From owner-freebsd-stable  Fri Feb 16 15:34:19 2001
Delivered-To: freebsd-stable@freebsd.org
Received: from obsecurity.dyndns.org (adsl-64-165-226-49.dsl.lsan03.pacbell.net [64.165.226.49])
	by hub.freebsd.org (Postfix) with ESMTP id 1909437B401
	for <freebsd-stable@FreeBSD.ORG>; Fri, 16 Feb 2001 15:34:17 -0800 (PST)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id 84FA566F2F; Fri, 16 Feb 2001 15:34:15 -0800 (PST)
Date: Fri, 16 Feb 2001 15:34:15 -0800
From: Kris Kennaway <kris@obsecurity.org>
To: "Brandon S. Allbery KF8NH" <allbery@ece.cmu.edu>
Cc: Kris Kennaway <kris@obsecurity.org>,
	Stephen Montgomery-Smith <stephen@math.missouri.edu>,
	Randy Bush <randy@psg.com>,
	FreeBSD Stable <freebsd-stable@FreeBSD.ORG>
Subject: Re: openssh not setting DISPLAY
Message-ID: <20010216153415.A98116@mollari.cthul.hu>
References: <20010216152317.A97818@mollari.cthul.hu> <33610000.982366319@pyanfar.ece.cmu.edu>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="7JfCtLOvnd9MIVvH"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <33610000.982366319@pyanfar.ece.cmu.edu>; from allbery@ece.cmu.edu on Fri, Feb 16, 2001 at 06:31:59PM -0500
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG


--7JfCtLOvnd9MIVvH
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Feb 16, 2001 at 06:31:59PM -0500, Brandon S. Allbery KF8NH wrote:
> On Friday, February 16, 2001 15:23:17 -0800, Kris Kennaway <kris@obsecuri=
ty.org> wrote:
> +-----
> | It's not the default because it allows the remote system to snoop your
> | X display, and that's not something you might want so we default to
> | being secure.
> +--->8
>=20
> That's interesting, since the sshd manpage from openssh says:
>=20
>              Note that disabling X11 forwarding does not improve secu=AD
>              rity in any way, as users can always install their own for=AD
>              warders.

Yes, users are free to weaken the security of their session if they
wish, but it's not done by default.

Kris

--7JfCtLOvnd9MIVvH
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE6jbj3Wry0BWjoQKURAnMcAJ4m2mFfHCvEKZwpsY+qUdbbJw7YRQCg3YcI
avUgseyZPTn9kwUcpdLuNFg=
=C/wA
-----END PGP SIGNATURE-----

--7JfCtLOvnd9MIVvH--


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message