From owner-freebsd-security  Tue May  1 13:24: 3 2001
Delivered-To: freebsd-security@freebsd.org
Received: from bootp-20-219.bootp.virginia.edu (bootp-20-219.bootp.Virginia.EDU [128.143.20.219])
	by hub.freebsd.org (Postfix) with ESMTP id ED27337B424
	for <security@FreeBSD.ORG>; Tue,  1 May 2001 13:24:01 -0700 (PDT)
	(envelope-from mipam@virginia.edu)
Received: by bootp-20-219.bootp.virginia.edu (Postfix)
	id F03311D001; Tue,  1 May 2001 16:23:54 -0400 (EDT)
Date: Tue, 1 May 2001 16:23:54 -0400
From: Mipam <mipam@ibb.net>
To: Alex Popa <razor@ldc.ro>
Cc: security@FreeBSD.ORG
Subject: Re: OpenSSH accepts any RSA key from host 127.0.0.1, even on non-default ports
Message-ID: <20010501162354.A282@bootp-20-219.bootp.virginia.edu>
Reply-To: mipam@ibb.net
References: <20010501231616.A40227@ldc.ro>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20010501231616.A40227@ldc.ro>; from razor@ldc.ro on Tue, May 01, 2001 at 11:16:16PM +0300
X-Operating-System: BSD
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

On Tue, May 01, 2001 at 11:16:16PM +0300, Alex Popa wrote:
> The reason why this bothers me is that I sometimes use ssh to tunnel ssh
> connections (blowfish encryption in a 3DES tunnel, anyone?)

Some ppl think that using encryption to encrypt allrdy encrypted data
is dubble secure. This is in general certainly not true.
Instead, sometimes it becomes only easier to crack it.
So i wouldnt advice to use ssh in a ssh tunnel to aviod possible
problems like that.
Bye,

Mipam.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message