From owner-freebsd-security Fri Aug 4 12:26:47 2000 Delivered-To: freebsd-security@freebsd.org Received: from closed-networks.com (closed-networks.com [195.153.248.242]) by hub.freebsd.org (Postfix) with SMTP id B9F8037B6DB for ; Fri, 4 Aug 2000 12:26:41 -0700 (PDT) (envelope-from udp@closed-networks.com) Received: (qmail 11612 invoked by uid 1021); 4 Aug 2000 19:34:12 -0000 Date: Fri, 4 Aug 2000 20:33:31 +0100 From: "Bruce M. Simpson" To: Andre Albsmeier Subject: Re: What will I lose if ssh is no more suid root? Message-ID: <20000804203331.F8029@closed-networks.com> References: <20000803074228.A1682@curry.mchp.siemens.de> <20000804163918.W23567@dlt.follo.net> <20000804171212.B6933@curry.mchp.siemens.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0.1i In-Reply-To: <20000804171212.B6933@curry.mchp.siemens.de>; from andre.albsmeier@mchp.siemens.de on Fri, Aug 04, 2000 at 05:12:12PM +0200 Organization: Closed Networks, London, UK X-Echelon: MI6 Cobra GCHQ Panavia MI5 Timberline IRA NSA Mossad CIA Copperhead Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Andre, On Fri, Aug 04, 2000 at 05:12:12PM +0200, Andre Albsmeier wrote: > > Anyways, what it does give you is the ability to read the host key's private > > part, and thus use RSAHostAuthentication, which is far more useful. > > Yes, I found this issue in the docs meanwhile... > > > If you don't need/want it though, running with the setuid bits off should not > > give you too much of a problem. > > No, I am currently running without it and didn't have problems. You're a very trusting man. ;> Seriously, isn't this a good candidate app for a privilege API? i.e. give a privilege to the ssh client on the system to use the host key for helping to identify itself to the remote peer. Yet another example of the kind of thing which gets people implementing lots of kludges using group numbers and kernel patches. Easily solved with a privilege API. Just my 2c. -- Bruce M. Simpson [udp] Digital Security Architect, Closed Networks www: www.closed-networks.com/~udp London [gsm+wap] www.packetfactory.net/~udp United Kingdom email+pgp: bruce@closed-networks.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message