{"action":"created","issue":{"url":"https://api.github.com/repos/lxc/lxd/issues/308","labels_url":"https://api.github.com/repos/lxc/lxd/issues/308/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxd/issues/308/comments","events_url":"https://api.github.com/repos/lxc/lxd/issues/308/events","html_url":"https://github.com/lxc/lxd/issues/308","id":59758091,"number":308,"title":"Add Remote Flow","user":{"login":"jensg-st","id":10879611,"avatar_url":"https://avatars.githubusercontent.com/u/10879611?v=3","gravatar_id":"","url":"https://api.github.com/users/jensg-st","html_url":"https://github.com/jensg-st","followers_url":"https://api.github.com/users/jensg-st/followers","following_url":"https://api.github.com/users/jensg-st/following{/other_user}","gists_url":"https://api.github.com/users/jensg-st/gists{/gist_id}","starred_url":"https://api.github.com/users/jensg-st/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jensg-st/subscriptions","organizations_url":"https://api.github.com/users/jensg-st/orgs","repos_url":"https://api.github.com/users/jensg-st/repos","events_url":"https://api.github.com/users/jensg-st/events{/privacy}","received_events_url":"https://api.github.com/users/jensg-st/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-04T06:58:00Z","updated_at":"2015-03-05T07:25:42Z","closed_at":null,"body":"I looked at the spec and the following happened, so I'm not sure if that is how it supposed to work:\r\n\r\n`lxc remote add demo 127.0.0.1`\r\n\r\nThen I get the fingerprint. If I accept and enter a random password, I would assume, that the cert is not getting stored? But if I ran the exact command again, it says the certificate has already been stored. \r\n\r\nI know that it still wouldn't help to get access, because the server didn't store the \"client\" cert as trusted and would reply with untrusted again. But maybe the remote cert should not be added in the first place, if I can't satisfy the requirements?\r\n\r\nI noticed that the client sends a second get request to the server (\"/1.0\") after accepting the fingerprint. But then the password input comes. Is the second get request required? We can not be a trusted client and the info that we need to provide a password is in the first get request already. \r\n\r\nI can dig through the code to understand it better, but maybe you can shed some light on it.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/lxc/lxd/issues/comments/77318639","html_url":"https://github.com/lxc/lxd/issues/308#issuecomment-77318639","issue_url":"https://api.github.com/repos/lxc/lxd/issues/308","id":77318639,"user":{"login":"jensg-st","id":10879611,"avatar_url":"https://avatars.githubusercontent.com/u/10879611?v=3","gravatar_id":"","url":"https://api.github.com/users/jensg-st","html_url":"https://github.com/jensg-st","followers_url":"https://api.github.com/users/jensg-st/followers","following_url":"https://api.github.com/users/jensg-st/following{/other_user}","gists_url":"https://api.github.com/users/jensg-st/gists{/gist_id}","starred_url":"https://api.github.com/users/jensg-st/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jensg-st/subscriptions","organizations_url":"https://api.github.com/users/jensg-st/orgs","repos_url":"https://api.github.com/users/jensg-st/repos","events_url":"https://api.github.com/users/jensg-st/events{/privacy}","received_events_url":"https://api.github.com/users/jensg-st/received_events","type":"User","site_admin":false},"created_at":"2015-03-05T07:25:42Z","updated_at":"2015-03-05T07:25:42Z","body":"Ok, half of what I said is rubbish after going through the source, so you can close it I guess. It is more a question of opinion rather than a bug. Just an explanation, so I don't look too stupid :)\r\n\r\nIn remote.go:\r\n\r\n```\r\nfunc addServer(config *lxd.Config, server string) error {\r\n\t\r\n\tfmt.Println(server)\r\n\tremote := config.ParseRemote(server)\r\n\tfmt.Println(remote)\r\n\tfmt.Println(config)\r\n\tc, err := lxd.NewClient(config, remote)\r\n\tif err != nil {\r\n\t\treturn err\r\n\t}\r\n\r\n\terr = c.UserAuthServerCert()\r\n\tif err != nil {\r\n\t\treturn err\r\n\t}\r\n```\r\n\r\nThe UserAuthServerCert() call is actually storing the cert in my home folder `/.config/lxc/servercerts`\r\n\r\nThe I enter the admin password and it gets posted with the cert to the server. If my admin password is wrong, it returns `Forbidden` and the lxc cert is not added to the remote. \r\n\r\nI was just expecting that the certificate in `/.config/lxc/servercerts` would be deleted after the add of the cert failed. But maybe that is what you wanted to check if the certificate has changed and that is, as far as I know, how 'known_hosts' in SSH works. I just did not expect that behaviour.  \r\n\r\nSo, forget everything, except good morning. :) Issue can be closed.\r\n"}}