Re: new host key?: Re: compromise of gluck.debian.org, lock down of other debian.org machines

2006-07-30 Thread Brian May
Osamu == Osamu Aoki [EMAIL PROTECTED] writes: Osamu Hi, Are you sure it is Debian gluck issue? It was working fine all the time up and until the compromise of gluck.debian.org. I haven't made any changes to the software on this computer, except to install the odd security fix. (I don't

Re: new host key?: Re: compromise of gluck.debian.org, lock down of other debian.org machines

2006-07-30 Thread Brian May
Brian == Brian May [EMAIL PROTECTED] writes: Brian (note: I am using ssh-krb5 - not that should matter - it Brian authenticated OK). Brian This is weird. Maybe I will need to experiment more. I just tried the standard ssh in sarge, and get the same results. -- Brian May [EMAIL

Re: new host key?: Re: compromise of gluck.debian.org, lock down of other debian.org machines

2006-07-30 Thread Brian May
Brian == Brian May [EMAIL PROTECTED] writes: Brian (note: I am using ssh-krb5 - not that should matter - it Brian authenticated OK). Brian This is weird. Maybe I will need to experiment more. Brian I just tried the standard ssh in sarge, and get the same Brian results. My

new host key?: Re: compromise of gluck.debian.org, lock down of other debian.org machines

2006-07-29 Thread Osamu Aoki
Hi, Are you sure it is Debian gluck issue? I can connect with SSH to it now with minor problem. On Sun, Jul 30, 2006 at 11:28:36AM +1000, Brian May wrote: ... debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'gluck.debian.org' is known and matches the RSA host key. debug1: Found key

Re: new host key?: Re: compromise of gluck.debian.org, lock down of other debian.org machines

2006-07-29 Thread Russ Allbery
Osamu Aoki [EMAIL PROTECTED] writes: PS: It would have been nicer if old hosk identification was backuped and used in new system. Well, not if the system had a root compromise. The attacker must be assumed to have the private host key, which means that reusing the same key would allow them to