From owner-freebsd-current Sat Feb 26 2:52:57 2000 Delivered-To: freebsd-current@freebsd.org Received: from verdi.nethelp.no (verdi.nethelp.no [158.36.41.162]) by hub.freebsd.org (Postfix) with SMTP id 85B3337BC1B for ; Sat, 26 Feb 2000 02:52:53 -0800 (PST) (envelope-from sthaug@nethelp.no) Received: (qmail 68553 invoked by uid 1001); 26 Feb 2000 10:52:50 +0000 (GMT) To: kris@FreeBSD.org Cc: jkh@zippy.cdrom.com, current@FreeBSD.ORG, markm@FreeBSD.ORG Subject: Re: OpenSSH /etc patch From: sthaug@nethelp.no In-Reply-To: Your message of "Sat, 26 Feb 2000 02:44:09 -0800 (PST)" References: X-Mailer: Mew version 1.05+ on Emacs 19.34.2 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Date: Sat, 26 Feb 2000 11:52:50 +0100 Message-ID: <68551.951562370@verdi.nethelp.no> Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > > Are you sure ssh requires a host key? I could have sworn this was > > entirely related to sshd and could thus be lumped into the same > > "if sshd_enable=YES" clause. > > The code does not lie :-) > > >From ssh.c: > > /* > * If we successfully made the connection, load the host private key > * in case we will need it later for combined rsa-rhosts > * authentication. This must be done before releasing extra > * privileges, because the file is only readable by root. But this means that ssh must be setuid root. Some of us insist on *not* using rsa-rhosts authentication, and install ssh without any privileges. Looks to me like we need a couple of alternatives here. Steinar Haug, Nethelp consulting, sthaug@nethelp.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message