Bug 251846 - sysutils/tmate: Bring back tmate server fingerprints or add a pkg-message explaining how to configure them
Summary: sysutils/tmate: Bring back tmate server fingerprints or add a pkg-message exp...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Mateusz Piotrowski
URL: https://reviews.freebsd.org/D27627
Keywords:
Depends on:
Blocks:
 
Reported: 2020-12-14 20:31 UTC by Mateusz Piotrowski
Modified: 2020-12-15 21:08 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (swills)

Attachments
Patch file (1.54 KB, patch)
2020-12-15 16:20 UTC, Yasuhiro Kimura 		no flags Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mateusz Piotrowski freebsd_committer freebsd_triage 2020-12-14 20:31:26 UTC 
It turns out that it is somewhat confusing to the users that we remove the upstream server fingerprints from the source code. I can imagine this is a security consideration, but we should at least mention in the pkg-message that in order to bring them back in a user may run the following:

cat > ~/.tmate.conf <<\EOF
set -g tmate-server-rsa-fingerprint   "SHA256:Hthk2T/M/Ivqfk1YYUn5ijC2Att3+UPzD7Rn72P5VWs"
set -g tmate-server-ecdsa-fingerprint "SHA256:8GmKHYHEJ6n0TEdciHeEGkKOigQfCFuBULdt6vZIhDc"
EOF

Related issue raised in the upsteam repo: https://github.com/tmate-io/tmate/issues/219
Comment 1 Yasuhiro Kimura freebsd_committer freebsd_triage 2020-12-15 16:20:55 UTC 
Created attachment 220583 [details]
Patch file

Don't reset default server fingerprints.
Comment 2 Steve Wills freebsd_committer freebsd_triage 2020-12-15 19:45:19 UTC 
Comment on attachment 220583 [details]
Patch file

Hmmm, I think I'd prefer to keep this patch and instead add a pkg-message instead which told the user how to trust the tmate.io servers if the want to. Personally, I don't and use tmate only with my own instance of sysutils/tmate-ssh-server and think that should be our default for the package, otherwise it seems a bit hidden from the users what they are really trusting and where there data is going when they run tmate.
Comment 3 Mateusz Piotrowski freebsd_committer freebsd_triage 2020-12-15 20:07:59 UTC 
(In reply to Steve Wills from comment #2)
I think I agree with Steve. Let's prepare an update for pkg-message.
Comment 4 Mateusz Piotrowski freebsd_committer freebsd_triage 2020-12-15 20:26:57 UTC 
I've posted a patch:
https://reviews.freebsd.org/D27627
Comment 5 Steve Wills freebsd_committer freebsd_triage 2020-12-15 20:31:22 UTC 
(In reply to Mateusz Piotrowski from comment #4)
Works for me, approved.
Comment 6 commit-hook freebsd_committer freebsd_triage 2020-12-15 21:07:13 UTC 
A commit references this bug:

Author: 0mp
Date: Tue Dec 15 21:06:41 UTC 2020
New revision: 558182
URL: https://svnweb.freebsd.org/changeset/ports/558182

Log:
  systutils/tmate: Explain how to configure default fingerprints

  PR:		251846
  Approved by:	swills (maintainer)
  Differential Revision:	https://reviews.freebsd.org/D27627

Changes:
  head/sysutils/tmate/Makefile
  head/sysutils/tmate/pkg-message
Comment 7 Mateusz Piotrowski freebsd_committer freebsd_triage 2020-12-15 21:08:04 UTC 
(In reply to Yasuhiro KIMURA from comment #1)
BTW, thanks for the patch. We decided to go in a different direction for now, but it's super nice you sent a patch anyway :)

Cheers!