<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-size:small">OK, summarizing the private responses, it is clear this is something worth populating for the server side and I will probably populate a TXT record and if it is a service as opposed to a host that is being accessed, an SRV as well.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">I don't see DNSSEC as being essential. It is a nice to have but that is all, if my client is getting its DNS from a resolver that is also the authoritative for the zone and that is secured using something like DPRIV, that is just as good.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The other side of the connection, the client, is something I will be looking to get a draft out on. The basic idea being that @<a href="http://phill.hallambaker.com">phill.hallambaker.com</a> is a handle anyone setting up an Internet service can use as the basis for authenticating me.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">So would appreciate it if anyone wants to discuss the best approach to this while we are in Bangkok.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The user experience I am aiming for with a webcam is Alice buys the webcam, gives it a name in the DNS space for her house '<a href="http://webcam.house.example.com">webcam.house.example.com</a>' and lists @<a href="http://alice.example.com">alice.example.com</a>, @<a href="http://bob.example.net">bob.example.net</a>, @<a href="http://carol.example.com">carol.example.com</a> as the list of people authorized to access it. From that point on, they can go to <a href="https://webcam.house.example.com/">https://webcam.house.example.com/</a> and log in via OAUTH using a regular browser.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">This is basically automation like Puppet and Ansible BUT for consumers. So I don't ask if they want to do it way A or way B, I pick one or both. </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">I want to make SSH the same experience, so Alice can set up a Raspberry pi, give it a name and this time the list of authorized users is a list of dns-handle/account pairs to map the globally unique but tiresome <a href="http://alice.example.com">alice.example.com</a> to her local unix account alice.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Challenge is working out how to achieve that with the existing SSH servers.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Feb 26, 2025 at 2:42 PM Philip Homburg <<a href="mailto:philip@nlnetlabs.nl">philip@nlnetlabs.nl</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<p><br>
</p>
<div>On 26/02/2025 19:00, Phillip
Hallam-Baker wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">As part of
that, I wanted to know if there was any *existing* use of the
SSHFP record for publishing SSH credentials and if so whether
it was limited to the server. And yes, I can read the specs,
what I am asking about is actual practice.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
</div>
</blockquote>
<p><br>
</p>
<p>My personal opinion (that quite a few people disagree with) is
that SSHFP records can be trusted only if the application does
DNSSEC validation. However, implementations tend to rely on the AD
bit. For a while I had a fork of openssh that did do DNSSEC
validation but it was too much work to maintain.<br>
</p>
</div>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div>