Re: Discussion about Cancel-Lock support

Hi Russ,

>> OK, I'll see how to get rid of the verifycancels stuff.
>> Couldn't refusecybercancels also be removed?  Its default value is already
>> false and our inn.conf documentation mentions it is a "somewhat messy,
>> inefficient, and inexact way of refusing spam cancels"...
> 
> Yes, I think we should remove refusecybercancels.  It was always a hack
> and I don't think anyone is issuing mass spam cancels using that
> convention any more (or probably has in more than a decade).

OK, I'll remove verifycancels and refusecybercancels during the 
integration of Cancel-Lock support.


>> cancels {
>>    canlockuser: password
>>    canlockadmin: otherpassword
>>    extracanlockuser: oldpassword
>>    extracanlockadmin: oldotherpassword
>> }
> 
> I'm not sure that I understand the difference between canlockuser and
> extracanlockuser.  They both result in sending a hash, and they are both
> valid for verifying hashes, correct?  If that's the case, it may be
> simpler to remove the extra* parameters and just make the values lists.

The idea behind was to send a hash only for canlock* and verify hashes 
for both canlock* and extra* but I agree it is a bit complex and confusing.
During key rotation, we can still go on send both hashes, and verify 
both hashes, then at one time remove the old password.  Looks like 
simpler indeed, with canlock* lists.


> I like the idea of a separate secrets file.
>
> I feel like we have other secrets that could potentially benefit from this
> over time, though (passwd.nntp, for instance, or the secret parameter in
> inn-radius.conf), so I like the grouping.  It feels more future-proof.  It
> would be lovely if eventually we could put all the secrets used by INN in
> one file, since that makes life much easier for configuration management
> and permissions.

Yep.
So in a nutshell the best design would be an inn.conf parameter:
secretsfile: <pathetc>/secrets.conf

With secrets.conf like:

cancels {
   canlockuser: [ password ]
   canlockadmin: [ password anotherpassword ]
}

# And other groups to come when merging other secrets.

-- 
Julien ÉLIE

« Vous savez, les idées, elles sont dans l'air. Il suffit que quelqu'un
   vous en parle de trop près, pour que vous les attrapiez ! » (Raymond
   Devos)
_______________________________________________
inn-workers mailing list
[email protected]
https://lists.isc.org/mailman/listinfo/inn-workers