Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #236223

Re: apt-key says deprecated, but not saying what else to use

Show all headers | View raw

Gene Heskett wrote: 
> I'd like to pleaed for a new apt-key, one that would survey the existing 
> list, and on finding a key that is expired or is no longer associated, 
> offer the option of removing it, or refreshiing it.
> 
> I have up to 7 machines on my local network, usually accessed by some 
> ssh/sshfs variation, but my current keyring since I'm first user, 
> probably has 30 some keys, many of which are useless as the target 
> machine has been changed by a new machine and a new bare metal install.

This is ssh key management, not apt key management. apt key
things are for trusting package repositories.

> I consider those "dead" keys to be security risks. But at present, there 
> is not a means to identify and remove them that I am aware of.
> 
> So I would plead for an apt-key replacement that would automate that 
> process. At the present state, my connection scripts to re-establlish my 
> local network after a reboot or power failure recovery, are all blocked 
> because of machine replacements/reinstalls using the same ip address 
> yadda yadda, so I must answer yes, then supply my first user password 
> for that machine because I do want to continue connecting to that 
> machine. That can rapidly turn into a PITA.

Here's what you should do:

1. create a new ssh keypair on your main machine:
    ssh-keygen -t rsa -b 4096 -f gene2021

2. for each $targetmachine in your 7 machines, do this:
    - ssh $targetmachine
    - mv ~/.ssh/authorized_keys ~/.ssh/authorized_keys_old
    - don't close that terminal 
    - open a new terminal and make sure you can ssh in by
      password, then
    - ssh-copy-id gene2021 $targetmachine
    - make sure you can ssh in with the gene2021 key:
      ssh -i gene2021 $targetmachine
    - if it's good, close both terminals and go on to the next
      $targetmachine

3. clean up: remove keys in ~/.ssh/  that aren't gene2021 and
   aren't useful otherwise.

Now you have one known good keypair that lets you in to all
seven machines without a password, and you can use a password as
fallback.

Now, it sounds like you also have a problem with machines
getting randomly assigned IP addresses. In a network of size 7,
I would strongly advise you to stop using DHCP and just put in 
static IP assignments for each machine in
/etc/network/interfaces.

-dsr-

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

apt-key says deprecated, but not saying what else to use Marco Möller <talby@debianlists.mobilxpress.net> - 2021-06-19 22:10 +0200
  Bug#990086: apt-key is deprecated in bullseye, how to manage keys instead Andrei POPESCU <andreimpopescu@gmail.com> - 2021-06-20 09:30 +0200
    Re: Bug#990086: apt-key is deprecated in bullseye, how to manage  keys instead Andrei POPESCU <andreimpopescu@gmail.com> - 2021-06-21 08:00 +0200
      Re: Bug#990086: apt-key is deprecated in bullseye, how to manage keys  instead Marco Möller <talby@debianlists.mobilxpress.net> - 2021-06-24 16:50 +0200
        Re: Bug#990086: apt-key is deprecated in bullseye, how to manage  keys instead Andrei POPESCU <andreimpopescu@gmail.com> - 2021-06-26 12:00 +0200
          Re: Bug#990086: apt-key is deprecated in bullseye, how to manage keys  instead Marco Möller <talby@debianlists.mobilxpress.net> - 2021-06-26 13:10 +0200
          Re: Bug#990086: apt-key is deprecated in bullseye, how to manage keys instead Cindy Sue Causey <butterflybytes@gmail.com> - 2021-06-26 14:50 +0200
            Re: Bug#990086: apt-key is deprecated in bullseye, how to manage  keys instead <tomas@tuxteam.de> - 2021-06-26 21:00 +0200
              Re: Bug#990086: apt-key is deprecated in bullseye, how to manage keys instead Nicholas Geovanis <nickgeovanis@gmail.com> - 2021-06-29 03:10 +0200
  Re: apt-key says deprecated, but not saying what else to use Darac Marjal <mailinglist@darac.org.uk> - 2021-06-20 14:20 +0200
    Re: apt-key says deprecated, but not saying what else to use Gene Heskett <gheskett@shentel.net> - 2021-06-20 14:50 +0200
      Re: apt-key says deprecated, but not saying what else to use Dan Ritter <dsr@randomstring.org> - 2021-06-20 16:30 +0200
        Re: apt-key says deprecated, but not saying what else to use Charles Curley <charlescurley@charlescurley.com> - 2021-06-20 17:30 +0200
        Re: apt-key says deprecated, but not saying what else to use Gene Heskett <gheskett@shentel.net> - 2021-06-20 17:40 +0200
        Re: apt-key says deprecated, but not saying what else to use Gene Heskett <gheskett@shentel.net> - 2021-06-20 19:00 +0200
          Re: apt-key says deprecated, but not saying what else to use <tomas@tuxteam.de> - 2021-06-20 19:10 +0200
          Re: apt-key says deprecated, but not saying what else to use Greg Wooledge <greg@wooledge.org> - 2021-06-20 21:10 +0200
            Re: apt-key says deprecated, but not saying what else to use Dan Ritter <dsr@randomstring.org> - 2021-06-20 21:20 +0200
          Re: apt-key says deprecated, but not saying what else to use Dan Ritter <dsr@randomstring.org> - 2021-06-20 21:10 +0200
        Re: apt-key says deprecated, but not saying what else to use Jonathan Dowland <jon+debian-user@dow.land> - 2021-06-21 11:10 +0200
    Re: apt-key says deprecated, but not saying what else to use Marco Möller <talby@debianlists.mobilxpress.net> - 2021-06-24 14:50 +0200
  Re: apt-key says deprecated, but not saying what else to use Brad Rogers <brad@fineby.me.uk> - 2021-06-20 18:10 +0200
    Re: apt-key says deprecated, but not saying what else to use Marco Möller <talby@debianlists.mobilxpress.net> - 2021-06-24 15:20 +0200

csiph-web