I could definitely see a point in having a default key listed that yum
> will import if it can - but how do you do that safely?

Your organization-wide, ssl-secured (well, "certified" is a better term
than "secured") keyserver, of course.

Which Duke, at least, has long needed.  I think it is time to sit down
with Chris and work one out (which really is something he/OIT should do,
not you).  It's not just these keys -- there is ssh host authentication
to prevent host spoofing and m-in-m attacks in departments and so much
more.

That is, in principle it is possible, but it requires tools that are not
(yet) commonly implemented.  But need to be.

   rgb

-- 
Robert G. Brown	                       http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567  Fax: 919-660-2525     email:rgb at phy.duke.edu