On 2006-11-03 04:06, Joachim Schrod wrote:

Fajar Priyanto wrote:

...

Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log

It seems that it's not running.

If it's a personal crontab, it's OK. If it's a system-wide crontab (i.e., /etc/crontab or one in /etc/cron.d), then the user is missing in front of env. OK, I am missing something. That syntax is not in my "man 5 crontab"; where might I find some documentation that is more up-to-date?

On 2006-11-04 05:56, Joachim Schrod wrote:

Darryl Gregorash wrote:

...

...

<snip> OK, I am missing something. That syntax is not in my "man 5 crontab"; where might I find some documentation that is more up-to-date?

It is there, but mentioned only in passing:

... That's in the 9.3 man page also, exactly as you quoted it, but nowhere is there any mention of any environment variable being set within a cron command. The only mention of the environment is that a variable may be set as a separate cron entry.

On 2006-11-04 06:21, Anders Johansson wrote:

On Saturday 04 November 2006 13:07, Darryl Gregorash wrote:

...

<wheeeeeee>

I'm not sure it should be in cron's man page. "env" is a program you run

Oh.

On 2006-11-04 14:16, Joachim Schrod wrote:

man env for more information.

I actually never even heard of env until this thread, and until your last and Anders's notes, I had assumed it was some sort of undocumented cron syntax.

On Saturday 04 November 2006 10:37, Fajar Priyanto wrote:

Message was signed with unknown key 0x8F5EEE2DF2E0B8DA. The validity of the signature cannot be verified. Status: No public key to verify the signature

Fajar: I have been meaning to comment on how pointless it is to sign messages with a private key for which you have not published your public key. Every message you send is flagged an not verifiable because you have not submitted your key to any of the public key servers. Won't you please consider submitting your public key to any of the public key servers? KGpg will do that for you. -- _____________________________________ John Andersen

On Saturday 04 November 2006 11:52, steve reilly wrote:

On Saturday 04 November 2006 14:42, John Andersen wrote:

hi,

I am new myself to keys. submitted my key thru kgpg, and this is the first mail that i have sent.

it works ok?

Nope. It appears you forgot to attach the key. Click that little Fountain pen icon while composing, and try again. -- _____________________________________ John Andersen

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 20:02 +0700, Fajar Priyanto wrote:

Hello John, Thank you very much for the tip. I used kgpg to export my pub keys, and also imported and sign yours.

That's wrong: how can you sign his key if you don't know him personally? Signing somebody else's key means that you have verified that he is really that person and that _that_ key belongs to him. This is usually done by meeting in person. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTet3tTMYHG2NR9URAtPNAJ95Hf+bD2dkjylWneickeWJTQlVUgCfc6Ph z4xb5mvadbnCCg7QKYUXYoo= =V/mV -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 12:22 -0900, John Andersen wrote:

On Sunday 05 November 2006 04:47, Carlos E. R. wrote:

...

That's wrong: how can you sign his key if you don't know him personally?

Signing somebody else's key means that you have verified that he is really that person and that _that_ key belongs to him. This is usually done by meeting in person.

Who one chooses to trust is up to that person.

That's not the question. Did you read the manual? PGP/GPG signatures are based in a web of trust. By signing a key you are telling the rest of the world (not yourself) that you certify that the key you are signing does in fact belong to the correct person. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTmmdtTMYHG2NR9URAsUmAJ9cA+MG1x6tjkR4E+5S7jQsC7lYDACfdVCC qVxUgJhvdjed31WJvyexkLM= =Irpc -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 13:51 -0900, John Andersen wrote:

My signing of his key, or vise versa, is not published anywhere.

Signatures are very easily uploaded to keyservers. You have to select "local signature only" in order to make sure you don't. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTnIztTMYHG2NR9URAnSRAJ9Ze4JAakHJcrl3A5g0TpbOGwO8AgCfewCU atWZgOPToFXj0vMnTmM6Xm0= =g65G -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 19:12 -0600, Darryl Gregorash wrote:

...

Signatures are very easily uploaded to keyservers. You have to select "local signature only" in order to make sure you don't.

I should revoke the signature I put on your key, then, in case I accidentally upload it. ;-)

Absolutely! :-) You shouldn't sign my key: for all you know I could have a different name, or somebody could have altered the key that reached you, or somebody could have impersonated me. Of course, if you don't sign keys, you will see something like "UNTRUSTED Good signature from...", on those emails, but that's aboslutely right. It means that the signature matches the key you downloaded, the email has not been altered in transit, and that it says to come from such person. The only thing you don't know is that "such" person is really that person. If you have to sign keys that you think you can trust, but can not vouch for them, do that locally. That's what I did with the suse keys that came with the dvd. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTpX/tTMYHG2NR9URAv/xAJ0QEaD3HOuDwC5CI/vHS4GCLsiKoQCdEpaw 1JlN7uq2jzW/IPwtzMRMVYY= =tWjq -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 20:11 -0600, Darryl Gregorash wrote:

That's why I signed it (locally), but now you are telling us I should not have done that, in case it gets uploaded to a key server with my signature!?

There are two kinds of signings. The normal, default, one is exportable. The other one is local only and not exportable. - From the manual for gpg: - -edit-key `name' Present a menu which enables you to do all key related tasks: sign Make a signature on key of user `name' If the key is not yet signed by the default user (or the users given with -u), the program displays the information of the key again, together with its fingerprint and asks whether it should be signed. This question is repeated for all users specified with -u. lsign Same as "sign" but the signature is marked as non-exportable and will therefore never be used by others. This may be used to make keys valid only in the local environment. In Thunderbird, that has a gpg key management section, when I chose to sign a key it will do so as exportable. I have to click "local" manually. In kgpg I don't remember. Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTq2JtTMYHG2NR9URAoTiAJoCDDhyDbSvhQS3lSQenX2OUwHFeQCeLNFM s8LnARDL2yeTPYMFsCmPGOI= =Kn4y -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2006-11-05 at 21:51 -0600, Darryl Gregorash wrote:

...

There are two kinds of signings. The normal, default, one is exportable. The other one is local only and not exportable.

I know this, so why are you objecting to my signing your key locally? ;-)

I object to somebody saying that they sign keys without mentioning they do it locally only, it's misleading ;-)

...

Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice. Perhaps I should re-think my policy -- your contributions to this list seemed to indicate that I could trust you

:-) :-0

:-) But that's different. What you know is that there is somebody that claims to be called "Carlos" that usually gives good advices here ;-) - and that this email comes from him, or at least, from the same person that uses to write and sign here with such gpg signature. But you can not certify to anybody that I'm really named Carlos E. R ;-) It's a different kind of trust. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFTyNFtTMYHG2NR9URAmibAJ9Ivcovx8jLLszzkehwSD7HQvutfwCfUwN5 OHJIwEjm/70STWB7PHrvrE0= =xpD2 -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2006-11-06 at 15:27 +0100, Jos van Kan wrote:

But that's sufficient isn't it? For all I know you're the best Carlos E. R. impersonator thus far known to me, but what I'm sure of by your signature it'sthe *same* impersonator everytime. That's all I need to know.

Yes, that's correct :-)

...

But you can not certify to anybody that I'm really named Carlos E. R ;-)

But if your real name were Gandalf the Grey, what difference would that make?

Not much, for our purposes. In other contexts, more serious, it might.

...

It's a different kind of trust.

Even if I meet you in person I trust that you tell me your real name. I can't remember *ever* having asked to look at the passport of someone introduced to me. :-)

:-) In theory, you would have to before signing somebody else's key. That's the weak point of pgp signing, there is no central "trusted" authority certifying identities. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFFT7p6tTMYHG2NR9URAtd+AJ9YGE4t3/FJt6pRo0ogobh4T6Q/XwCfT9cA BrMMuoyRBWaiXIyvDd55oCk= =s/dc -----END PGP SIGNATURE-----

On 11/05/2006 10:35 PM somebody named Carlos E. R. wrote:

....

Also, I don't even sign locally keys for which I don't have some kind of verification, even if marginal, because key checking will not tell me the diference when reading an email. But that is a personal choice.

Carlos, I very much appreciate the rigorous care you take when signing others' keys. I also find the documentation on this aspect of key signing rather abstract. So to wax phenomenological, I would see a case for locally signing your (actual) key and would advocate for at least one descriptive category of signature. Because you have been posting here for quite awhile with a consistent key, I can be sure that emails sent to me with this key are from the same person (unless someone else gets your passphrase or hacks your private key... but in that case all bets are off anyway). If you change to a new email account and want to prove to me that you are the same person, all you have to do is send me an email using your current key. I might not know with any certainty that your name really is Carlos or anything else about you, but I do know that you are the same person I have been receiving emails from, even if you send me an email with a different name and different email address. Conversely, if someone else, say a guy named Scooter, gets control of your email address (or spoofs it) and, further, uses the name Carlos E. R., Scooter could fool a lot of people into thinking he was you... unless people had already imported your key and questioned the fact that he was not using the key for Carlos E. R. Going on the assumption that Scooter was not in possession of your private key, he could not prove (to me, at least) that he was you. Conversely again, you could change your email address and even change your name-- to, say, Jorge-- and if you used the same key you are using now, people who had already imported your key would know that Jorge and Carlos were the same person. Moreover, were I to (non-locally) sign and upload your key, other people would/should trust that Jorge and Carlos E. R. are one and the same person. Now the terms "local" and "non-local" (global?) don't describe very well this usage. Nor do the given "levels of trust". Given the above purposes, there's no question as to *how much* I trust the signature, but rather *what* I trust. The local-global dichotomy doesn't address this manner of trusting, what I would refer to as "personal" or "identical" trusting. That is, I don't know your date of birth, street address, phone number, or even if Carlos E. R. is your true name, but I don't care about those. (Except for your date of birth, all these details about you could be legally changed anyway.) The only trust issue here is personal (and I'm using "person" here in its original, most fundamental sense, from the Latin "per-sonare", to sound through (a mask), what an actor in a drama did/does), one of the identity of the one who may wear different "masks". To trust any communication where the identity of the person we are communicating with is critical, this manner of trusting is critical, regardless of whether we call it global or local. -- To announce that there must be no criticism of the president, or that we are to stand by the president, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public. --Theodore Roosevelt, 1918

On 11/06/2006 05:58 PM somebody named Carlos E. R. wrote:

The Monday 2006-11-06 at 07:27 -0500, ken wrote:

...

On 11/05/2006 10:35 PM somebody named Carlos E. R. wrote:

...

....

...

If you change to a new email account and want to prove to me that you are the same person, all you have to do is send me an email using your current key.

Actually, you can add the new identity to the old key, upload it again to a key server, and continue using the same key. The same key can have several ids.

This is true and good to point out. However, it's not required and might not always be desirable. It might be preferable to keep one's identities distinct and separate except to select friends.

...

....

...

Now the terms "local" and "non-local" (global?) don't describe very well this usage. Nor do the given "levels of trust". Given the above purposes, there's no question as to *how much* I trust the signature, but rather *what* I trust. The local-global dichotomy doesn't address this manner of trusting, what I would refer to as "personal" or "identical" trusting. That is, I don't know your date of birth, street address, phone number, or even if Carlos E. R. is your true name, but I don't care about those. (Except for your date of birth, all these details about you could be legally changed anyway.) The only trust issue here is personal (and I'm using "person" here in its original, most fundamental sense, from the Latin "per-sonare", to sound through (a mask), what an actor in a drama did/does), one of the identity of the one who may wear different "masks". To trust any communication where the identity of the person we are communicating with is critical, this manner of trusting is critical, regardless of whether we call it global or local.

Right again.

Local signing is just a safeguard, so that I don't upload them accidentally and others import it. Each person might use it for different purposes, but the idea is to only sign globally or publicly when we can certify the identity of that person somewhat. That's how I understand it, at least.

Perhaps my point got lost in the too much explication I posted. It is that the notion of "levels of trust" implies that keys have a range of qualities, e.g., moderate, full, ultimate, unrelated to whether they are, e.g., 1024-bit or 2048-bit. What, then, do the levels of trust mean and how can we assign a value to a new key on our ring(s)? The scalars, whether numeric or linguistic, don't correspond to anything in experience... abstractions I just don't see too much use for. More useful would be, for example, the ability to designate the name as "alleged" (as in "the person with this email address says his name is Jorge") vs. "verified" (as in "I checked his official picture ID and the name is what he says"). One such Boolean, but experientially concrete selection would be far more meaningful than an abstract scale with lots of choices. -- "It is not knowable how long that conflict would last, it could last, you know, six days, six weeks. I doubt six months." --Secretary of Defense Donald Rumsfeld, 2/7/03

Fajar Priyanto wrote:

On Friday 03 November 2006 17:06, Joachim Schrod wrote:

...

Fajar Priyanto wrote:

...

Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log

It seems that it's not running.

If it's a personal crontab, it's OK. If it's a system-wide crontab (i.e., /etc/crontab or one in /etc/cron.d), then the user is missing in front of env.

How about the */5 8-16 * * 1-6 ? Is it ok?

Yes. You wrote that it does not run. Is there an entry in /var/log/messages? Which user runs the command? Does crontab -l output that line, without any newline inbetween? (I suppose that the newline above was inserted by your mail agent and that it is not in the original file.) Can that user receive email or did you set the MAILTO variable in crontab? Joachim -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Joachim Schrod Email: jschrod@acm.org Roedermark, Germany

On Fri, 03 Nov, 2006 at 04:11:57 -0600, Darryl Gregorash wrote:

On 2006-11-02 22:16, Fajar Priyanto wrote:

...

Hello friends, Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log I am sure you cannot set an environment variable this way.

On 9.3 it's very much possible to set a variable that way, to wit; # MRTG: Entry for self temp; */5 * * * * env LANG=C /usr/bin/mrtg /etc/mrtg/self_tens.conf >/dev/null 2>&1 - which has been running for... dunno exactly... but months, at least

You *can* do this:

LANG=C <cron command>

This I wasn't aware of, though. /Jon -- YMMV

On Fri, 03 Nov, 2006 at 13:15:03 -0600, Darryl Gregorash wrote:

On 2006-11-03 09:07, Jon Clausen wrote:

...

On 9.3 it's very much possible to set a variable that way, to wit;

Perhaps that is what is meant by "environment variables can be set in the crontab," but I took that to mean the way I mentioned.

I don't think so.

There is nothing that clearly says an environment variable can be set within a cron command.

Agreed, but then again; env VAR=value /path/to/command *is* the command. Whether or not it's acceptable to the shell is not really cron's problem.

...

...

You *can* do this:

LANG=C <cron command>

This I wasn't aware of, though.

Which wasn't wasn't strictly true, I've just never used it to set LANG :P

Yes, man 5 crontab states: "An active line in a crontab will be either an environment setting or a cron command. An environment setting is of the form, name=value."

IINM it may all be summarized to something like; If you want to set a variable for a single command in the crontab, without affecting subsequent commands, use * * * * * /path/to/unaffected * * * * * env VAR=val /path/to/command * * * * * /path/to/othercommand If you want to set a var for all subsequent commands in the crontab, use * * * * * /path/to/unaffected VAR=value * * * * * /path/to/command * * * * * /path/to/othercommand But that's all supposition... /Jon -- YMMV

On Sat, 04 Nov, 2006 at 03:07:50 -0600, Darryl Gregorash wrote:

On 2006-11-04 01:55, Jon Clausen wrote:

...

<snip> IINM it may all be summarized to something like;

If you want to set a variable for a single command in the crontab, without affecting subsequent commands, use

* * * * * /path/to/unaffected * * * * * env VAR=val /path/to/command * * * * * /path/to/othercommand

Well, it certainly makes sense that the environment setting applies only to that one command, and the following is quite correct (can't recall just where I read that, certainly not the man page :-) )

Indeed. One more example of manpages' terseness, I guess :P /Jon -- YMMV

Darryl Gregorash wrote:

On 2006-11-02 22:16, Fajar Priyanto wrote:

...

Hello friends, Is it possible to run cron like this? */5 8-16 * * 1-6 env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log I am sure you cannot set an environment variable this way.

man env This is a command and not special syntax for crontab. As such, it should be executed. Best, Joachim -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Joachim Schrod Email: jschrod@acm.org Roedermark, Germany