/[gentoo]/xml/htdocs/proj/en/glep/glep-0012.html
Gentoo

Contents of /xml/htdocs/proj/en/glep/glep-0012.html

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1.1 - (hide annotations) (download) (as text)
Mon Aug 11 14:35:04 2003 UTC (10 years, 8 months ago) by g2boojum
Branch: MAIN
File MIME type: text/html
New glep added.

1 g2boojum 1.1 <?xml version="1.0" encoding="utf-8" ?>
2     <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3     <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
4     <!--
5     This HTML is auto-generated. DO NOT EDIT THIS FILE! If you are writing a new
6     PEP, see http://www.python.org/peps/pep-0001.html for instructions and links
7     to templates. DO NOT USE THIS HTML FILE AS YOUR TEMPLATE!
8     -->
9     <head>
10     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
11     <meta name="generator" content="Docutils 0.3.0: http://docutils.sourceforge.net/" />
12     <title>GLEP 12 -- Gentoo.org Finger Daemon</title>
13     <link rel="stylesheet" href="tools/glep.css" type="text/css" />
14     </head>
15     <body bgcolor="white">
16     <table class="navigation" cellpadding="0" cellspacing="0"
17     width="100%" border="0">
18     <tr><td class="navicon" width="150" height="35">
19     <a href="http://www.gentoo.org/" title="Gentoo Linux Home Page">
20     <img src="http://www.gentoo.org/images/gentoo-new.gif" alt="[Gentoo]"
21     border="0" width="150" height="35" /></a></td>
22     <td class="textlinks" align="left">
23     [<b><a href="http://www.gentoo.org/">Gentoo Linux Home</a></b>]
24     [<b><a href="http://www.gentoo.org/proj/en/glep">GLEP Index</a></b>]
25     [<b><a href="http://www.gentoo.org/proj/en/glep/glep-0012.txt">GLEP Source</a></b>]
26     </td></tr></table>
27     <div class="document">
28     <table class="rfc2822 field-list" frame="void" rules="none">
29     <col class="field-name" />
30     <col class="field-body" />
31     <tbody valign="top">
32     <tr class="field"><th class="field-name">GLEP:</th><td class="field-body">12</td>
33     </tr>
34     <tr class="field"><th class="field-name">Title:</th><td class="field-body">Gentoo.org Finger Daemon</td>
35     </tr>
36     <tr class="field"><th class="field-name">Version:</th><td class="field-body">1.1</td>
37     </tr>
38     <tr class="field"><th class="field-name">Last-Modified:</th><td class="field-body"><a class="reference" href="http://www.gentoo.org/cgi-bin/viewcvs.cgi/xml/htdocs/proj/en/glep/glep-0012.txt?cvsroot=gentoo">2003/08/11 14:32:44</a></td>
39     </tr>
40     <tr class="field"><th class="field-name">Author:</th><td class="field-body">Tavis Ormandy &lt;taviso&#32;&#97;t&#32;gentoo.org&gt;</td>
41     </tr>
42     <tr class="field"><th class="field-name">Status:</th><td class="field-body">Draft</td>
43     </tr>
44     <tr class="field"><th class="field-name">Type:</th><td class="field-body">Standards Track</td>
45     </tr>
46     <tr class="field"><th class="field-name">Created:</th><td class="field-body">10-Aug-2003</td>
47     </tr>
48     <tr class="field"><th class="field-name">Post-History:</th><td class="field-body">11-Aug-2003</td>
49     </tr>
50     </tbody>
51     </table>
52     <hr />
53     <div class="contents topic" id="contents">
54     <p class="topic-title"><a name="contents">Contents</a></p>
55     <ul class="simple">
56     <li><a class="reference" href="#abstract" id="id21" name="id21">Abstract</a></li>
57     <li><a class="reference" href="#motivation" id="id22" name="id22">Motivation</a></li>
58     <li><a class="reference" href="#rationale" id="id23" name="id23">Rationale</a></li>
59     <li><a class="reference" href="#implementation-and-security" id="id24" name="id24">Implementation and Security</a></li>
60     <li><a class="reference" href="#example-query" id="id25" name="id25">Example Query</a></li>
61     <li><a class="reference" href="#references" id="id26" name="id26">References</a></li>
62     <li><a class="reference" href="#copyright" id="id27" name="id27">Copyright</a></li>
63     </ul>
64     </div>
65     <div class="section" id="abstract">
66     <h1><a class="toc-backref" href="#id21" name="abstract">Abstract</a></h1>
67     <p>The finger protocol is documented in rfc742 <a class="footnote-reference" href="#id11" id="id1" name="id1">[1]</a> and rfc1196 <a class="footnote-reference" href="#id12" id="id2" name="id2">[2]</a>, a simple
68     protocol that returns a human readable report about a particular user
69     of the system. Typically, the information returned will be details such as
70     full name, location, etc. These details are entirely optional and are obtained
71     from the system passwd file, which of course can be edited or removed with the
72     standard chfn(1) <a class="footnote-reference" href="#id13" id="id3" name="id3">[3]</a> command.</p>
73     <p>The finger daemon will also return the contents of three files from the users home
74     directory, should they exist and be readable.</p>
75     <blockquote>
76     <ul class="simple">
77     <li>~/.project - which should contain information about the project currently being worked on.</li>
78     <li>~/.plan - which might contain work being done or a TODO style list.</li>
79     <li>~/.pgpkey - which would contain a PGP/GnuPG <a class="footnote-reference" href="#id14" id="id4" name="id4">[4]</a> public key block.</li>
80     </ul>
81     </blockquote>
82     <p>The finger protocol is mature, secure and widely used in the UNIX community.
83     There are clients available for all major operating systems, and web-based
84     clients for those that dont.</p>
85     </div>
86     <div class="section" id="motivation">
87     <h1><a class="toc-backref" href="#id22" name="motivation">Motivation</a></h1>
88     <p>Gentoo developers are already aware of the importance of User Relations <a class="footnote-reference" href="#id19" id="id5" name="id5">[9]</a> .</p>
89     <p>It is essential to keep the community up to date with current goals, status
90     updates, and information from the development team. Currently it is suggested
91     users track mailing lists, monitor the Gentoo bugzilla, developer IRC
92     channels and cvs commits.</p>
93     <p>While the resources to track developer progress and activity are made
94     available to users, they are not in a form usable to many people. Keeping
95     track of development is a tedious challenge, even for developers. For
96     non-technical users wishing to track the progress of a developer, using
97     mailing lists and bugzilla may not be a practical option.</p>
98     <p>Developers may also need a way to quickly find out the progress or activity of
99     other developers, different time zones sometimes makes it difficult for
100     developers to catch each other on IRC, and making already high-volume mailing
101     lists even more cluttered with status updates is not desirable.</p>
102     <p>A method that would allow individual developers to keep a log of their
103     activities and plans that were instantly accesible to anyone who was
104     interested would be desirable, I propose running a finger daemon on
105     gentoo.org, or dev.gentoo.org and forwarding requests there from gentoo.org.</p>
106     <p>Running a developer finger daemon would improve inter developer communication,
107     user communication and relations, and reduce workload on developers who have to
108     respond to queries from users on project status updates.</p>
109     <p>In the future, it is foreseen that portage will require a cryptographically
110     secure means of verifying ebuilds aquired from an rsync mirror are identical
111     to those checked into the portage tree by a developer <a class="footnote-reference" href="#id20" id="id6" name="id6">[10]</a> . Making developer keys
112     available to users for manually checking the integrity of files, or patches
113     sent to them is important. It has long been known that encouraging the
114     use of gpg among developers is desirable <a class="footnote-reference" href="#id15" id="id7" name="id7">[5]</a> .</p>
115     <p>Should a security vulnerability of a serious nature ever be reported,
116     standard procedure <a class="footnote-reference" href="#id16" id="id8" name="id8">[6]</a> is to inform vendors before releasing the information
117     to full disclosure security discussion lists. Making the relevant maintainer's
118     key easily obtainable will allow reporters to encrypt their reports.</p>
119     </div>
120     <div class="section" id="rationale">
121     <h1><a class="toc-backref" href="#id23" name="rationale">Rationale</a></h1>
122     <p>Providing a finger daemon will allow users to instantly access information on
123     developers, and all details of that developers current projects that they decide
124     to share.</p>
125     <p>GPG keys for all developers will be instantly availble, and the output of the
126     finger <a class="reference" href="mailto:devname&#64;gentoo.org">devname&#64;gentoo.org</a> command can be piped into gpg --import to instantly
127     add it to the users keyring.</p>
128     <p>The following projects use finger for user-developer communications,:</p>
129     <pre class="literal-block">
130     Latest kernel releases, and developer information.
131     $ finger &#64;kernel.org
132    
133     Developers and organisers are encouraged to keep .plans about their
134     activity.
135     $ finger nugget&#64;distributed.net
136    
137     Latest NASA news, and information from engineers.
138     $ finger nasanews&#64;space.mit.edu
139    
140     Slackware developers.
141     $ finger volkerdi&#64;slackware.com
142    
143     FreeBSD developers.
144     $ finger nakai&#64;freebsd.org
145     </pre>
146     </div>
147     <div class="section" id="implementation-and-security">
148     <h1><a class="toc-backref" href="#id24" name="implementation-and-security">Implementation and Security</a></h1>
149     <p>Some admins are concerned about the security of running a finger daemon on their
150     machines, the class of security issues involved with the finger protocol are
151     commonly referred to as &quot;information leaks&quot; <a class="footnote-reference" href="#id17" id="id9" name="id9">[7]</a>.</p>
152     <p>This means an attacker may be able to use a finger daemon to identify valid
153     accounts on their target, which they would then try to obtain access to.</p>
154     <p>This scenario does not apply to this implementation, as the gentoo developer
155     names are already well publicised. <a class="footnote-reference" href="#id18" id="id10" name="id10">[8]</a></p>
156     <p>No security issues have ever been reported with the fingerd available in gentoo
157     portage. Finger is used worldwide by universities, unix systems, and development
158     projects.</p>
159     <p>Adding dummy users, will be trivial and allow projects such as gentoo-docs,
160     gentoo-alpha, gentoo-ppc, etc to maintain .plans and .projects. This will allow
161     the projects to maintain more technical details or status updates not suitable
162     for their project webpages.</p>
163     <p>Adding data to a plan is a lot simpler than updating webpages.</p>
164     </div>
165     <div class="section" id="example-query">
166     <h1><a class="toc-backref" href="#id25" name="example-query">Example Query</a></h1>
167     <p>Should a user want information about the author, this might be the output of
168     a finger query:</p>
169     <pre class="literal-block">
170     $ finger taviso&#64;gentoo.org
171     Login: taviso Name: Tavis Ormandy
172     Directory: /home/taviso Shell: /bin/bash
173     Last login: dd-mmm-yyyy
174     Mail last read dd-mmm-yyy
175     Project:
176    
177     Currently working on implementing XXX, and porting XXX to XXX.
178    
179     Plan:
180    
181     dd-mmm-yyyy
182    
183     Investigating bug #12345, testing patch provided in #12236
184    
185     Write documentation for new features in XXX.
186    
187     dd-mmm-yyyy
188    
189     Contact acmesoft regarding license for xxx in portage.
190    
191     PGP Key:
192    
193     -----BEGIN PGP PUBLIC KEY BLOCK-----
194     Version: GnuPG v1.2.1 (Linux)
195     (...)
196     -----END PGP PUBLIC KEY BLOCK-----
197     </pre>
198     </div>
199     <div class="section" id="references">
200     <h1><a class="toc-backref" href="#id26" name="references">References</a></h1>
201     <table class="footnote" frame="void" id="id11" rules="none">
202     <colgroup><col class="label" /><col /></colgroup>
203     <tbody valign="top">
204     <tr><td class="label"><a class="fn-backref" href="#id1" name="id11">[1]</a></td><td><a class="reference" href="http://www.ietf.org/rfc/rfc0742.txt">http://www.ietf.org/rfc/rfc0742.txt</a></td></tr>
205     </tbody>
206     </table>
207     <table class="footnote" frame="void" id="id12" rules="none">
208     <colgroup><col class="label" /><col /></colgroup>
209     <tbody valign="top">
210     <tr><td class="label"><a class="fn-backref" href="#id2" name="id12">[2]</a></td><td><a class="reference" href="http://www.ietf.org/rfc/rfc1196.txt">http://www.ietf.org/rfc/rfc1196.txt</a></td></tr>
211     </tbody>
212     </table>
213     <table class="footnote" frame="void" id="id13" rules="none">
214     <colgroup><col class="label" /><col /></colgroup>
215     <tbody valign="top">
216     <tr><td class="label"><a class="fn-backref" href="#id3" name="id13">[3]</a></td><td><a class="reference" href="http://www.gentoo.org/dyn/pkgs/sys-apps/shadow.xml">http://www.gentoo.org/dyn/pkgs/sys-apps/shadow.xml</a></td></tr>
217     </tbody>
218     </table>
219     <table class="footnote" frame="void" id="id14" rules="none">
220     <colgroup><col class="label" /><col /></colgroup>
221     <tbody valign="top">
222     <tr><td class="label"><a class="fn-backref" href="#id4" name="id14">[4]</a></td><td><a class="reference" href="http://www.gnupg.org">http://www.gnupg.org</a></td></tr>
223     </tbody>
224     </table>
225     <table class="footnote" frame="void" id="id15" rules="none">
226     <colgroup><col class="label" /><col /></colgroup>
227     <tbody valign="top">
228     <tr><td class="label"><a class="fn-backref" href="#id7" name="id15">[5]</a></td><td>&lt;<a class="reference" href="mailto:20030629040521.4316b135.seemant&#64;gentoo.org">20030629040521.4316b135.seemant&#64;gentoo.org</a>&gt;</td></tr>
229     </tbody>
230     </table>
231     <table class="footnote" frame="void" id="id16" rules="none">
232     <colgroup><col class="label" /><col /></colgroup>
233     <tbody valign="top">
234     <tr><td class="label"><a class="fn-backref" href="#id8" name="id16">[6]</a></td><td><a class="reference" href="http://www.oisafety.org/process.html">http://www.oisafety.org/process.html</a></td></tr>
235     </tbody>
236     </table>
237     <table class="footnote" frame="void" id="id17" rules="none">
238     <colgroup><col class="label" /><col /></colgroup>
239     <tbody valign="top">
240     <tr><td class="label"><a class="fn-backref" href="#id9" name="id17">[7]</a></td><td><a class="reference" href="http://search.linuxsecurity.com/cgi-bin/htsearch?words=information%20leak">http://search.linuxsecurity.com/cgi-bin/htsearch?words=information%20leak</a></td></tr>
241     </tbody>
242     </table>
243     <table class="footnote" frame="void" id="id18" rules="none">
244     <colgroup><col class="label" /><col /></colgroup>
245     <tbody valign="top">
246     <tr><td class="label"><a class="fn-backref" href="#id10" name="id18">[8]</a></td><td><a class="reference" href="http://www.gentoo.org/main/en/devlist.xml">http://www.gentoo.org/main/en/devlist.xml</a></td></tr>
247     </tbody>
248     </table>
249     <table class="footnote" frame="void" id="id19" rules="none">
250     <colgroup><col class="label" /><col /></colgroup>
251     <tbody valign="top">
252     <tr><td class="label"><a class="fn-backref" href="#id5" name="id19">[9]</a></td><td><a class="reference" href="http://www.gentoo.org/proj/en/devrel/user-relations.xml">http://www.gentoo.org/proj/en/devrel/user-relations.xml</a></td></tr>
253     </tbody>
254     </table>
255     <table class="footnote" frame="void" id="id20" rules="none">
256     <colgroup><col class="label" /><col /></colgroup>
257     <tbody valign="top">
258     <tr><td class="label"><a class="fn-backref" href="#id6" name="id20">[10]</a></td><td><a class="reference" href="http://www.gentoo.org/news/en/gwn/20030407-newsletter.xml">http://www.gentoo.org/news/en/gwn/20030407-newsletter.xml</a></td></tr>
259     </tbody>
260     </table>
261     </div>
262     <div class="section" id="copyright">
263     <h1><a class="toc-backref" href="#id27" name="copyright">Copyright</a></h1>
264     <p>This document is released under the Open Publications License.</p>
265     </div>
266     </div>
267    
268     <hr class="footer"/>
269     <div class="footer">
270     <a class="reference" href="glep-0012.txt">View document source</a>.
271     Generated on: 2003-08-11 14:32 UTC.
272     Generated by <a class="reference" href="http://docutils.sourceforge.net/">Docutils</a> from <a class="reference" href="http://docutils.sourceforge.net/rst.html">reStructuredText</a> source.
273     </div>
274     </body>
275     </html>

  ViewVC Help
Powered by ViewVC 1.1.20