Re: CERT Advisory CA-2002-28 Trojan Horse Sendmail Distribution

* S. Bougerolle <[email protected]> [2002-10-12 06:53]:
> 
> All that's missing is a convenient list of signatures in the same place
> as the download files, which GNOME should easily be able to do since 80%
> of their stuff comes from the same site.
> 
But there is ...

Do a quick search on google for "keyserver", and pick one near you.
Eg: wwwkeys.eu.pgp.net

You could add "--keyserver wwwkeys.eu.pgp.net" to all your commands,
but it is easier to just add "keyserver wwwkeys.eu.pgp.net" to
"~/.gnupg/options".

Next, people have probably exported keys with there signature on them
since you got hold of the key. Pick up all the signatures with:
gpg --refresh-keys

Perhaps one of those extra signatures will give you a new path through
the web of trust:
gpg --check-trustdb

This is a new discovery I made today, and have not tried yet. It might
download the correct key if you try to verify something that is signed
with a key you do not have:
--keyserver-options auto-key-retrieve

If that does not do the job, you can use --recv-keys:
key=$(gpg --verify something.sign 2>&1 | awk '/key ID/ {print $(NF)}')
gpg --recv-keys $key

There is still no guaranty that someone has not uploaded their own
signature with their trojaned software. That is why I recommend waiting
a few days for a security alert to reach me before trusting keys.


Richard 

-- 
Key id: 4BA38C19

-- 
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message