From owner-freebsd-security@FreeBSD.ORG Mon Mar 2 21:49:49 2009 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 46F671065715 for ; Mon, 2 Mar 2009 21:49:49 +0000 (UTC) (envelope-from david@catwhisker.org) Received: from albert.catwhisker.org (adsl-63-193-123-122.dsl.snfc21.pacbell.net [63.193.123.122]) by mx1.freebsd.org (Postfix) with ESMTP id EBCCD8FC1D for ; Mon, 2 Mar 2009 21:49:48 +0000 (UTC) (envelope-from david@catwhisker.org) Received: from albert.catwhisker.org (localhost [127.0.0.1]) by albert.catwhisker.org (8.14.3/8.14.3) with ESMTP id n22LUYJj091758; Mon, 2 Mar 2009 13:30:34 -0800 (PST) (envelope-from david@albert.catwhisker.org) Received: (from david@localhost) by albert.catwhisker.org (8.14.3/8.14.3/Submit) id n22LUYoW091757; Mon, 2 Mar 2009 13:30:34 -0800 (PST) (envelope-from david) Date: Mon, 2 Mar 2009 13:30:34 -0800 From: David Wolfskill To: Chris Palmer Message-ID: <20090302213034.GM65706@albert.catwhisker.org> Mail-Followup-To: David Wolfskill , Chris Palmer , freebsd-security@freebsd.org References: <20090302021415.GU5602@noncombatant.org> <200903021410.00093.mail@maxlor.com> <20090302021415.GU5602@noncombatant.org> <87sklwiptp.fsf@jehiel.elehack.net> <20090302211932.GZ5602@noncombatant.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="bIUMYB+SOIcERsee" Content-Disposition: inline In-Reply-To: <20090302211932.GZ5602@noncombatant.org> User-Agent: Mutt/1.4.2.3i Cc: freebsd-security@freebsd.org Subject: Re: OPIE considered insecure X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Mar 2009 21:49:49 -0000 --bIUMYB+SOIcERsee Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Mar 02, 2009 at 01:19:32PM -0800, Chris Palmer wrote: > ... > Benjamin Lutz writes: >=20 > > Because the inconvience of not using whatever service or data the serve= r is=20 > > providing is considered greater than the security risk. >=20 > But isn't regular password authentication the most convenient of all? Not in my experience, no. I configure ~/.xsession to run "eval `ssh-agent`" and "ssh-add" very early, so all processes run under that environment get the benefit of the cached authentication credentials I thus set up. Then I can login to most machines I care about directly, without requiring additional authentication. To me, that's far more convenient than ensuring that I'm around & paying attention whenever some random process (e.g., a CVS update) wants a password. And I strongly suspect that it's better security than a password. For my externally-visible sshd, there's no way I'd use a reusable password for authentication. As things presently stand, I only permit SSH public key authentication for that use. > ... Peace, david --=20 David H. Wolfskill david@catwhisker.org Depriving a girl or boy of an opportunity for education is evil. See http://www.catwhisker.org/~david/publickey.gpg for my public key. --bIUMYB+SOIcERsee Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (FreeBSD) iEYEARECAAYFAkmsT/kACgkQmprOCmdXAD2ivQCeKB6/L0JQU62x1DEwVJOF12Wk hj8Anjb+SjyCQqCBUCjHuiGDCk2XPyeo =lFaY -----END PGP SIGNATURE----- --bIUMYB+SOIcERsee--