Since keys are important it could be useful to have secondary storage (i.e. email, log files) of the fingerprints and actions taken on keys.

Todo:
* Email the account owner whenever a key is changed (deleted, added, edited) including fingerprint before/after the change and instructions on how to check the fingerprint of a public/private key

Done:
* Log the same (delete/add/edit) operations in watchdog and maybe in other locations? #2166053: Add watchdog messages when SSH keys are added or changed #2166055: Track sshkey changes

Comments

drumm’s picture

Priority: Normal » Major
Issue summary: View changes
dave reid’s picture

I don't think we should add any kind of periodically confirmation email. That could also be split into a separate module if someone wanted that functionality.

I agree being able to configure an e-mail whenever an SSH key is added/changed/removed. I'm seeing that now more with sites. I think adding a hook_action_info() implementation (or whatever the equivalent is for Rules module) so that the emails could be configured on a site by site bases. Maybe a provided sub-feature module to provide this email support.

And +100 for adding watchdog logging. I should also add support in the role_activity module for sshkey.module.

drumm’s picture

While I see the advantages, I'm not eager to consider adding Rules to Drupal.org. Rules with Commerce on DrupalCon sites caused sites outages related to a rules cache locking/contention. It was mitigated by moving from the core DB cache to MemCache. We already have MemCache on Drupal.org, and now all new DrupalCon sites.

dave reid’s picture

Adding some SSH key email templates that I've encountered before:

[GitHub] A new public key was added to your account

The following SSH key was added to your account:

[sshkey name]
[sshkey fingerprint]

If you believe this key was added in error, you can remove the key and disable
access at the following location:

https://github.com/settings/ssh

[Bitbucket] SSH key added to your account

An SSH key was added to account davereid:
[trimmed version of sshkey value] [ssh key name]
Users with this key can access all of the repositories that davereid can access.
If you did not make this change, remove the key and notify support@bitbucket.org.

dave reid’s picture

I never said Rules was necessary. We should be able to set it up with just Action and Trigger modules.

greggles’s picture

Can you explain more on this:

I don't think we should add any kind of periodically confirmation email. That could also be split into a separate module if someone wanted that functionality.

The goal is to discover a situation where the key has been changed outside of the normal form editing process. There are other ways we could do that, but I think this is the easiest way.

dave reid’s picture

Because regular 'reminder' emails like that are typically ignore and not very functional? I've not ever seen something like that done so I'm not convinced it would actually be useful? And I think it should be provided as a separate module (let alone a separate feature request since this is three requests all in one).

drumm’s picture

Great. We don't have Trigger enabled on Drupal.org right now. As long as it is the right tool for the job, and it seems it is, we can test and enable it when we upgrade SSH Key.

dave reid’s picture

greggles’s picture

Issue summary: View changes

Awesome, thanks for the work mentioned in #9. Updating the title to reflect what remains here.

tvn’s picture

Issue tags: +affects drupal.org
drumm’s picture

Title: Add email notifications and logging for changes » Add email notifications for SSH key changes
colan’s picture

Version: 7.x-2.x-dev » 4.x-dev

Sounds reasonable to me, but new features go into HEAD.

drumm’s picture

Issue tags: -affects drupal.org

Drupal.org no longer uses this module, in favor of GitLab managing SSH keys, which does have these notifications.

Still a good feature request for this module.