Changes between Version 7 and Version 8 of jessie-stretch-upgrade

Timestamp:

Oct 18, 2017, 2:57:40 PM (8 years ago)

Author:

Jamie McClelland

Comment:

--

jessie-stretch-upgrade

@@ -1 +1 @@
 = Jessie Stretch Upgrade Page =
+
+== Root gpg key and monkeysphere ==
+
+All of our servers can easily ssh between themselves through the monkeysphere. For the monkeysphere to work, the root user on each machine has to maintain an ssh-agent.
+
+Prior to stretch, we could not load a monkeysphere key into ssh-agent that didn't have a password (so we set the password to 'monkeys' for all keys). With stretch, you can't load a key into ssh-agent in an automated way that ''has'' a password. Sigh. Also, you cannot automate the change of a gpg key password.
+
+As a result: upon upgrading sites to stretch, you must manually remove the password for the root user's gpg key:
+
+{{{
+gpg --change-passphrase root@$(hostname).mayfirst.org
+}}}
+
+The current password is: monkeys
+
+If you don't, you will get this warning when you run puppet:
+
+{{{
+remote: Error: /bin/false returned 1 instead of one of [0]
+remote: Error: /Stage[main]/Mayfirst::M_minimal/M_gpg::Private_key[root]/Exec[admin:please-manually-change-passphrase-from-monkeys-to-empty-for-root-user-on-this-host]/returns: change from notrun to 0 failed: /bin/false returned 1 instead of one of [0]
+}}}
 
 == Silence ==
@@ -18 +39 @@
 With stretch, `syslog` has been purged. That means all services and programs that depend on it have been modified (fail2ban, many of the mf-scripts, etc).
 
-== Root gpg key and monkeysphere ==
-
-All of our servers can easily ssh between themselves through the monkeysphere. For the monkeysphere to work, the root user on each machine has to maintain an ssh-agent.
-
-Prior to stretch, we could not load a monkeysphere key into ssh-agent that didn't have a password (so we set the password to 'monkeys' for all keys). With stretch, you can't load a key into ssh-agent in an automated way that ''has'' a password. Sigh. Also, you cannot automate the change of a gpg key password.
-
-As a result: upon upgrading sites to stretch, you must manually remove the password for the root user's gpg key:
-
-{{{
-gpg --change-passphrase root@$(hostname).mayfirst.org
-}}}
-
-The current password is: monkeys
-
-If you don't, you will get this warning when you run puppet:
-
-{{{
-remote: Error: gpg --pinentry-mode loopback --passphrase '' --export-secret-keys  --armour 1>/dev/null 2>/dev/null returned 2 instead of one of [0]
-remote: Error: /Stage[main]/Mayfirst::M_minimal/M_gpg::Private_key[root]/Exec[admin:please-manually-change-passphrase-from-monkeys-to-empty-for-root-user-on-this-host]/returns: change from notrun to 0 failed: gpg --pinentry-mode loopback --passphrase '' --export-secret-keys  --armour 1>/dev/null 2>/dev/null returned 2 instead of one of [0]
-}}}
 
 == Predictable Network Interfaces Names ==