Re: Bigbrother at pgp.uni-mainz.de

Hi Christoph, folks,

there are two problems in your mail:
1. outdated and presumably insecure software
2. outdated keyserver list

As for 1.:
I am interested in a service like this, and I have consulted it
previously. It used to be handy for debugging. We do run our own
keyserver (pgpkeys.logintas.ch:11371) and we do have a Nagios up and
running. So if there is interest, we could take over the monitoring.
There would be some differences to the current service, though:
- we would define the pgp key servers as a host and service group in our
internal nagios system
- in regular intervals we would export the corresponding html result
page to one of our public webservers
- so there would not be a "login" for admins or the like, and no direct
interaction with our nagios
- also the checks would be limited to "host" (ping), smtp (25), "sks
sync (11370)" and "openpgp keyserver service" (11371), and not include
cpu load, disk, procs or other host-internal stati
- also it would look like the standard nagios result page - no fancy
blinking buttons, but the essential "key server reachable" info would be
there
- alarming would go directly to the respective host admins, and their
names might be published on the result page
- we could do an SMS alert, but max 1 per day and max 5 times in a row
(which costs us about =A41-3 per host or service downtime, which we would
sponsor).
- we suffer outages ourselves sometimes... misalerts are possible though
rare.
- I would put a logintas logo and link onto the page ("PGP keyserver
monitoring provided by Logintas") - small, with a link, and nothing else.

Please let me know if that sounds interesting.


As for 2:
We would also depend on pgp key server admins to provide us with their
host names or ips, and e-mail-addresses or sms / mobile phone numbers
for notification. Correspondance would be using signed and possibly
encrypted pgp e-mails. We do not expect a load of changes... pgp key
server population has not seen that much of fluctuation, so
administrative work would remain low, I hope.
However, there is a graph on http://www.nongnu.org/sks/ which lists many
SKS servers. This graph seems to be auto-generated. So there has to be a
list of servers, or at least a way to create such a list. Anyone any
idea about this?


-- Marcus



--=20
-- Dr. Marcus Holthaus
-- Logintas AG, CH 6330 Cham, +41 41 780 0011, Fax 0021


Christoph Martin schrieb:
> As you know I am running a Bigbrother monitoring service for some PGP
> keyserver on http://pgp.zdv.uni-mainz.de/bigbrother/. It is somewhat
> outdated now. The serverlist is not really current. What is more a
> problem, is that the software has a security hole. It is no option to
> upgrade to a current Bigbrother version, since it is no longer in Debia=
n
> and is also not free.
>=20
> So the question is, are people interested in a monitoring service for
> keyserver? The option is to disable the service completely or to replac=
e
> it with some other software like nagios. Also we should consider how to
> keep the serverlist current.
>=20
> Christoph