X2Go Bug report logs - #1401
Update GPG key bootstrapping instructions for Debian

Toggle useless messages

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

From: "Daniel Ullrich" <store@posteo.de>

To: submit@bugs.x2go.org

Subject: PGP-Key is not available on keyservers for debian buster

Date: Sat, 24 Aug 2019 02:36:24 +0000

[Message part 1 (text/plain, inline)]

Package: complete x2go repo
version: none

sudo apt update
The following signatures could not be verified because their public key 
is not available: NO_PUBKEY E1F958385BFE2B6E
W: GPG error: http://packages.x2go.org/debian buster InRelease: The 
following signatures could not be verified because their public key is 
not available: NO_PUBKEY E1F958385BFE2B6E
E: The depot "http://packages.x2go.org/debian buster InRelease" is not 
signed.
N: An update from such a repository cannot be done in a secure way, so 
it is disabled by default.
N: See the apt-secure(8) manual page for more details on package vault 
creation and user configuration.

sudo apt-key adv --recv-keys --keyserver keys.gnupg.net E1F958385BFE2B6E
Executing: /tmp/apt-key-gpghome.4WhtJFIi3f/gpg.1.sh --recv-keys 
--keyserver keys.gnupg.net E1F958385BFE2B6E
gpg: Received from key server failed: The waiting time for the 
connection has expired.

x2go-keyring package is not available for debian buster => would solve 
this issue!

[Message part 2 (text/html, inline)]

Message #10 received at 1401@bugs.x2go.org (full text, mbox, reply):

From: Mihai Moldovan <ionic@ionic.de>

To: 1401@bugs.x2go.org

Subject: Re: Bug#1401: PGP-Key is not available on keyservers for debian buster

Date: Sat, 24 Aug 2019 19:06:24 +0200

[Message part 1 (text/plain, inline)]

Control: reassign -1 packages.x2go.org


> N: An update from such a repository cannot be done in a secure way, so
> it is disabled by default.

The x2go-keyring package is available for Debian buster, includes the required
key file and should work just fine.

However, newer apt versions will disallow downloading from an untrusted repository.

In order to actually install the keyring package, try running something like:
sudo apt-get --allow-unauthenticated install x2go-keyring

Afterwards, sudo apt update should not return an error again. Do not use the
--allow-unauthenticated flag without understanding its implications.


> sudo apt-key adv --recv-keys --keyserver keys.gnupg.net E1F958385BFE2B6E
> Executing: /tmp/apt-key-gpghome.4WhtJFIi3f/gpg.1.sh --recv-keys
> --keyserver keys.gnupg.net E1F958385BFE2B6E
> gpg: Received from key server failed: The waiting time for the
> connection has expired.

The public key is also available on keyservers. Most keyservers are still
stoned, however, from the attacks that have been carried out a few months ago
and a year ago. For more information, and why this problem is unlike to be fixed
in the first place, refer to
https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f for instance.
I cannot fix public keyservers for you.

Like the message said: there was a timeout while fetching the key. It did not
say that such a key does not exist.



Mihai

[signature.asc (application/pgp-signature, attachment)]

Message #19 received at 1401@bugs.x2go.org (full text, mbox, reply):

From: Mihai Moldovan <ionic@ionic.de>

To: 1401@bugs.x2go.org

Subject: Re: Bug#1401: PGP-Key is not available on keyservers for debian buster

Date: Thu, 12 Sep 2019 19:40:40 +0200

[Message part 1 (text/plain, inline)]

Control: reassign wiki.x2go.org
Control: retitle -1 Update GPG key bootstrapping instructions for Debian
Control: close -1


* On 8/24/19 7:06 PM, Mihai Moldovan wrote:
> Control: reassign -1 packages.x2go.org
> 
> 
>> N: An update from such a repository cannot be done in a secure way, so
>> it is disabled by default.
> 
> The x2go-keyring package is available for Debian buster, includes the required
> key file and should work just fine.
> 
> However, newer apt versions will disallow downloading from an untrusted repository.
> 
> In order to actually install the keyring package, try running something like:
> sudo apt-get --allow-unauthenticated install x2go-keyring
> 
> Afterwards, sudo apt update should not return an error again. Do not use the
> --allow-unauthenticated flag without understanding its implications.

That wasn't correct - at least not completely. --allow-unauthenticated should
work for package installations, but not for downloading repository metadata.

To allow apt to work with unauthenticated repository metadata, users would need
to use something like:
apt-get update --allow-insecure-repositories

This said: this is totally risky, now and later. Installing packages from an
unauthenticated repository doesn't give apt any chance to check the origin. A
successful Man-in-the-Middle attack is very likely in such a scenario. Worse,
even after the initial bootstrap, all subsequent operations and packages from
such a repository could still be malicious.


I've updated https://wiki.x2go.org/doku.php/wiki:repositories:debian et al with
this information, big fat warning signs and explanations.

**Users should always bootstrap with the currently valid GPG key and then
install the x2go-keyring package from the validated X2Go repository location!**


Closing up here.



Mihai

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.