| 1 |
g2boojum |
1.1 |
GLEP: 12
|
| 2 |
|
|
Title: Gentoo.org Finger Daemon
|
| 3 |
g2boojum |
1.2 |
Version: $Revision: 1.1 $
|
| 4 |
|
|
Last-Modified: $Date: 2003/08/11 14:32:44 $
|
| 5 |
g2boojum |
1.1 |
Author: Tavis Ormandy <taviso@gentoo.org>
|
| 6 |
g2boojum |
1.2 |
Status: Rejected
|
| 7 |
g2boojum |
1.1 |
Type: Standards Track
|
| 8 |
|
|
Created: 10-Aug-2003
|
| 9 |
|
|
Post-History: 11-Aug-2003
|
| 10 |
|
|
|
| 11 |
g2boojum |
1.2 |
Reason for rejection
|
| 12 |
|
|
====================
|
| 13 |
|
|
|
| 14 |
|
|
Information about Gentoo development is already significantly fragmented.
|
| 15 |
|
|
Although this GLEP has its merits, the fact that it is a separate source
|
| 16 |
|
|
of information, rather than simply another conduit to existing sources
|
| 17 |
|
|
of information, poses more problems than it solves. Were this GLEP to
|
| 18 |
|
|
be resubmitted/modified so that finger was nothing more than an interface
|
| 19 |
|
|
into existing sources of information, it would probably be accepted.
|
| 20 |
|
|
|
| 21 |
|
|
|
| 22 |
g2boojum |
1.1 |
Abstract
|
| 23 |
|
|
========
|
| 24 |
|
|
|
| 25 |
|
|
The finger protocol is documented in rfc742 [1]_ and rfc1196 [2]_, a simple
|
| 26 |
|
|
protocol that returns a human readable report about a particular user
|
| 27 |
|
|
of the system. Typically, the information returned will be details such as
|
| 28 |
|
|
full name, location, etc. These details are entirely optional and are obtained
|
| 29 |
|
|
from the system passwd file, which of course can be edited or removed with the
|
| 30 |
|
|
standard chfn(1) [3]_ command.
|
| 31 |
|
|
|
| 32 |
|
|
The finger daemon will also return the contents of three files from the users home
|
| 33 |
|
|
directory, should they exist and be readable.
|
| 34 |
|
|
|
| 35 |
|
|
|
| 36 |
|
|
* ~/.project - which should contain information about the project currently being worked on.
|
| 37 |
|
|
* ~/.plan - which might contain work being done or a TODO style list.
|
| 38 |
|
|
* ~/.pgpkey - which would contain a PGP/GnuPG [4]_ public key block.
|
| 39 |
|
|
|
| 40 |
|
|
The finger protocol is mature, secure and widely used in the UNIX community.
|
| 41 |
|
|
There are clients available for all major operating systems, and web-based
|
| 42 |
|
|
clients for those that dont.
|
| 43 |
|
|
|
| 44 |
|
|
Motivation
|
| 45 |
|
|
==========
|
| 46 |
|
|
|
| 47 |
|
|
Gentoo developers are already aware of the importance of User Relations [9]_ .
|
| 48 |
|
|
|
| 49 |
|
|
It is essential to keep the community up to date with current goals, status
|
| 50 |
|
|
updates, and information from the development team. Currently it is suggested
|
| 51 |
|
|
users track mailing lists, monitor the Gentoo bugzilla, developer IRC
|
| 52 |
|
|
channels and cvs commits.
|
| 53 |
|
|
|
| 54 |
|
|
While the resources to track developer progress and activity are made
|
| 55 |
|
|
available to users, they are not in a form usable to many people. Keeping
|
| 56 |
|
|
track of development is a tedious challenge, even for developers. For
|
| 57 |
|
|
non-technical users wishing to track the progress of a developer, using
|
| 58 |
|
|
mailing lists and bugzilla may not be a practical option.
|
| 59 |
|
|
|
| 60 |
|
|
Developers may also need a way to quickly find out the progress or activity of
|
| 61 |
|
|
other developers, different time zones sometimes makes it difficult for
|
| 62 |
|
|
developers to catch each other on IRC, and making already high-volume mailing
|
| 63 |
|
|
lists even more cluttered with status updates is not desirable.
|
| 64 |
|
|
|
| 65 |
|
|
A method that would allow individual developers to keep a log of their
|
| 66 |
|
|
activities and plans that were instantly accesible to anyone who was
|
| 67 |
|
|
interested would be desirable, I propose running a finger daemon on
|
| 68 |
|
|
gentoo.org, or dev.gentoo.org and forwarding requests there from gentoo.org.
|
| 69 |
|
|
|
| 70 |
|
|
Running a developer finger daemon would improve inter developer communication,
|
| 71 |
|
|
user communication and relations, and reduce workload on developers who have to
|
| 72 |
|
|
respond to queries from users on project status updates.
|
| 73 |
|
|
|
| 74 |
|
|
In the future, it is foreseen that portage will require a cryptographically
|
| 75 |
|
|
secure means of verifying ebuilds aquired from an rsync mirror are identical
|
| 76 |
|
|
to those checked into the portage tree by a developer [10]_ . Making developer keys
|
| 77 |
|
|
available to users for manually checking the integrity of files, or patches
|
| 78 |
|
|
sent to them is important. It has long been known that encouraging the
|
| 79 |
|
|
use of gpg among developers is desirable [5]_ .
|
| 80 |
|
|
|
| 81 |
|
|
Should a security vulnerability of a serious nature ever be reported,
|
| 82 |
|
|
standard procedure [6]_ is to inform vendors before releasing the information
|
| 83 |
|
|
to full disclosure security discussion lists. Making the relevant maintainer's
|
| 84 |
|
|
key easily obtainable will allow reporters to encrypt their reports.
|
| 85 |
|
|
|
| 86 |
|
|
Rationale
|
| 87 |
|
|
=========
|
| 88 |
|
|
|
| 89 |
|
|
Providing a finger daemon will allow users to instantly access information on
|
| 90 |
|
|
developers, and all details of that developers current projects that they decide
|
| 91 |
|
|
to share.
|
| 92 |
|
|
|
| 93 |
|
|
GPG keys for all developers will be instantly availble, and the output of the
|
| 94 |
|
|
finger devname@gentoo.org command can be piped into gpg --import to instantly
|
| 95 |
|
|
add it to the users keyring.
|
| 96 |
|
|
|
| 97 |
|
|
The following projects use finger for user-developer communications,::
|
| 98 |
|
|
|
| 99 |
|
|
Latest kernel releases, and developer information.
|
| 100 |
|
|
$ finger @kernel.org
|
| 101 |
|
|
|
| 102 |
|
|
Developers and organisers are encouraged to keep .plans about their
|
| 103 |
|
|
activity.
|
| 104 |
|
|
$ finger nugget@distributed.net
|
| 105 |
|
|
|
| 106 |
|
|
Latest NASA news, and information from engineers.
|
| 107 |
|
|
$ finger nasanews@space.mit.edu
|
| 108 |
|
|
|
| 109 |
|
|
Slackware developers.
|
| 110 |
|
|
$ finger volkerdi@slackware.com
|
| 111 |
|
|
|
| 112 |
|
|
FreeBSD developers.
|
| 113 |
|
|
$ finger nakai@freebsd.org
|
| 114 |
|
|
|
| 115 |
|
|
Implementation and Security
|
| 116 |
|
|
===========================
|
| 117 |
|
|
|
| 118 |
|
|
Some admins are concerned about the security of running a finger daemon on their
|
| 119 |
|
|
machines, the class of security issues involved with the finger protocol are
|
| 120 |
|
|
commonly referred to as "information leaks" [7]_.
|
| 121 |
|
|
|
| 122 |
|
|
This means an attacker may be able to use a finger daemon to identify valid
|
| 123 |
|
|
accounts on their target, which they would then try to obtain access to.
|
| 124 |
|
|
|
| 125 |
|
|
This scenario does not apply to this implementation, as the gentoo developer
|
| 126 |
|
|
names are already well publicised. [8]_
|
| 127 |
|
|
|
| 128 |
|
|
No security issues have ever been reported with the fingerd available in gentoo
|
| 129 |
|
|
portage. Finger is used worldwide by universities, unix systems, and development
|
| 130 |
|
|
projects.
|
| 131 |
|
|
|
| 132 |
|
|
Adding dummy users, will be trivial and allow projects such as gentoo-docs,
|
| 133 |
|
|
gentoo-alpha, gentoo-ppc, etc to maintain .plans and .projects. This will allow
|
| 134 |
|
|
the projects to maintain more technical details or status updates not suitable
|
| 135 |
|
|
for their project webpages.
|
| 136 |
|
|
|
| 137 |
|
|
Adding data to a plan is a lot simpler than updating webpages.
|
| 138 |
|
|
|
| 139 |
|
|
Example Query
|
| 140 |
|
|
=============
|
| 141 |
|
|
|
| 142 |
|
|
Should a user want information about the author, this might be the output of
|
| 143 |
|
|
a finger query::
|
| 144 |
|
|
|
| 145 |
|
|
$ finger taviso@gentoo.org
|
| 146 |
|
|
Login: taviso Name: Tavis Ormandy
|
| 147 |
|
|
Directory: /home/taviso Shell: /bin/bash
|
| 148 |
|
|
Last login: dd-mmm-yyyy
|
| 149 |
|
|
Mail last read dd-mmm-yyy
|
| 150 |
|
|
Project:
|
| 151 |
|
|
|
| 152 |
|
|
Currently working on implementing XXX, and porting XXX to XXX.
|
| 153 |
|
|
|
| 154 |
|
|
Plan:
|
| 155 |
|
|
|
| 156 |
|
|
dd-mmm-yyyy
|
| 157 |
|
|
|
| 158 |
|
|
Investigating bug #12345, testing patch provided in #12236
|
| 159 |
|
|
|
| 160 |
|
|
Write documentation for new features in XXX.
|
| 161 |
|
|
|
| 162 |
|
|
dd-mmm-yyyy
|
| 163 |
|
|
|
| 164 |
|
|
Contact acmesoft regarding license for xxx in portage.
|
| 165 |
|
|
|
| 166 |
|
|
PGP Key:
|
| 167 |
|
|
|
| 168 |
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
| 169 |
|
|
Version: GnuPG v1.2.1 (Linux)
|
| 170 |
|
|
(...)
|
| 171 |
|
|
-----END PGP PUBLIC KEY BLOCK-----
|
| 172 |
|
|
|
| 173 |
|
|
References
|
| 174 |
|
|
==========
|
| 175 |
|
|
|
| 176 |
|
|
.. [1] http://www.ietf.org/rfc/rfc0742.txt
|
| 177 |
|
|
.. [2] http://www.ietf.org/rfc/rfc1196.txt
|
| 178 |
|
|
.. [3] http://www.gentoo.org/dyn/pkgs/sys-apps/shadow.xml
|
| 179 |
|
|
.. [4] http://www.gnupg.org
|
| 180 |
|
|
.. [5] <20030629040521.4316b135.seemant@gentoo.org>
|
| 181 |
|
|
.. [6] http://www.oisafety.org/process.html
|
| 182 |
|
|
.. [7] http://search.linuxsecurity.com/cgi-bin/htsearch?words=information%20leak
|
| 183 |
|
|
.. [8] http://www.gentoo.org/main/en/devlist.xml
|
| 184 |
|
|
.. [9] http://www.gentoo.org/proj/en/devrel/user-relations.xml
|
| 185 |
|
|
.. [10] http://www.gentoo.org/news/en/gwn/20030407-newsletter.xml
|
| 186 |
|
|
|
| 187 |
|
|
Copyright
|
| 188 |
|
|
=========
|
| 189 |
|
|
|
| 190 |
|
|
This document is released under the Open Publications License.
|
Parent Directory
| 
Revision Log