Nabble - PGP

Re: IPv6 only works, both do not

2009-12-01T14:54:45Z

On 2009-12-01 at 09:21 -0300, Arturo 'Buanzo' Busleiman wrote:

> Hi!
>
> If I use, for instance:
>
> recon_address: 0.0.0.0 ::
> hkp_address: 0.0.0.0 ::
>
> (or 85.13.200.90 2a01:c0:2:1::2)
>
> Then sks dies.

Anything in the logs? db.log and recon.log in your basedir (which, if
not overriden, is the directory which SKS is started from).

Are you sure that SKS dies if you explicitly list one IPv4 and one IPv6
address and nothing else? This is the configuration I'm using, but not
on Linux:
recon_address: 94.142.241.93 2a02:898:31:0:48:4558:73:6b73
hkp_address: 94.142.241.93 2a02:898:31:0:48:4558:73:6b73

> Any ideas? This is linux 2.6.31

My suspicion is that your platform enables v4-mapped IPv6 sockets by
default, so when you listen on :: you are implicitly also accepting IPv4
connections.

There's no sane portable way for O'Caml programs to disable this (or
wasn't when I last checked). By contrast, if only one socket is used,
it will break on platforms where IPv6 sockets do not accept IPv4
connections by default.

Try just using "::" and then connecting to the server over IPv4. If it
works, one socket handles both. What addresses do you see for
connections then? ::ffff:ip.v4.addr.ess ? Do these match ACLs or do
things break?

I suspect that the logs have a socket bind error, address in use?

The general use case for explicit binding is to select *just* the IP
addresses you want to listen on and send from. So if you have 3 IPv6
addresses, you listen on just the sks address and your outgoing recon
connections come from that same IP, so will get past the membership
tests of your peers.

-Phil

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (169 bytes) Download Attachment

From forum: SKS Devel

IPv6 only works, both do not

2009-12-01T04:21:01Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi!

If I use, for instance:

recon_address: 0.0.0.0 ::
hkp_address: 0.0.0.0 ::

(or 85.13.200.90 2a01:c0:2:1::2)

Then sks dies.

If I ONLY use IPv6:

recon_address: ::
hkp_address: ::

sks runs perfect, and lsof shows the ipv6 listening socket.

Interesting detail, if I use the ipv6 LOOKBACK address, 4 and 6 work (but useless, of course)

recon_address: 0.0.0.0 ::1
hkp_address: 0.0.0.0 ::1

Any ideas? This is linux 2.6.31

- --
Arturo "Buanzo" Busleiman
Independent Linux and Security Consultant - OWASP - SANS - OISSG
http://www.buanzo.com.ar/pro/eng.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksVCioACgkQAlpOsGhXcE2mPgCfStrOg6rdyCgxAvPtoVsjFEeW
sjEAn1kBBVGlN04+6zhhP0/HYM95l45K
=xkj3
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Fail2ban, Nagios, thoughts...

2009-11-30T17:25:27Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi! Being a fail2ban developer (a program that uses regexes to match logfiles in real time and
firewall abusive clients by IP address) and a nagios maniac, after having sks in use for a couple
hours I thought about creating a fail2ban jail/config for sks' logs, and then some specific nagios
script.

Any feedback or ideas you can think of?

- --
Arturo "Buanzo" Busleiman
Independent Linux and Security Consultant - OWASP - SANS - OISSG
http://www.buanzo.com.ar/pro/eng.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksUcIcACgkQAlpOsGhXcE3iYgCeOB2/E7FaYxcqa4c6uY4wUoya
/SIAnj4hibneAp16xJBf6oP2sW9LtONP
=Qhj1
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T15:30:49Z

MailFighter.net Admin writes:

> What I still need is to configure my mailsync file, and test incoming pks over email.

Do you know people using PKS? The subject comes up here regularly
regarding how SKS should behave with regard to PKS. Their input would
be precious.

> The only errors so far:
>
> 2009-11-30 14:02:24 Error fetching key from hash FFD5C0C7664F01D38C370A09FB156111: Not_found

These errors occur frequently and are unarmful and normal. You should
see a couple of line preceding where this particular hash is deleted and
another one added instead. This is one of your keys being updated and
thus its hash changed (deleted and added). When the partner that sent
you the updated key tries to fetch the old version you do not have it
anymore thus this error message.

> Also, my main interest is to have some sort of XML or machine parseable output over the http
> interface, so I can implement a set of features into Enigform.

Depending upon your particular needs, adding options=mr (for machine
readable) to op=index may suit you: it outputs plain text.

Kim Minh.

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T10:48:45Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Daniel Kahn Gillmor wrote:
> PS i'm very interested in what you're working on, as i suspect i've been
> thinking over similar things. If you want to chat off-list about your
> project (or direct me to somewhere i can discuss it with you), let me know.

Hi Daniel, thanks!

Feel free to use any of this:

eMail (buanzo@... or root@... per your preference)
MSN/Gtalk: buanzo@...
IRC: on demand
Skype: buanzo (I'm currently trying to get skype to work again with ubuntu 9.10!).

http://wiki.buanzo.org has a couple interesting articles.

:)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksUE40ACgkQAlpOsGhXcE29pQCfaT8vVI7067lF2x5twDucprS+
1vMAn3N/1h8+R7FhXJvB3CNPjnWIYNbw
=4bF9
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T10:35:40Z

On 11/30/2009 12:22 PM, MailFighter.net Admin wrote:
> My interest is in being able to get what keyids have signed a certain key, in a machine parsable format.

Keyservers can't actually tell you that reliably. As far as i know, SKS
does no cryptographic validation on the signatures it publishes.

one way to think about this is I might make a key ("X") that is not
uploaded to the keyservers. but X might be used to certify another key
("Y"), and that certification might be published to the keyservers.
When SKS serves up Y, it should include X's certification, even if it
knows nothing about X. It *cannot* validate the signature in that case.

Even if the keyserver *did* validation, a cryptographically-secure
application should verify the signatures itself anyway (why trust the
keyserver?). In addition, most keyservers are accessed in the clear
(there's only one hkps keyserver in existence that i know of), which is
problematic too.

Regards,

--dkg

PS i'm very interested in what you're working on, as i suspect i've been
thinking over similar things. If you want to chat off-list about your
project (or direct me to somewhere i can discuss it with you), let me know.

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

signature.asc (909 bytes) Download Attachment

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T09:22:43Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Daniel Kahn Gillmor wrote:
> The output should already be machine-parseable (though it's not XML).

OK, so, I want this:

http://sks.buanzo.org:11371/pks/lookup?op=vindex&search=0x025A4EB06857704D

into mr.

But if I add &options=mr, then I get less information. Compare:

http://sks.buanzo.org:11371/pks/lookup?op=vindex&search=0x025A4EB06857704D&options=mr

My interest is in being able to get what keyids have signed a certain key, in a machine parsable format.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksT/2MACgkQAlpOsGhXcE3FMgCfcAKXnvBaqpjUzRCMDJ/U8rS5
2lgAn1nXJFiuQfDjgi23QsKAGJ06xHrt
=GSiw
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T09:14:08Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Daniel Kahn Gillmor wrote:
> The output should already be machine-parseable (though it's not XML).
> Have you read David Shaw's I-D which documents the interface?

Lol, I was JUST starting to read it :)

Thank you Daniel.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksT/WAACgkQAlpOsGhXcE2edQCfedNB/TSP77ZZEGpZAplD4S9w
fjoAni2lpXdVgkPKIXhbO5iJ1Ryr5UVj
=c0S+
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T08:42:39Z

On 11/30/2009 09:05 AM, MailFighter.net Admin wrote:
> Also, my main interest is to have some sort of XML or machine parseable output over the http
> interface, so I can implement a set of features into Enigform.

The output should already be machine-parseable (though it's not XML).
Have you read David Shaw's I-D which documents the interface?

http://tools.ietf.org/html/draft-shaw-openpgp-hkp-00

Regards,

--dkg

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

signature.asc (909 bytes) Download Attachment

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T06:05:23Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

MailFighter.net Admin wrote:
> I'll start testing it right away. Thanks everybody.

OK. The logs show that keys are being received, and all 4 membership entries appear to be functional.

What I still need is to configure my mailsync file, and test incoming pks over email.

Also, gpg --keyserver sks.buanzo.org --recv-keys 64011A8B works.

The only errors so far:

2009-11-30 14:02:24 Error fetching key from hash FFD5C0C7664F01D38C370A09FB156111: Not_found

... but those seem to have stopped now. Probably the key got downloaded from another server.

So, all seems fine. I gotta setup the web interface now.

Also, my main interest is to have some sort of XML or machine parseable output over the http
interface, so I can implement a set of features into Enigform.

Yours,
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksT0SMACgkQAlpOsGhXcE3zkgCdErmhN1ACAxCkRGA2f4aV4J1o
OlYAn0dYQqERvVARn0VM5tY2pjanJkRI
=a7/c
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Hi everybody!

2009-11-30T05:44:19Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi everybody!

I've compiled by hand (I had to tweak /usr/include/bits/string3.h in Ubuntu 9.10 for it to compile,
just change line 96 from __extern_always_inline to __extern_inline, ugly, but works, remember to
change it back).

I've setup my membership file according to the numerous offers I've received (thank you guys). The
PKS address I've setup is sks-admin@... and I've setup sks to run on IPv4 and IPv6.

I'll start testing it right away. Thanks everybody.

Yours,
Buanzo

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksTzDIACgkQAlpOsGhXcE3DRQCcDCekxYut9GKnDEYRZIWEIapr
Z20An05RPgx03lBzMcXIwFHI9IhRF8ku
=/LJD
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

keyserver.nyfnet.net currently down...

2009-11-29T22:20:44Z

Due to circumstances beyond my control, my WAN connection is currently
offline. As a result, anybody who is peering with me will be seeing
it as currently broken. I do not anticipate this issue to last more
than a week or so. I apologize for any inconvenience this may cause.
If you have any question, please feel free to forward them to me and
I'll be more than happy to reply.

Faith Manages,

-A
keyserver.nyfnet.net 11370

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Re: Hi everybody!

2009-11-29T22:17:40Z

Feel free to add my server, as well. WAN connection is currently
down, so it'll say broken link, but I should be getting that restored
within a week or so.

keyserver.nyfnet.net 11370

On Sun, Nov 29, 2009 at 4:13 PM, MailFighter.net Admin
<root@...> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Daniel Kahn Gillmor wrote:
>> Are you filing bugs about this with ubuntu? it would be really good for
>> them to know that their packages are busted (with as much detail as
>> possible).
>
> It's this Debian bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=535469
>
> It's exactly the same problem:
> root@mx4:~# sks recon
> unknown timeout type argument to DB_ENV->rep_get_timeout
> Segmentation fault
> root@mx4:~# sks db
> unknown timeout type argument to DB_ENV->rep_get_timeout
> Segmentation fault
>
> I felt no need to notify Ubuntu, but I can start working on that if you want.
>
> Yours,
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEAREKAAYFAksTDi0ACgkQAlpOsGhXcE21vQCfTu+PaCGaDreNBH9Wkn3JAvlx
> ekEAn22CVGRklmsGjsqzIquMuZzv+h9b
> =RrY2
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> Sks-devel mailing list
> Sks-devel@...
> http://lists.nongnu.org/mailman/listinfo/sks-devel
>

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Re: Hi everybody!

2009-11-29T16:13:33Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Daniel Kahn Gillmor wrote:
> Are you filing bugs about this with ubuntu? it would be really good for
> them to know that their packages are busted (with as much detail as
> possible).

It's this Debian bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=535469

It's exactly the same problem:
root@mx4:~# sks recon
unknown timeout type argument to DB_ENV->rep_get_timeout
Segmentation fault
root@mx4:~# sks db
unknown timeout type argument to DB_ENV->rep_get_timeout
Segmentation fault

I felt no need to notify Ubuntu, but I can start working on that if you want.

Yours,

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksTDi0ACgkQAlpOsGhXcE21vQCfTu+PaCGaDreNBH9Wkn3JAvlx
ekEAn22CVGRklmsGjsqzIquMuZzv+h9b
=RrY2
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Re: Hi everybody!

2009-11-29T16:08:37Z

On 11/29/2009 07:03 PM, MailFighter.net Admin wrote:
> root@mx4:/var/lib/sks# sks build -n 13 -cache 100 /var/sks/dump/*.pgp
> unknown timeout type argument to DB_ENV->rep_get_timeout
> Segmentation fault
>
> It SIGSEGV's immediately. It's not a RAM problem.
>
> I'll compile sks manually and ignore Ubuntu's packages for it.

Are you filing bugs about this with ubuntu? it would be really good for
them to know that their packages are busted (with as much detail as
possible).

--dkg

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

signature.asc (909 bytes) Download Attachment

From forum: SKS Devel

Re: Re: Hi everybody!

2009-11-29T16:03:14Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

John Clizbe wrote:
> I ran
> sks build -n 13 -cache 100 /var/sks/dump/*.pgp

root@mx4:/var/lib/sks# sks build -n 13 -cache 100 /var/sks/dump/*.pgp
unknown timeout type argument to DB_ENV->rep_get_timeout
Segmentation fault

It SIGSEGV's immediately. It's not a RAM problem.

I'll compile sks manually and ignore Ubuntu's packages for it.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksTC78ACgkQAlpOsGhXcE0sOgCdHhByj632w/8fS0NX2rjBa5LZ
1D0An1uAnc/wz52XAwlGof5GHNWPAG4+
=FGWS
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Re: Hi everybody!

2009-11-29T15:03:01Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Jens Leinenbach wrote:
> Where/when exactly do you get the segfault? After starting sks_build.sh?
> Does your system run out of memory?

See below for a trace.

> E.g. if you don't have much RAM:

root@mx4:/var/lib/sks# free -m
total used free shared buffers cached
Mem: 2012 467 1544 0 19 240
- -/+ buffers/cache: 208 1803
Swap: 3812 0 3812

root@mx4:/var/lib/sks# uname -a
Linux mx4 2.6.31-15-generic-pae #50-Ubuntu SMP Tue Nov 10 16:12:10 UTC 2009 i686 GNU/Linux

CPU: Dual Intel(R) Xeon(R) CPU 3065 @ 2.33GHz

Would that be ok?

> /usr/sbin/sks build /var/lib/sks/dump/keydump* -n 1 -cache 20

I tried different values for the parameters, to no avail. From what I read, the problem is related
to two different versions of libdb...

===trace start====
root@mx4:/var/lib/sks# /usr/lib/sks/sks_build.sh
+ ask_mode
+ echo 'Please select the mode in which you want to import the keydump:'
Please select the mode in which you want to import the keydump:
+ echo ''

+ echo '1 - fastbuild'
1 - fastbuild
+ echo ' only an index of the keydump is created and the keydump cannot be'
only an index of the keydump is created and the keydump cannot be
+ echo ' removed.'
removed.
+ echo ''

+ echo '2 - normalbuild'
2 - normalbuild
+ echo ''

+ echo ' all the keydump will be imported in a new database. It takes longer'
all the keydump will be imported in a new database. It takes longer
+ echo ' time and more disk space, but the server will run faster (depending'
time and more disk space, but the server will run faster (depending
+ echo ' from the source/age of the keydump).'
from the source/age of the keydump).
+ echo ' The keydump can be removed after the import.'
The keydump can be removed after the import.
+ echo ''

+ echo -n 'Enter enter the mode (1/2): '
Enter enter the mode (1/2): + read
2
+ case "$REPLY" in
+ mode='build /var/lib/sks/dump/*.pgp'
+ echo '=== Running (fast)build... ==='
=== Running (fast)build... ===
+ /usr/sbin/sks build /var/lib/sks/dump/sks-dump-0000.pgp /var/lib/sks/dump/sks-dump-0001.pgp
/var/lib/sks/dump/sks-dump-0002.pgp /var/lib/sks/dump/sks-dump-0003.pgp
/var/lib/sks/dump/sks-dump-0004.pgp /var/lib/sks/dump/sks-dump-0005.pgp
/var/lib/sks/dump/sks-dump-0006.pgp /var/lib/sks/dump/sks-dump-0007.pgp
/var/lib/sks/dump/sks-dump-0008.pgp /var/lib/sks/dump/sks-dump-0009.pgp
/var/lib/sks/dump/sks-dump-0010.pgp /var/lib/sks/dump/sks-dump-0011.pgp
/var/lib/sks/dump/sks-dump-0012.pgp /var/lib/sks/dump/sks-dump-0013.pgp
/var/lib/sks/dump/sks-dump-0014.pgp /var/lib/sks/dump/sks-dump-0015.pgp
/var/lib/sks/dump/sks-dump-0016.pgp /var/lib/sks/dump/sks-dump-0017.pgp
/var/lib/sks/dump/sks-dump-0018.pgp /var/lib/sks/dump/sks-dump-0019.pgp
/var/lib/sks/dump/sks-dump-0020.pgp /var/lib/sks/dump/sks-dump-0021.pgp
/var/lib/sks/dump/sks-dump-0022.pgp /var/lib/sks/dump/sks-dump-0023.pgp
/var/lib/sks/dump/sks-dump-0024.pgp /var/lib/sks/dump/sks-dump-0025.pgp
/var/lib/sks/dump/sks-dump-0026.pgp /var/lib/sks/dump/sks-dump-0027.pgp
/var/lib/sks/dump/sks-dump-0028.pgp /var/lib/sks/dump/sks-dump-0029.pgp
/var/lib/sks/dump/sks-dump-0030.pgp /var/lib/sks/dump/sks-dump-0031.pgp
/var/lib/sks/dump/sks-dump-0032.pgp /var/lib/sks/dump/sks-dump-0033.pgp
/var/lib/sks/dump/sks-dump-0034.pgp /var/lib/sks/dump/sks-dump-0035.pgp
/var/lib/sks/dump/sks-dump-0036.pgp /var/lib/sks/dump/sks-dump-0037.pgp
/var/lib/sks/dump/sks-dump-0038.pgp /var/lib/sks/dump/sks-dump-0039.pgp
/var/lib/sks/dump/sks-dump-0040.pgp /var/lib/sks/dump/sks-dump-0041.pgp
/var/lib/sks/dump/sks-dump-0042.pgp /var/lib/sks/dump/sks-dump-0043.pgp
/var/lib/sks/dump/sks-dump-0044.pgp /var/lib/sks/dump/sks-dump-0045.pgp
/var/lib/sks/dump/sks-dump-0046.pgp /var/lib/sks/dump/sks-dump-0047.pgp
/var/lib/sks/dump/sks-dump-0048.pgp /var/lib/sks/dump/sks-dump-0049.pgp
/var/lib/sks/dump/sks-dump-0050.pgp /var/lib/sks/dump/sks-dump-0051.pgp
/var/lib/sks/dump/sks-dump-0052.pgp /var/lib/sks/dump/sks-dump-0053.pgp
/var/lib/sks/dump/sks-dump-0054.pgp /var/lib/sks/dump/sks-dump-0055.pgp
/var/lib/sks/dump/sks-dump-0056.pgp /var/lib/sks/dump/sks-dump-0057.pgp
/var/lib/sks/dump/sks-dump-0058.pgp /var/lib/sks/dump/sks-dump-0059.pgp
/var/lib/sks/dump/sks-dump-0060.pgp /var/lib/sks/dump/sks-dump-0061.pgp
/var/lib/sks/dump/sks-dump-0062.pgp /var/lib/sks/dump/sks-dump-0063.pgp
/var/lib/sks/dump/sks-dump-0064.pgp /var/lib/sks/dump/sks-dump-0065.pgp
/var/lib/sks/dump/sks-dump-0066.pgp /var/lib/sks/dump/sks-dump-0067.pgp
/var/lib/sks/dump/sks-dump-0068.pgp /var/lib/sks/dump/sks-dump-0069.pgp
/var/lib/sks/dump/sks-dump-0070.pgp /var/lib/sks/dump/sks-dump-0071.pgp
/var/lib/sks/dump/sks-dump-0072.pgp /var/lib/sks/dump/sks-dump-0073.pgp
/var/lib/sks/dump/sks-dump-0074.pgp /var/lib/sks/dump/sks-dump-0075.pgp
/var/lib/sks/dump/sks-dump-0076.pgp /var/lib/sks/dump/sks-dump-0077.pgp
/var/lib/sks/dump/sks-dump-0078.pgp /var/lib/sks/dump/sks-dump-0079.pgp
/var/lib/sks/dump/sks-dump-0080.pgp /var/lib/sks/dump/sks-dump-0081.pgp
/var/lib/sks/dump/sks-dump-0082.pgp /var/lib/sks/dump/sks-dump-0083.pgp
/var/lib/sks/dump/sks-dump-0084.pgp /var/lib/sks/dump/sks-dump-0085.pgp
/var/lib/sks/dump/sks-dump-0086.pgp /var/lib/sks/dump/sks-dump-0087.pgp
/var/lib/sks/dump/sks-dump-0088.pgp /var/lib/sks/dump/sks-dump-0089.pgp
/var/lib/sks/dump/sks-dump-0090.pgp /var/lib/sks/dump/sks-dump-0091.pgp
/var/lib/sks/dump/sks-dump-0092.pgp /var/lib/sks/dump/sks-dump-0093.pgp
/var/lib/sks/dump/sks-dump-0094.pgp /var/lib/sks/dump/sks-dump-0095.pgp
/var/lib/sks/dump/sks-dump-0096.pgp /var/lib/sks/dump/sks-dump-0097.pgp
/var/lib/sks/dump/sks-dump-0098.pgp /var/lib/sks/dump/sks-dump-0099.pgp
/var/lib/sks/dump/sks-dump-0100.pgp /var/lib/sks/dump/sks-dump-0101.pgp
/var/lib/sks/dump/sks-dump-0102.pgp /var/lib/sks/dump/sks-dump-0103.pgp
/var/lib/sks/dump/sks-dump-0104.pgp /var/lib/sks/dump/sks-dump-0105.pgp
/var/lib/sks/dump/sks-dump-0106.pgp /var/lib/sks/dump/sks-dump-0107.pgp
/var/lib/sks/dump/sks-dump-0108.pgp /var/lib/sks/dump/sks-dump-0109.pgp
/var/lib/sks/dump/sks-dump-0110.pgp /var/lib/sks/dump/sks-dump-0111.pgp
/var/lib/sks/dump/sks-dump-0112.pgp /var/lib/sks/dump/sks-dump-0113.pgp
/var/lib/sks/dump/sks-dump-0114.pgp /var/lib/sks/dump/sks-dump-0115.pgp
/var/lib/sks/dump/sks-dump-0116.pgp /var/lib/sks/dump/sks-dump-0117.pgp
/var/lib/sks/dump/sks-dump-0118.pgp /var/lib/sks/dump/sks-dump-0119.pgp
/var/lib/sks/dump/sks-dump-0120.pgp /var/lib/sks/dump/sks-dump-0121.pgp
/var/lib/sks/dump/sks-dump-0122.pgp /var/lib/sks/dump/sks-dump-0123.pgp
/var/lib/sks/dump/sks-dump-0124.pgp /var/lib/sks/dump/sks-dump-0125.pgp
/var/lib/sks/dump/sks-dump-0126.pgp /var/lib/sks/dump/sks-dump-0127.pgp
/var/lib/sks/dump/sks-dump-0128.pgp /var/lib/sks/dump/sks-dump-0129.pgp
/var/lib/sks/dump/sks-dump-0130.pgp /var/lib/sks/dump/sks-dump-0131.pgp
/var/lib/sks/dump/sks-dump-0132.pgp /var/lib/sks/dump/sks-dump-0133.pgp
/var/lib/sks/dump/sks-dump-0134.pgp /var/lib/sks/dump/sks-dump-0135.pgp
/var/lib/sks/dump/sks-dump-0136.pgp /var/lib/sks/dump/sks-dump-0137.pgp
/var/lib/sks/dump/sks-dump-0138.pgp /var/lib/sks/dump/sks-dump-0139.pgp
/var/lib/sks/dump/sks-dump-0140.pgp /var/lib/sks/dump/sks-dump-0141.pgp
/var/lib/sks/dump/sks-dump-0142.pgp /var/lib/sks/dump/sks-dump-0143.pgp
/var/lib/sks/dump/sks-dump-0144.pgp /var/lib/sks/dump/sks-dump-0145.pgp
/var/lib/sks/dump/sks-dump-0146.pgp /var/lib/sks/dump/sks-dump-0147.pgp
/var/lib/sks/dump/sks-dump-0148.pgp /var/lib/sks/dump/sks-dump-0149.pgp
/var/lib/sks/dump/sks-dump-0150.pgp /var/lib/sks/dump/sks-dump-0151.pgp
/var/lib/sks/dump/sks-dump-0152.pgp /var/lib/sks/dump/sks-dump-0153.pgp
/var/lib/sks/dump/sks-dump-0154.pgp /var/lib/sks/dump/sks-dump-0155.pgp
/var/lib/sks/dump/sks-dump-0156.pgp /var/lib/sks/dump/sks-dump-0157.pgp
/var/lib/sks/dump/sks-dump-0158.pgp /var/lib/sks/dump/sks-dump-0159.pgp
/var/lib/sks/dump/sks-dump-0160.pgp /var/lib/sks/dump/sks-dump-0161.pgp
/var/lib/sks/dump/sks-dump-0162.pgp /var/lib/sks/dump/sks-dump-0163.pgp
/var/lib/sks/dump/sks-dump-0164.pgp /var/lib/sks/dump/sks-dump-0165.pgp
/var/lib/sks/dump/sks-dump-0166.pgp /var/lib/sks/dump/sks-dump-0167.pgp
/var/lib/sks/dump/sks-dump-0168.pgp /var/lib/sks/dump/sks-dump-0169.pgp
/var/lib/sks/dump/sks-dump-0170.pgp /var/lib/sks/dump/sks-dump-0171.pgp
/var/lib/sks/dump/sks-dump-0172.pgp /var/lib/sks/dump/sks-dump-0173.pgp
/var/lib/sks/dump/sks-dump-0174.pgp /var/lib/sks/dump/sks-dump-0175.pgp
/var/lib/sks/dump/sks-dump-0176.pgp /var/lib/sks/dump/sks-dump-0177.pgp
/var/lib/sks/dump/sks-dump-0178.pgp /var/lib/sks/dump/sks-dump-0179.pgp
/var/lib/sks/dump/sks-dump-0180.pgp /var/lib/sks/dump/sks-dump-0181.pgp
/var/lib/sks/dump/sks-dump-0182.pgp /var/lib/sks/dump/sks-dump-0183.pgp
/var/lib/sks/dump/sks-dump-0184.pgp -n 10 -cache 100
unknown timeout type argument to DB_ENV->rep_get_timeout
/usr/lib/sks/sks_build.sh: line 43: 4106 Segmentation fault /usr/sbin/sks $mode -n 10 -cache 100
+ fail
+ echo Command failed unexpectedly. Bailing out
Command failed unexpectedly. Bailing out
+ exit
===trace end======

===strace=======
mkdir("/var/lib/sks/DB", 0700) = 0
time(NULL) = 1259535735
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3661, ...}) = 0
write(4, "2009-11-29 23:02:15 Opening KeyD"..., 43) = 43
write(2, "unknown timeout type argument to"..., 56unknown timeout type argument to
DB_ENV->rep_get_timeout) = 56
write(2, "\n", 1
) = 1
- --- SIGSEGV (Segmentation fault) @ 0 (0) ---
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
rt_sigaction(SIGSEGV, {SIG_DFL, [], 0}, NULL, 8) = 0
sigreturn() = ? (mask now [])
- --- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
===strace end===

Any ideas?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksS/aMACgkQAlpOsGhXcE3NiwCcCg5jshmaq3TANR/M4byffhTu
GmMAn3OHADPdvPxcWwSw/7DY9mQkqpHv
=QwJK
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Re: Hi everybody!

2009-11-29T14:55:21Z

Hi Buanzo,
> Now, I finished downloading the dump, but I'musing Ubuntu, and it
> fails with a segfault.
Where/when exactly do you get the segfault? After starting sks_build.sh?
Does your system run out of memory?

Then try to reduce memory usage by reducing the cache values of sks_build.sh

E.g. if you don't have much RAM:
/usr/sbin/sks build /var/lib/sks/dump/keydump* -n 1 -cache 20

(Change the paths for your needs.)

Cheers,
Jens

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Re: Hi everybody!

2009-11-29T14:49:20Z

MailFighter.net Admin wrote:
> First of all,
>
> Thanks to everyone that emailed me off-list offering to peer up. :)
>
> Now, I finished downloading the dump, but I'm using Ubuntu, and it fails with
> a segfault. I know it's got to do with different versions of libdb (compiled
> vs runtime), so I upgraded to karmic. Still the same problem. Ergo, I'm stuck.
>
> SO, should I just d/l && configure && make && make install?

SKS builds pretty easily. You just need a libdb >= 4.6 and a recent ocaml compiler.

That's what I would do.
--
John P. Clizbe Inet:John (a) Mozilla-Enigmail.org
You can't spell fiasco without SCO. hkp://keyserver.gingerbear.net or
mailto:pgp-public-keys@...?subject=HELP

Q:"Just how do the residents of Haiku, Hawai'i hold conversations?"
A:"An odd melody / island voices on the winds / surplus of vowels"

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Hi everybody!

2009-11-29T14:32:02Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

First of all,

Thanks to everyone that emailed me off-list offering to peer up. :)

Now, I finished downloading the dump, but I'musing Ubuntu, and it fails with a segfault. I know it's
got to do with different versions of libdb (compiled vs runtime), so I upgraded to karmic. Still the
same problem. Ergo, I'm stuck.

SO, should I just d/l && configure && make && make install?

Yours,

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksS9l8ACgkQAlpOsGhXcE31hgCeOTilT+DT8WYPVLLmtFJX61mL
9DsAnRrCOm9sMG7XtJ6h5g/oRiJvFME3
=0MBB
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: New wiki page: Peering

2009-11-28T20:25:20Z

On 2009-11-28 at 09:48 +0000, Kim Minh Kaplan wrote:
> You could explicit that you mean something like "make && make install"
> or "aptitude install sks" as peering itself might be considered part of
> the installation process.

I opted for "You are assumed to have installed the SKS program and to
[...]".

> SKS basedir
>
> Unlike many daemons SKS makes use of its current working directory as
> its basedir. It should be mentionned.

Done.

> Phil Pennock:
> > I'm not sure that membership_reload_interval is necessary any more,
> > after Kim's improvements in this area. I put it in anyway, to be safe,
> > but would be happy to remove it again; Kim?
>
> I am quite confident that this setting is not used anymore (and that the
> code could do with a little cleanup regarding this). So yes remove it.

Done.

> The server is in The Netherlands.
>
> Use a non existant country in the sample. The Neverland is nice.

I'm based in the USA and wary of trademarks; I strongly suspect that the
estate of a recently deceased pop star has a trademark on that. I went
for "Foobarlandy (EU)".

> Add the line to your config
>
> Explicit mention of "membership file" would be better than config.

Done.

> Also a couple of words mentionning that SKS logs to db.log, recon.log
> and generally *.log will help the new user.

Done.

> The "-disable_mailsync" option should be explained as it is a loose end
> in SKS.

Done.

> in SKS. Given the state of the PKS network it is perfectly acceptable
> to use it. At any rate if the mailsync file is empty it can be used to
> keep the db process from spitting false alarms in the logs. Mmm,
> looking back at it these alarms are not completely false: it seems there
> is a leak in the tqueue DB when you have no mailsync, I'll have to file
> an issue about that.

Looking forward to the patch. :)

> Kim Minh.
>
> P.S.: browsing http://code.google.com/p/sks-keyserver/source/browse/
> does *not* show all source files, it stops at reconserver.ml. Am I the
> only one seeing this?

"Files 1 - 100 of 126"

It's not as clear as it could be.

-Phil

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (169 bytes) Download Attachment

From forum: SKS Devel

Re: New wiki page: Peering

2009-11-28T20:11:58Z

On 2009-11-28 at 10:54 -0500, Daniel Kahn Gillmor wrote:

> Actually, for examples IP addresses, please use documentation-specific
> values for IP addresses (in the so-called TEST-NET range):
>
> For IPv6, use addresses in the range: 2001:db8::/32
>
> http://tools.ietf.org/html/rfc5156#section-2.6
> http://tools.ietf.org/html/rfc3849
>
> For IPv4, use addresses in the range: 192.0.2.0/24
>
> http://tools.ietf.org/html/rfc3330#page-3

These are in fact what I did use.

Thanks,
-Phil

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (169 bytes) Download Attachment

From forum: SKS Devel

Re: New wiki page: Peering

2009-11-28T17:20:14Z

Daniel Kahn Gillmor writes:

> On 11/28/2009 04:48 AM, Kim Minh Kaplan wrote:
>
>> myhost.example.com. IN A 192.68.2.42
>> myhost.example.com. IN AAAA FDA6:58A1:7B2E:AAF9::1:42
>
> Actually, for examples IP addresses, please use documentation-specific
> values for IP addresses (in the so-called TEST-NET range):
>
> For IPv6, use addresses in the range: 2001:db8::/32
>
> http://tools.ietf.org/html/rfc5156#section-2.6
> http://tools.ietf.org/html/rfc3849
>
> For IPv4, use addresses in the range: 192.0.2.0/24
>
> http://tools.ietf.org/html/rfc3330#page-3

I did not know about these reserved addresses ranges, thank you for the
information and references.

Kim Minh.

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Hi everybody!

2009-11-28T15:43:17Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hello! I'm in the process of becoming part of the sks pool. I'm currently downloading the dump (will
be over in 30 more minutes), then I'll build the database, and after all that, I'll ask for some
peers to gossip with.

My server (sks.buanzo.org both IPv4 and IPv6, dns has both A and AAAA records) is located in
Stratford, London, UK, in a nice datacenter facility with great bandwidth and uptime, so I hope I'll
get peers soon.

Well, about myself: I've been programming since age 8 (I'm 27 now), with GNU/Linux and 'stuff' since
I was 12 (1994). I enjoy programming, hacking up stuff, and I also run a number of NTP servers for
the pool.ntp.org. I created mod_openpgp and Enigform, a set of server (Apache) and client (firefox)
tools that implemented OpenPGP stuff for HTTP (signed requests, and a secure session initiation
method created on top of that, more info in wiki.buanzo.org).

Well, hope that's enough for an introduction :)

I'm available for IM, eMail, etc. Not much of an IRCer.

Bye!

Yours,
Buanzo.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAksRtZUACgkQAlpOsGhXcE0gpACffDfYqCDtmOMfGo52pW5SJfMl
9uUAn0LBeT7YgfZbhAwKYD1HvquwtmoN
=e9gF
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: New wiki page: Peering

2009-11-28T07:54:06Z

On 11/28/2009 04:48 AM, Kim Minh Kaplan wrote:
> Phil Pennock:
>
>> I just wrote this:
>>
>> http://code.google.com/p/sks-keyserver/wiki/Peering

Thanks, Phil!

> Sample DNS records could help ; and use non routable addresses¹ in your
> examples. Something like:
>
> myhost.example.com. IN A 192.68.2.42
> myhost.example.com. IN AAAA FDA6:58A1:7B2E:AAF9::1:42
> keyserver.example.com. IN A myhost.example.com.

Actually, for examples IP addresses, please use documentation-specific
values for IP addresses (in the so-called TEST-NET range):

For IPv6, use addresses in the range: 2001:db8::/32

http://tools.ietf.org/html/rfc5156#section-2.6
http://tools.ietf.org/html/rfc3849

For IPv4, use addresses in the range: 192.0.2.0/24

http://tools.ietf.org/html/rfc3330#page-3

Please do *not* use RFC1918 private address space, because it might
actually be in use by people reading the examples.

Thanks,

--dkg

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

signature.asc (909 bytes) Download Attachment

From forum: SKS Devel

Re: New wiki page: Peering

2009-11-28T01:48:26Z

Phil Pennock:

> I just wrote this:
>
> http://code.google.com/p/sks-keyserver/wiki/Peering

Nice work. Here are some hopefully constructive comments.

You are assumed to have installed SKS

You could explicit that you mean something like "make && make install"
or "aptitude install sks" as peering itself might be considered part of
the installation process.

SKS basedir

Unlike many daemons SKS makes use of its current working directory as
its basedir. It should be mentionned.

Double-check DNS

Sample DNS records could help ; and use non routable addresses¹ in your
examples. Something like:

myhost.example.com. IN A 192.68.2.42
myhost.example.com. IN AAAA FDA6:58A1:7B2E:AAF9::1:42
keyserver.example.com. IN A myhost.example.com.

> I'm not sure that membership_reload_interval is necessary any more,
> after Kim's improvements in this area. I put it in anyway, to be safe,
> but would be happy to remove it again; Kim?

I am quite confident that this setting is not used anymore (and that the
code could do with a little cleanup regarding this). So yes remove it.

The server is in The Netherlands.

Use a non existant country in the sample. The Neverland is nice.

Add the line to your config

Explicit mention of "membership file" would be better than config.

Also a couple of words mentionning that SKS logs to db.log, recon.log
and generally *.log will help the new user.

The "-disable_mailsync" option should be explained as it is a loose end
in SKS. Given the state of the PKS network it is perfectly acceptable
to use it. At any rate if the mailsync file is empty it can be used to
keep the db process from spitting false alarms in the logs. Mmm,
looking back at it these alarms are not completely false: it seems there
is a leak in the tqueue DB when you have no mailsync, I'll have to file
an issue about that.

Kim Minh.

P.S.: browsing http://code.google.com/p/sks-keyserver/source/browse/
does *not* show all source files, it stops at reconserver.ml. Am I the
only one seeing this?

¹ RFC 1918 Address Allocation for Private Internets
http://www.ietf.org/rfc/rfc1918.txt
RFC 4193 Unique Local IPv6 Unicast Addresses
http://www.ietf.org/rfc/rfc4193.txt

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

New wiki page: Peering

2009-11-27T15:35:15Z

I just wrote this:

http://code.google.com/p/sks-keyserver/wiki/Peering

Constructive feedback welcome.

Yes, it has some bias in what it suggests you do. It suggests what I
think is right. Arguments about how I'm wrong are constructive.

I'm not sure that membership_reload_interval is necessary any more,
after Kim's improvements in this area. I put it in anyway, to be safe,
but would be happy to remove it again; Kim?

*cough* Comments about how long it took me to write anything at all,
after getting editor privilege, while wholly justified are not
constructive. ;-) Unless your name is Yaron.

I decided that the act of getting and installing the keydump was enough
of an issue in itself to not be part of peering. There are good docs
out there on how to do this; I linked to:
http://www.keysigning.org/sks/
for instructions. In general though, I think that the wiki should aim
to be self-sufficient. Why? Because when I was setting up SKS it was a
pain to pick through all the dead sites, out-of-date sites and
assumptions that well-known-site X would be up with the canonical
information. If someone is reading the wiki, then the wiki is up and
reachable, so we should make it self-contained, but link freely to the
external docs from the relevant articles.

Thoughts?

-Phil

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (169 bytes) Download Attachment

From forum: SKS Devel

Re: gossip partner request

2009-11-27T07:14:39Z

@all

Please feel free to add our server and let us know, so that we can add
you, too:
keyserver.ccc-hanau.de 11370 # Jens Leinenbach <jens@...>
0x534EDA85

Cheers,
Jens

Andy Ruddock:
> Feel free to add keyserver.rainydayz.org
(Done.)

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: gossip partner request

2009-11-27T01:03:30Z

On 2009-11-25 at 10:49 +0100, Sebastian Urbach wrote:
> the debian readme told me to ask for gossip partners if we want to
> connect to the global sks-network. Here we go as ordered ;-)

Well no, since you don't provide details of the peering hostname.

The usual form is to post, at a minimum, the hostname. Ideally, the
hostname, the port (even if it's the normal one) and a contact address
to use for admin purposes. Add a PGP keyid and you've got everything
covered. Post this in the format that it would go in the "membership"
file.

Eg, a thorough line would be:
sks.example.com 11370 # Fred Bloggs <fred@...> 0xDEADBEEF

A more *common* line would include only the first two items. *sigh*

Then you'll get responses saying you've been added, so you should then
add that respondent to your file. The peering has access controls based
on source IP for inbound connections, checking it's the IP of one of
your peers, so if you don't have mutually correct entries then peering
won't work.

If you edit your "sksconf" file to add:
membership_reload_interval: 1
then changes will be picked up more quickly.

If your machine is at all modern (past few years) then you might also
add:
initial_stat:
(include the final ":" but put nothing after it); this will cause sks to
do a statistics gathering run at startup; look at your performance with
this option on to decide if you're happy with it. The advantage is that
when you point a web-browser at:
http://your-sks-server.example.com:11371/pks/lookup?op=stats
then you'll get complete data very soon after start-up, which can be
very helpful.

Once you've gotten a peer and have been up for a day or so, check back
in at:
http://www.sks-keyservers.net/status/
http://www.pramberger.at/peter/services/keyserver/network/
to see how your server is being reported and check that everything is
okay.

Regards,
-Phil

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

attachment0 (169 bytes) Download Attachment

From forum: SKS Devel

Re: gossip partner request

2009-11-27T00:54:21Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sebastian Urbach wrote:
> Hi,
>
> the debian readme told me to ask for gossip partners if we want to
> connect to the global sks-network. Here we go as ordered ;-)
>
> Thanks in advance.
>

Feel free to add keyserver.rainydayz.org

Please also let us know the hostname of your server so we can reciprocate.

- --
Andy Ruddock
- ------------
andy.ruddock@... (GPG Key ID 0xA622D452)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAksPk7wACgkQfSkWkaYi1FIG8QCfSAGvpRM5pQsFESB5x10v58pV
rBYAoKT8QtFg/1vBK5HqR2JqUkGq3skd
=Sjfr
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

gossip partner request

2009-11-25T01:49:19Z

Hi,

the debian readme told me to ask for gossip partners if we want to
connect to the global sks-network. Here we go as ordered ;-)

Thanks in advance.

--

Mit freundlichen Gruessen / yours sincerely

Sebastian Urbach

----------------------------------------------------------
Angewoehnung geistiger Grundsaetze ohne Gruende
nennt man Glauben.
----------------------------------------------------------
Friedrich Nietzsche (1844 - 1900)
Philosoph, Essayist, Lyriker und Schriftsteller

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

signature.asc (205 bytes) Download Attachment

From forum: SKS Devel

keyserver.hadiko.de down

2009-10-17T18:03:39Z

Hi,

I would like to inform everyone that keyserver.hadiko.de has been
decommissioned in September. There will be no replacement at hadiko.de.
Please delete the server from your gossip peer list, DNS round robin
records and any monitoring.

Thanks and bye,
Marc

--
_ _ Marc A. Donges +49 721 6904-2130
'v' Klosterweg 28 / E110
/ \ 76131 Karlsruhe
W W

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: Re: hkp

2009-10-15T16:40:10Z

On Oct 15, 2009, at 6:55 PM, John Clizbe wrote:

> [cc to sks-devel as this may be a SKS issue]
>
> Matthias Fuchs wrote:
>> Hi,
>>
>> Not sure if that is the correct ml, if not sorry in advance.
>>
>> I don't want to use hkp, but rather http e.g.
>> http://stinkfoot.org:11371/pks/lookup?op=get&search=0x517D0F0E
>
> hkp is just http over port 11371. hkp://<server.name.tld> is
> nothing more
> than http://<server.name.tld>:11371 by definition.
>
>> that works nicely, though I want to get the machine readable text,
>> though
>> adding "&options=mr" does not work. Is there a way to get mr code?
>
> Hmm, this should probably go to the sks-devel list. There is code in
> place for
> checking for the mr option and implementing it. If it's not working,
> it's a SKS
> issue. (request.ml & dbserver.ml,)

options=mr only pertains to op=index and op=vindex. It is not
meaningful for op=get.

What would you expect to get differently for op=get&options=mr ? The
output of a get is already machine readable.

David

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel

Re: hkp

2009-10-15T15:55:04Z

[cc to sks-devel as this may be a SKS issue]

Matthias Fuchs wrote:
> Hi,
>
> Not sure if that is the correct ml, if not sorry in advance.
>
> I don't want to use hkp, but rather http e.g.
> http://stinkfoot.org:11371/pks/lookup?op=get&search=0x517D0F0E

hkp is just http over port 11371. hkp://<server.name.tld> is nothing more
than http://<server.name.tld>:11371 by definition.

> that works nicely, though I want to get the machine readable text, though
> adding "&options=mr" does not work. Is there a way to get mr code?

Hmm, this should probably go to the sks-devel list. There is code in place for
checking for the mr option and implementing it. If it's not working, it's a SKS
issue. (request.ml & dbserver.ml,)

It may be specific to the SKS version. keyserver.stinkfoot.org is running 1.0.10
which is known to have at least one other issue.

Does the mr work if you try a 1.1.0 version (pgp.mit.edu, pgp.surfnet.nl) or
1.1.1 (keyserver.gingerbear.net, keyserver.kim-minh.com)

--
John P. Clizbe Inet:John (a) Mozilla-Enigmail.org
You can't spell fiasco without SCO. hkp://keyserver.gingerbear.net or
mailto:pgp-public-keys@...?subject=HELP

Q:"Just how do the residents of Haiku, Hawai'i hold conversations?"
A:"An odd melody / island voices on the winds / surplus of vowels"

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

signature.asc (693 bytes) Download Attachment

From forum: SKS Devel

Re: SKS peers needed

2009-10-15T13:47:48Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

The server is added.

Regards
Dimitar Ianakiev

Anakin-Marc Zaeger написа:

> Feel free to add me: keyserver.nyfnet.net 11370
>
> -A
>
> Dimitar Ianakiev wrote:
>> Hello,
>
>> Recently I setuped a news sks server and I need someone to peer with.
>> My sks server is:
>
>> keyserver.mitaka-g.net 11370
>
>> Currently I am looking ony peers for gossip peers and no mailsync.
>
>> Regards,
>> Dimitar Ianakiev
>
> _______________________________________________
> Sks-devel mailing list
> Sks-devel@...
> http://lists.nongnu.org/mailman/listinfo/sks-devel
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkrXinQACgkQP2g41NZNcp6aKQCfew7UNyXWIHPtFrYkNz0+0bmt
TyQAoKWzmGWHMJgCBgA3tj8oKUhp54Lk
=GUTf
-----END PGP SIGNATURE-----

_______________________________________________
Sks-devel mailing list
Sks-devel@...
http://lists.nongnu.org/mailman/listinfo/sks-devel

From forum: SKS Devel