![](https://seccdn.libravatar.org/avatar/e9476b0f5d44f568c06c0ca302e09fc4.jpg?s=120&d=mm&r=g)
Hello friends, Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log It seems that it's not running. Thank you very much. -- Fajar Priyanto | Reg'd Linux User #327841 | Linux tutorial http://linux2.arinet.org 11:13am up 2:44, 2.6.16.13-4-default GNU/Linux Let's use OpenOffice. http://www.openoffice.org
![](https://seccdn.libravatar.org/avatar/324df7bef1ca31c33c5b9af30d1af934.jpg?s=120&d=mm&r=g)
Fajar Priyanto wrote:
Hello friends, <snip>
Fajar Priyanto | Reg'd Linux User #327841 | Linux tutorial http://linux2.arinet.org 11:13am up 2:44, 2.6.16.13-4-default GNU/Linux Let's use OpenOffice. http://www.openoffice.org
Hey, this linux2.arinet.org is a beautiful website! And I slog around through the English translations and I discover that YOU are the famous ari-stress. I certainly can't read the Indonesian stuff, but you've done a fantastic job here!! -- Tony Alfrey tonyalfrey@earthlink.net "I'd Rather Be Sailing"
![](https://seccdn.libravatar.org/avatar/9b3c3a790b500cdb2bbfe34f8db0e867.jpg?s=120&d=mm&r=g)
Fajar Priyanto wrote:
Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log
It seems that it's not running.
If it's a personal crontab, it's OK. If it's a system-wide crontab (i.e., /etc/crontab or one in /etc/cron.d), then the user is missing in front of env. Joachim -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Joachim Schrod Email: jschrod@acm.org Roedermark, Germany
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-03 04:06, Joachim Schrod wrote:
Fajar Priyanto wrote:
Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log
It seems that it's not running.
If it's a personal crontab, it's OK. If it's a system-wide crontab (i.e., /etc/crontab or one in /etc/cron.d), then the user is missing in front of env. OK, I am missing something. That syntax is not in my "man 5 crontab"; where might I find some documentation that is more up-to-date?
![](https://seccdn.libravatar.org/avatar/9b3c3a790b500cdb2bbfe34f8db0e867.jpg?s=120&d=mm&r=g)
Darryl Gregorash wrote:
On 2006-11-03 04:06, Joachim Schrod wrote:
Fajar Priyanto wrote:
Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log
It seems that it's not running.
If it's a personal crontab, it's OK. If it's a system-wide crontab (i.e., /etc/crontab or one in /etc/cron.d), then the user is missing in front of env. OK, I am missing something. That syntax is not in my "man 5 crontab"; where might I find some documentation that is more up-to-date?
It is there, but mentioned only in passing: The format of a cron command is very much the V7 standard, with a number of upward-compatible extensions. Each line has five time and date fields, followed by a user name if this is ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the system crontab file, followed by a command. ^^^^^^^^^^^^^^^^^^^^^^^^^ That's lines 50ff in 10.0 man page. HTH, Joachim -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Joachim Schrod Email: jschrod@acm.org Roedermark, Germany
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-04 05:56, Joachim Schrod wrote:
Darryl Gregorash wrote:
<snip> OK, I am missing something. That syntax is not in my "man 5 crontab"; where might I find some documentation that is more up-to-date?
It is there, but mentioned only in passing:
... That's in the 9.3 man page also, exactly as you quoted it, but nowhere is there any mention of any environment variable being set within a cron command. The only mention of the environment is that a variable may be set as a separate cron entry.
![](https://seccdn.libravatar.org/avatar/72ee3b9e0735cf98a1e936a90fc087ed.jpg?s=120&d=mm&r=g)
On Saturday 04 November 2006 13:07, Darryl Gregorash wrote:
That's in the 9.3 man page also, exactly as you quoted it, but nowhere is there any mention of any environment variable being set within a cron command. The only mention of the environment is that a variable may be set as a separate cron entry.
I'm not sure it should be in cron's man page. "env" is a program you run, and cron's man page tells you how to run programs. The fact that the "env" program happens to set an environment variable and then execute another program is irrelevant to cron, it just runs it like any other program. You also have the shell syntax VAR=value command which is standard bash, setting the variable VAR to the value for that command
![](https://seccdn.libravatar.org/avatar/9b3c3a790b500cdb2bbfe34f8db0e867.jpg?s=120&d=mm&r=g)
Darryl Gregorash wrote:
That's in the 9.3 man page also, exactly as you quoted it, but nowhere is there any mention of any environment variable being set within a cron command. The only mention of the environment is that a variable may be set as a separate cron entry.
I don't understand your issue. The OP doesn't set any variable with cron syntax, he calls the command env. man env for more information. Joachim -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Joachim Schrod Email: jschrod@acm.org Roedermark, Germany
![](https://seccdn.libravatar.org/avatar/e9476b0f5d44f568c06c0ca302e09fc4.jpg?s=120&d=mm&r=g)
On Friday 03 November 2006 17:06, Joachim Schrod wrote:
Fajar Priyanto wrote:
Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log
It seems that it's not running.
If it's a personal crontab, it's OK. If it's a system-wide crontab (i.e., /etc/crontab or one in /etc/cron.d), then the user is missing in front of env.
How about the */5 8-16 * * 1-6 ? Is it ok? -- Fajar Priyanto | Reg'd Linux User #327841 | Linux tutorial http://linux2.arinet.org 2:29am up 1:16, 2.6.16.13-4-default GNU/Linux Let's use OpenOffice. http://www.openoffice.org
![](https://seccdn.libravatar.org/avatar/ded3c1cf46ea720a1f3f65df348eff3a.jpg?s=120&d=mm&r=g)
On Saturday 04 November 2006 10:37, Fajar Priyanto wrote:
Message was signed with unknown key 0x8F5EEE2DF2E0B8DA. The validity of the signature cannot be verified. Status: No public key to verify the signature
Fajar: I have been meaning to comment on how pointless it is to sign messages with a private key for which you have not published your public key. Every message you send is flagged an not verifiable because you have not submitted your key to any of the public key servers. Won't you please consider submitting your public key to any of the public key servers? KGpg will do that for you. -- _____________________________________ John Andersen
![](https://seccdn.libravatar.org/avatar/25ff0aae17aee3ddccc370eb95d87ad8.jpg?s=120&d=mm&r=g)
On Saturday 04 November 2006 14:42, John Andersen wrote: hi, I am new myself to keys. submitted my key thru kgpg, and this is the first mail that i have sent. it works ok?
On Saturday 04 November 2006 10:37, Fajar Priyanto wrote:
Message was signed with unknown key 0x8F5EEE2DF2E0B8DA. The validity of the signature cannot be verified. Status: No public key to verify the signature
Fajar: I have been meaning to comment on how pointless it is to sign messages with a private key for which you have not published your public key.
Every message you send is flagged an not verifiable because you have not submitted your key to any of the public key servers.
Won't you please consider submitting your public key to any of the public key servers? KGpg will do that for you.
-- Powered by: SuSE Linux 10.1 ~ Kernel 2.6.16.21-0.25-smp #1 ~ Kmail 1.9 ~ Registered Linux user: 412217 http://reillyblog.com 3:50pm up 19:33, 2 users, load average: 2.09, 2.50, 3.14
![](https://seccdn.libravatar.org/avatar/ded3c1cf46ea720a1f3f65df348eff3a.jpg?s=120&d=mm&r=g)
On Saturday 04 November 2006 11:52, steve reilly wrote:
On Saturday 04 November 2006 14:42, John Andersen wrote:
hi,
I am new myself to keys. submitted my key thru kgpg, and this is the first mail that i have sent.
it works ok?
Nope. It appears you forgot to attach the key. Click that little Fountain pen icon while composing, and try again. -- _____________________________________ John Andersen
![](https://seccdn.libravatar.org/avatar/e9476b0f5d44f568c06c0ca302e09fc4.jpg?s=120&d=mm&r=g)
On Sunday 05 November 2006 02:42, John Andersen wrote:
Fajar: I have been meaning to comment on how pointless it is to sign messages with a private key for which you have not published your public key.
Every message you send is flagged an not verifiable because you have not submitted your key to any of the public key servers.
Won't you please consider submitting your public key to any of the public key servers? KGpg will do that for you.
Hello John, Thank you very much for the tip. I used kgpg to export my pub keys, and also imported and sign yours. Cool. I'll write an article about this for others. -- Fajar Priyanto | Reg'd Linux User #327841 | Linux tutorial http://linux2.arinet.org 8:01pm up 0:40, 2.6.16.13-4-default GNU/Linux Let's use OpenOffice. http://www.openoffice.org
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 20:02 +0700, Fajar Priyanto wrote:
Hello John, Thank you very much for the tip. I used kgpg to export my pub keys, and also imported and sign yours.
That's wrong: how can you sign his key if you don't know him personally? Signing somebody else's key means that you have verified that he is really that person and that _that_ key belongs to him. This is usually done by meeting in person. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTet3tTMYHG2NR9URAtPNAJ95Hf+bD2dkjylWneickeWJTQlVUgCfc6Ph z4xb5mvadbnCCg7QKYUXYoo= =V/mV -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/ded3c1cf46ea720a1f3f65df348eff3a.jpg?s=120&d=mm&r=g)
On Sunday 05 November 2006 04:47, Carlos E. R. wrote:
That's wrong: how can you sign his key if you don't know him personally?
Signing somebody else's key means that you have verified that he is really that person and that _that_ key belongs to him. This is usually done by meeting in person.
Who one chooses to trust is up to that person. I have never met the signer of SuSE packages either. -- _____________________________________ John Andersen
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 12:22 -0900, John Andersen wrote:
On Sunday 05 November 2006 04:47, Carlos E. R. wrote:
That's wrong: how can you sign his key if you don't know him personally?
Signing somebody else's key means that you have verified that he is really that person and that _that_ key belongs to him. This is usually done by meeting in person.
Who one chooses to trust is up to that person.
That's not the question. Did you read the manual? PGP/GPG signatures are based in a web of trust. By signing a key you are telling the rest of the world (not yourself) that you certify that the key you are signing does in fact belong to the correct person. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTmmdtTMYHG2NR9URAsUmAJ9cA+MG1x6tjkR4E+5S7jQsC7lYDACfdVCC qVxUgJhvdjed31WJvyexkLM= =Irpc -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/ded3c1cf46ea720a1f3f65df348eff3a.jpg?s=120&d=mm&r=g)
On Sunday 05 November 2006 13:45, Carlos E. R. wrote:
The Sunday 2006-11-05 at 12:22 -0900, John Andersen wrote:
On Sunday 05 November 2006 04:47, Carlos E. R. wrote:
That's wrong: how can you sign his key if you don't know him personally?
Signing somebody else's key means that you have verified that he is really that person and that _that_ key belongs to him. This is usually done by meeting in person.
Who one chooses to trust is up to that person.
That's not the question. Did you read the manual? PGP/GPG signatures are based in a web of trust. By signing a key you are telling the rest of the world (not yourself) that you certify that the key you are signing does in fact belong to the correct person.
My signing of his key, or vise versa, is not published anywhere. -- _____________________________________ John Andersen
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 13:51 -0900, John Andersen wrote:
My signing of his key, or vise versa, is not published anywhere.
Signatures are very easily uploaded to keyservers. You have to select "local signature only" in order to make sure you don't. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTnIztTMYHG2NR9URAnSRAJ9Ze4JAakHJcrl3A5g0TpbOGwO8AgCfewCU atWZgOPToFXj0vMnTmM6Xm0= =g65G -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-05 17:22, Carlos E. R. wrote:
The Sunday 2006-11-05 at 13:51 -0900, John Andersen wrote:
My signing of his key, or vise versa, is not published anywhere.
Signatures are very easily uploaded to keyservers. You have to select "local signature only" in order to make sure you don't.
I should revoke the signature I put on your key, then, in case I accidentally upload it. ;-)
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 19:12 -0600, Darryl Gregorash wrote:
Signatures are very easily uploaded to keyservers. You have to select "local signature only" in order to make sure you don't.
I should revoke the signature I put on your key, then, in case I accidentally upload it. ;-)
Absolutely! :-) You shouldn't sign my key: for all you know I could have a different name, or somebody could have altered the key that reached you, or somebody could have impersonated me. Of course, if you don't sign keys, you will see something like "UNTRUSTED Good signature from...", on those emails, but that's aboslutely right. It means that the signature matches the key you downloaded, the email has not been altered in transit, and that it says to come from such person. The only thing you don't know is that "such" person is really that person. If you have to sign keys that you think you can trust, but can not vouch for them, do that locally. That's what I did with the suse keys that came with the dvd. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTpX/tTMYHG2NR9URAv/xAJ0QEaD3HOuDwC5CI/vHS4GCLsiKoQCdEpaw 1JlN7uq2jzW/IPwtzMRMVYY= =tWjq -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-05 19:55, Carlos E. R. wrote:
The Sunday 2006-11-05 at 19:12 -0600, Darryl Gregorash wrote:
Signatures are very easily uploaded to keyservers. You have to select "local signature only" in order to make sure you don't.
I should revoke the signature I put on your key, then, in case I accidentally upload it. ;-)
<snip>
If you have to sign keys that you think you can trust, but can not vouch for them, do that locally. That's what I did with the suse keys that came with the dvd.
That's why I signed it (locally), but now you are telling us I should not have done that, in case it gets uploaded to a key server with my signature!?
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 20:11 -0600, Darryl Gregorash wrote:
That's why I signed it (locally), but now you are telling us I should not have done that, in case it gets uploaded to a key server with my signature!?
There are two kinds of signings. The normal, default, one is exportable. The other one is local only and not exportable. - From the manual for gpg: - -edit-key `name' Present a menu which enables you to do all key related tasks: sign Make a signature on key of user `name' If the key is not yet signed by the default user (or the users given with -u), the program displays the information of the key again, together with its fingerprint and asks whether it should be signed. This question is repeated for all users specified with -u. lsign Same as "sign" but the signature is marked as non-exportable and will therefore never be used by others. This may be used to make keys valid only in the local environment. In Thunderbird, that has a gpg key management section, when I chose to sign a key it will do so as exportable. I have to click "local" manually. In kgpg I don't remember. Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTq2JtTMYHG2NR9URAoTiAJoCDDhyDbSvhQS3lSQenX2OUwHFeQCeLNFM s8LnARDL2yeTPYMFsCmPGOI= =Kn4y -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-05 21:35, Carlos E. R. wrote:
The Sunday 2006-11-05 at 20:11 -0600, Darryl Gregorash wrote:
That's why I signed it (locally), but now you are telling us I should not have done that, in case it gets uploaded to a key server with my signature!?
There are two kinds of signings. The normal, default, one is exportable. The other one is local only and not exportable.
I know this, so why are you objecting to my signing your key locally? ;-)
In Thunderbird, that has a gpg key management section, when I chose to sign a key it will do so as exportable. I have to click "local" manually. In kgpg I don't remember.
I've never used Mozilla except to import a key with enigmail. I don't use kgpg, preferring to manage keys on the commandline.
Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice. Perhaps I should re-think my policy -- your contributions to this list seemed to indicate that I could trust you
:-) :-0
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 21:51 -0600, Darryl Gregorash wrote:
There are two kinds of signings. The normal, default, one is exportable. The other one is local only and not exportable.
I know this, so why are you objecting to my signing your key locally? ;-)
I object to somebody saying that they sign keys without mentioning they do it locally only, it's misleading ;-)
Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice. Perhaps I should re-think my policy -- your contributions to this list seemed to indicate that I could trust you
:-) :-0
:-) But that's different. What you know is that there is somebody that claims to be called "Carlos" that usually gives good advices here ;-) - and that this email comes from him, or at least, from the same person that uses to write and sign here with such gpg signature. But you can not certify to anybody that I'm really named Carlos E. R ;-) It's a different kind of trust. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTyNFtTMYHG2NR9URAmibAJ9Ivcovx8jLLszzkehwSD7HQvutfwCfUwN5 OHJIwEjm/70STWB7PHrvrE0= =xpD2 -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/c85c078174b85b3c27e9c68f92d6b3ff.jpg?s=120&d=mm&r=g)
Carlos E. R. wrote:
What you know is that there is somebody that claims to be called "Carlos" that usually gives good advices here ;-) - and that this email comes from him, or at least, from the same person that uses to write and sign here with such gpg signature.
But that's sufficient isn't it? For all I know you're the best Carlos E. R. impersonator thus far known to me, but what I'm sure of by your signature it's the *same* impersonator everytime. That's all I need to know.
But you can not certify to anybody that I'm really named Carlos E. R ;-)
But if your real name were Gandalf the Grey, what difference would that make?
It's a different kind of trust.
Even if I meet you in person I trust that you tell me your real name. I can't remember *ever* having asked to look at the passport of someone introduced to me. :-) Regards, -- Jos van Kan registered Linux user #152704
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2006-11-06 at 15:27 +0100, Jos van Kan wrote:
But that's sufficient isn't it? For all I know you're the best Carlos E. R. impersonator thus far known to me, but what I'm sure of by your signature it'sthe *same* impersonator everytime. That's all I need to know.
Yes, that's correct :-)
But you can not certify to anybody that I'm really named Carlos E. R ;-)
But if your real name were Gandalf the Grey, what difference would that make?
Not much, for our purposes. In other contexts, more serious, it might.
It's a different kind of trust.
Even if I meet you in person I trust that you tell me your real name. I can't remember *ever* having asked to look at the passport of someone introduced to me. :-)
:-) In theory, you would have to before signing somebody else's key. That's the weak point of pgp signing, there is no central "trusted" authority certifying identities. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFT7p6tTMYHG2NR9URAtd+AJ9YGE4t3/FJt6pRo0ogobh4T6Q/XwCfT9cA BrMMuoyRBWaiXIyvDd55oCk= =s/dc -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-06 05:57, Carlos E. R. wrote:
But that's different.
What you know is that there is somebody that claims to be called "Carlos" that usually gives good advices here ;-) - and that this email comes from him, or at least, from the same person that uses to write and sign here with such gpg signature.
But you can not certify to anybody that I'm really named Carlos E. R ;-)
It's a different kind of trust.
Yes, Gandalf, what difference does it make? :-)
![](https://seccdn.libravatar.org/avatar/9cd265c308d561ecdca2c46beea94eed.jpg?s=120&d=mm&r=g)
On 11/05/2006 10:35 PM somebody named Carlos E. R. wrote:
....
Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice.
Carlos, I very much appreciate the rigorous care you take when signing others' keys. I also find the documentation on this aspect of key signing rather abstract. So to wax phenomenological, I would see a case for locally signing your (actual) key and would advocate for at least one descriptive category of signature. Because you have been posting here for quite awhile with a consistent key, I can be sure that emails sent to me with this key are from the same person (unless someone else gets your passphrase or hacks your private key... but in that case all bets are off anyway). If you change to a new email account and want to prove to me that you are the same person, all you have to do is send me an email using your current key. I might not know with any certainty that your name really is Carlos or anything else about you, but I do know that you are the same person I have been receiving emails from, even if you send me an email with a different name and different email address. Conversely, if someone else, say a guy named Scooter, gets control of your email address (or spoofs it) and, further, uses the name Carlos E. R., Scooter could fool a lot of people into thinking he was you... unless people had already imported your key and questioned the fact that he was not using the key for Carlos E. R. Going on the assumption that Scooter was not in possession of your private key, he could not prove (to me, at least) that he was you. Conversely again, you could change your email address and even change your name-- to, say, Jorge-- and if you used the same key you are using now, people who had already imported your key would know that Jorge and Carlos were the same person. Moreover, were I to (non-locally) sign and upload your key, other people would/should trust that Jorge and Carlos E. R. are one and the same person. Now the terms "local" and "non-local" (global?) don't describe very well this usage. Nor do the given "levels of trust". Given the above purposes, there's no question as to *how much* I trust the signature, but rather *what* I trust. The local-global dichotomy doesn't address this manner of trusting, what I would refer to as "personal" or "identical" trusting. That is, I don't know your date of birth, street address, phone number, or even if Carlos E. R. is your true name, but I don't care about those. (Except for your date of birth, all these details about you could be legally changed anyway.) The only trust issue here is personal (and I'm using "person" here in its original, most fundamental sense, from the Latin "per-sonare", to sound through (a mask), what an actor in a drama did/does), one of the identity of the one who may wear different "masks". To trust any communication where the identity of the person we are communicating with is critical, this manner of trusting is critical, regardless of whether we call it global or local. -- To announce that there must be no criticism of the president, or that we are to stand by the president, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public. --Theodore Roosevelt, 1918
![](https://seccdn.libravatar.org/avatar/77cb4da5f72bc176182dcc33f03a18f3.jpg?s=120&d=mm&r=g)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2006-11-06 at 07:27 -0500, ken wrote:
On 11/05/2006 10:35 PM somebody named Carlos E. R. wrote:
Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice.
Carlos,
I very much appreciate the rigorous care you take when signing others' keys. I also find the documentation on this aspect of key signing rather abstract. So to wax phenomenological, I would see a case for locally signing your (actual) key and would advocate for at least one descriptive category of signature.
Because you have been posting here for quite awhile with a consistent key, I can be sure that emails sent to me with this key are from the same person (unless someone else gets your passphrase or hacks your private key... but in that case all bets are off anyway).
Right.
If you change to a new email account and want to prove to me that you are the same person, all you have to do is send me an email using your current key.
Actually, you can add the new identity to the old key, updload it again to a key server, and continue using the same key. The same key can have several ids.
I might not know with any certainty that your name really is Carlos or anything else about you, but I do know that you are the same person I have been receiving emails from, even if you send me an email with a different name and different email address.
Yes.
Conversely, if someone else, say a guy named Scooter, gets control of your email address (or spoofs it) and, further, uses the name Carlos E. R., Scooter could fool a lot of people into thinking he was you... unless people had already imported your key and questioned the fact that he was not using the key for Carlos E. R. Going on the assumption that Scooter was not in possession of your private key, he could not prove (to me, at least) that he was you.
But he might fool you by creating a new key pair and using it. You would download that key, and the keys would be correct. You might not notice that the keys used by me and the impersonator were different unless you checked.
Conversely again, you could change your email address and even change your name-- to, say, Jorge-- and if you used the same key you are using now, people who had already imported your key would know that Jorge and Carlos were the same person. Moreover, were I to (non-locally) sign and upload your key, other people would/should trust that Jorge and Carlos E. R. are one and the same person.
Yes.
Now the terms "local" and "non-local" (global?) don't describe very well this usage. Nor do the given "levels of trust". Given the above purposes, there's no question as to *how much* I trust the signature, but rather *what* I trust. The local-global dichotomy doesn't address this manner of trusting, what I would refer to as "personal" or "identical" trusting. That is, I don't know your date of birth, street address, phone number, or even if Carlos E. R. is your true name, but I don't care about those. (Except for your date of birth, all these details about you could be legally changed anyway.) The only trust issue here is personal (and I'm using "person" here in its original, most fundamental sense, from the Latin "per-sonare", to sound through (a mask), what an actor in a drama did/does), one of the identity of the one who may wear different "masks". To trust any communication where the identity of the person we are communicating with is critical, this manner of trusting is critical, regardless of whether we call it global or local.
Right again. Local signing is just a safeguard, so that I don't upload them accidentally and others import it. Each person might use it for different purposes, but the idea is to only sign globally or publicly when we can certify the identity of that person somewhat. That's how I understand it, at least. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFT74LtTMYHG2NR9URAuqVAJ9BRAH6y4E6DDDabzZnl8WcdomyggCgkjoq rLwGwouK90gj/yt8oLhsUro= =OBT2 -----END PGP SIGNATURE-----
![](https://seccdn.libravatar.org/avatar/9cd265c308d561ecdca2c46beea94eed.jpg?s=120&d=mm&r=g)
On 11/06/2006 05:58 PM somebody named Carlos E. R. wrote:
The Monday 2006-11-06 at 07:27 -0500, ken wrote:
On 11/05/2006 10:35 PM somebody named Carlos E. R. wrote:
....
If you change to a new email account and want to prove to me that you are the same person, all you have to do is send me an email using your current key.
Actually, you can add the new identity to the old key, upload it again to a key server, and continue using the same key. The same key can have several ids.
This is true and good to point out. However, it's not required and might not always be desirable. It might be preferable to keep one's identities distinct and separate except to select friends.
....
Now the terms "local" and "non-local" (global?) don't describe very well this usage. Nor do the given "levels of trust". Given the above purposes, there's no question as to *how much* I trust the signature, but rather *what* I trust. The local-global dichotomy doesn't address this manner of trusting, what I would refer to as "personal" or "identical" trusting. That is, I don't know your date of birth, street address, phone number, or even if Carlos E. R. is your true name, but I don't care about those. (Except for your date of birth, all these details about you could be legally changed anyway.) The only trust issue here is personal (and I'm using "person" here in its original, most fundamental sense, from the Latin "per-sonare", to sound through (a mask), what an actor in a drama did/does), one of the identity of the one who may wear different "masks". To trust any communication where the identity of the person we are communicating with is critical, this manner of trusting is critical, regardless of whether we call it global or local.
Right again.
Local signing is just a safeguard, so that I don't upload them accidentally and others import it. Each person might use it for different purposes, but the idea is to only sign globally or publicly when we can certify the identity of that person somewhat. That's how I understand it, at least.
Perhaps my point got lost in the too much explication I posted. It is that the notion of "levels of trust" implies that keys have a range of qualities, e.g., moderate, full, ultimate, unrelated to whether they are, e.g., 1024-bit or 2048-bit. What, then, do the levels of trust mean and how can we assign a value to a new key on our ring(s)? The scalars, whether numeric or linguistic, don't correspond to anything in experience... abstractions I just don't see too much use for. More useful would be, for example, the ability to designate the name as "alleged" (as in "the person with this email address says his name is Jorge") vs. "verified" (as in "I checked his official picture ID and the name is what he says"). One such Boolean, but experientially concrete selection would be far more meaningful than an abstract scale with lots of choices. -- "It is not knowable how long that conflict would last, it could last, you know, six days, six weeks. I doubt six months." --Secretary of Defense Donald Rumsfeld, 2/7/03
![](https://seccdn.libravatar.org/avatar/ded3c1cf46ea720a1f3f65df348eff3a.jpg?s=120&d=mm&r=g)
On Sunday 05 November 2006 04:02, Fajar Priyanto wrote:
Hello John, Thank you very much for the tip. I used kgpg to export my pub keys, and also imported and sign yours. Cool. I'll write an article about this for others. --
That worked great Fajar. Kmail now reports that your Signature is Valid. Furthermore it does this almost instantly, no waiting for the longer interval before the message text appears which happens when Kmail can't find a signature. -- _____________________________________ John Andersen
![](https://seccdn.libravatar.org/avatar/9b3c3a790b500cdb2bbfe34f8db0e867.jpg?s=120&d=mm&r=g)
Fajar Priyanto wrote:
On Friday 03 November 2006 17:06, Joachim Schrod wrote:
Fajar Priyanto wrote:
Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log
It seems that it's not running.
If it's a personal crontab, it's OK. If it's a system-wide crontab (i.e., /etc/crontab or one in /etc/cron.d), then the user is missing in front of env.
How about the */5 8-16 * * 1-6 ? Is it ok?
Yes. You wrote that it does not run. Is there an entry in /var/log/messages? Which user runs the command? Does crontab -l output that line, without any newline inbetween? (I suppose that the newline above was inserted by your mail agent and that it is not in the original file.) Can that user receive email or did you set the MAILTO variable in crontab? Joachim -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Joachim Schrod Email: jschrod@acm.org Roedermark, Germany
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
Hello friends, Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log I am sure you cannot set an environment variable this way. You *can* do
On 2006-11-02 22:16, Fajar Priyanto wrote: this: LANG=C <cron command>
![](https://seccdn.libravatar.org/avatar/7acbdae447cd30bea7b8f1b20b79ee34.jpg?s=120&d=mm&r=g)
On Fri, 03 Nov, 2006 at 04:11:57 -0600, Darryl Gregorash wrote:
On 2006-11-02 22:16, Fajar Priyanto wrote:
Hello friends, Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log I am sure you cannot set an environment variable this way.
On 9.3 it's very much possible to set a variable that way, to wit; # MRTG: Entry for self temp; */5 * * * * env LANG=C /usr/bin/mrtg /etc/mrtg/self_tens.conf >/dev/null 2>&1 - which has been running for... dunno exactly... but months, at least
You *can* do this:
LANG=C <cron command>
This I wasn't aware of, though. /Jon -- YMMV
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-03 09:07, Jon Clausen wrote:
On Fri, 03 Nov, 2006 at 04:11:57 -0600, Darryl Gregorash wrote:
On 2006-11-02 22:16, Fajar Priyanto wrote:
Hello friends, Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log
I am sure you cannot set an environment variable this way.
On 9.3 it's very much possible to set a variable that way, to wit;
You *can* do this:
LANG=C <cron command>
This I wasn't aware of, though. Yes, man 5 crontab states: "An active line in a crontab will be either an environment setting or a cron command. An environment setting is of
Perhaps that is what is meant by "environment variables can be set in the crontab," but I took that to mean the way I mentioned. There is nothing that clearly says an environment variable can be set within a cron command. the form, name=value."
![](https://seccdn.libravatar.org/avatar/7acbdae447cd30bea7b8f1b20b79ee34.jpg?s=120&d=mm&r=g)
On Fri, 03 Nov, 2006 at 13:15:03 -0600, Darryl Gregorash wrote:
On 2006-11-03 09:07, Jon Clausen wrote:
On 9.3 it's very much possible to set a variable that way, to wit;
Perhaps that is what is meant by "environment variables can be set in the crontab," but I took that to mean the way I mentioned.
I don't think so.
There is nothing that clearly says an environment variable can be set within a cron command.
Agreed, but then again; env VAR=value /path/to/command *is* the command. Whether or not it's acceptable to the shell is not really cron's problem.
You *can* do this:
LANG=C <cron command>
This I wasn't aware of, though.
Which wasn't wasn't strictly true, I've just never used it to set LANG :P
Yes, man 5 crontab states: "An active line in a crontab will be either an environment setting or a cron command. An environment setting is of the form, name=value."
IINM it may all be summarized to something like; If you want to set a variable for a single command in the crontab, without affecting subsequent commands, use * * * * * /path/to/unaffected * * * * * env VAR=val /path/to/command * * * * * /path/to/othercommand If you want to set a var for all subsequent commands in the crontab, use * * * * * /path/to/unaffected VAR=value * * * * * /path/to/command * * * * * /path/to/othercommand But that's all supposition... /Jon -- YMMV
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-04 01:55, Jon Clausen wrote:
<snip> IINM it may all be summarized to something like;
If you want to set a variable for a single command in the crontab, without affecting subsequent commands, use
* * * * * /path/to/unaffected * * * * * env VAR=val /path/to/command * * * * * /path/to/othercommand
Well, it certainly makes sense that the environment setting applies only to that one command, and the following is quite correct (can't recall just where I read that, certainly not the man page :-) )
If you want to set a var for all subsequent commands in the crontab, use
* * * * * /path/to/unaffected VAR=value * * * * * /path/to/command * * * * * /path/to/othercommand
But that's all supposition...
/Jon
![](https://seccdn.libravatar.org/avatar/7acbdae447cd30bea7b8f1b20b79ee34.jpg?s=120&d=mm&r=g)
On Sat, 04 Nov, 2006 at 03:07:50 -0600, Darryl Gregorash wrote:
On 2006-11-04 01:55, Jon Clausen wrote:
<snip> IINM it may all be summarized to something like;
If you want to set a variable for a single command in the crontab, without affecting subsequent commands, use
* * * * * /path/to/unaffected * * * * * env VAR=val /path/to/command * * * * * /path/to/othercommand
Well, it certainly makes sense that the environment setting applies only to that one command, and the following is quite correct (can't recall just where I read that, certainly not the man page :-) )
Indeed. One more example of manpages' terseness, I guess :P /Jon -- YMMV
![](https://seccdn.libravatar.org/avatar/5e70f769092f3372f14b4f2df58a17e1.jpg?s=120&d=mm&r=g)
On 2006-11-04 03:51, Jon Clausen wrote:
On Sat, 04 Nov, 2006 at 03:07:50 -0600, Darryl Gregorash wrote: <snip>
Well, it certainly makes sense that the environment setting applies only to that one command, and the following is quite correct (can't recall just where I read that, certainly not the man page :-) )
Indeed. One more example of manpages' terseness, I guess :P
No, it's one more example of "don't let the programmer write the user documentation" :-)
![](https://seccdn.libravatar.org/avatar/9b3c3a790b500cdb2bbfe34f8db0e867.jpg?s=120&d=mm&r=g)
Darryl Gregorash wrote:
On 2006-11-02 22:16, Fajar Priyanto wrote:
Hello friends, Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log I am sure you cannot set an environment variable this way.
man env This is a command and not special syntax for crontab. As such, it should be executed. Best, Joachim -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Joachim Schrod Email: jschrod@acm.org Roedermark, Germany
participants (11)
-
Anders Johansson
-
Carlos E. R.
-
Darryl Gregorash
-
Fajar Priyanto
-
Joachim Schrod
-
John Andersen
-
Jon Clausen
-
Jos van Kan
-
ken
-
steve reilly
-
Tony Alfrey