From owner-freebsd-security@FreeBSD.ORG Thu Sep 18 17:19:57 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D1ED516A4B3 for ; Thu, 18 Sep 2003 17:19:57 -0700 (PDT) Received: from arginine.spc.org (arginine.spc.org [195.206.69.236]) by mx1.FreeBSD.org (Postfix) with ESMTP id E76B343F75 for ; Thu, 18 Sep 2003 17:19:56 -0700 (PDT) (envelope-from bms@spc.org) Received: from localhost (localhost [127.0.0.1]) by arginine.spc.org (Postfix) with ESMTP id 76AE765404; Fri, 19 Sep 2003 01:19:55 +0100 (BST) Received: from arginine.spc.org ([127.0.0.1]) by localhost (arginine.spc.org [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 29713-02; Fri, 19 Sep 2003 01:19:54 +0100 (BST) Received: from saboteur.dek.spc.org (unknown [81.3.72.68]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by arginine.spc.org (Postfix) with ESMTP id 77D80652D3; Fri, 19 Sep 2003 01:19:54 +0100 (BST) Received: by saboteur.dek.spc.org (Postfix, from userid 1001) id E40BB9; Fri, 19 Sep 2003 01:19:51 +0100 (BST) Date: Fri, 19 Sep 2003 01:19:51 +0100 From: Bruce M Simpson To: Avleen Vig Message-ID: <20030919001951.GD2720@saboteur.dek.spc.org> Mail-Followup-To: Avleen Vig , Roger Marquis , freebsd-security@freebsd.org References: <20030918192135.744AADACAF@mx7.roble.com> <20030918231811.GE527@silverwraith.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030918231811.GE527@silverwraith.com> Organization: SPC cc: freebsd-security@freebsd.org cc: Roger Marquis Subject: Re: FreeBSD Security Advisory FreeBSD-SA-03:12.openssh X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Sep 2003 00:19:58 -0000 On Thu, Sep 18, 2003 at 04:18:11PM -0700, Avleen Vig wrote: > On Thu, Sep 18, 2003 at 12:21:35PM -0700, Roger Marquis wrote: > > Why FreeBSd's default installation still uses a legacy stand-alone > > ssh daemon is a question many systems administrators are asking. > > I'm certainly not one of those systems administrators. > I manage > 700 systems on a daily basis (not alone, obviosuly, and not > all FreeBSD). > I don't want one service (ssh) being dependant on anoyher service > (inetd). This is bad system design. When you run out of inetd to service a single connection, you have to generate a new ephemeral key for every ssh instance. This is a needless waste of precious entropy from /dev/random. I think running sshd out of inetd is a very bad idea indeed, unless Mr Marquis is willing to stay in my datacenter and hammer the keys like a monkey all day, but even then that might be a poor source of entropy. BMS