Date: Fri, 1 Jun 2001 14:37:55 -0700 From: Kris Kennaway <kris@obsecurity.org> To: "Karsten W. Rohrbach" <karsten@rohrbach.de> Cc: Kris Kennaway <kris@obsecurity.org>, Crist Clark <crist.clark@globalstar.com>, security@FreeBSD.org Subject: Re: Apache Software Foundation Server compromised, resecured. (fwd) Message-ID: <20010601143755.B88206@xor.obsecurity.org> In-Reply-To: <20010601161951.F10477@mail.webmonster.de>; from karsten@rohrbach.de on Fri, Jun 01, 2001 at 04:19:51PM %2B0200 References: <Pine.BSF.4.21.0105311727160.66343-100000@pogo.caustic.org> <3B16E7D9.3E9B78FF@globalstar.com> <20010531183732.B12216@xor.obsecurity.org> <3B16F492.128CB8B0@globalstar.com> <20010531191001.A12808@xor.obsecurity.org> <3B16FD12.B1F251C8@globalstar.com> <20010531193555.A13334@xor.obsecurity.org> <20010601161951.F10477@mail.webmonster.de>
next in thread | previous in thread | raw e-mail | index | archive | help
--7ZAtKRhVyVSsbBD2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jun 01, 2001 at 04:19:51PM +0200, Karsten W. Rohrbach wrote: > Kris Kennaway(kris@obsecurity.org)@2001.05.31 19:35:55 +0000: > > On Thu, May 31, 2001 at 07:25:22PM -0700, Crist Clark wrote: > >=20 > > > According to the documentation, this is NOT how the agent forwarding > > > works. The second client passes data, typically a challenge, back to= =20 > > > machine one, where the agent does its thing with the private key=20 > > > material, then passes the decrypted challenge information back to > > > machine two. > >=20 > > Okay, I'm willing to admit I could be wrong about the mechanism, but > > the trust relationship still exists. The ssh-agent authenticates on > > demand, so as long as you're connected to the untrusted system it can > > authenticate as you to other systems without your permission. > this does not lead to a big tragedy since the agent protocol is > challenge-response. Yes, but it's done on demand with no auditing. Two systems with an ssh-agent connection between them walked into a bar. System B says to System A, "Your user told me to buy this fine imported Australian beer, and that you'd pay for it. Just sign this cheque". "Well, okay, here you go". System B drinks its fine imported Australian beer and enjoys it. System B says to the bartender, "I'll have another one of those, thanks. My friend here is paying." "No problem, if my user says it's okay, I'm sure it's fine!", says the ever-trusting System A. System B drinks its fine imported Australian beer and enjoys it. At the end of the night System B stumbles back home, happy and full of Coopers Pale Ale; System A skips merrily home, happy that it was able to help its user so much tonight; and the user is none the wiser until he thinks to balance his chequebook at the end of the month. "I spent $100 on beer? Hmm, I don't remember that at all..it must have been a good night!" Kris --7ZAtKRhVyVSsbBD2 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7GAszWry0BWjoQKURAhHnAJ9d3FpD/uF/i5yy7UhLLpuBJ4FTLgCgwXQd 07RQIitxo0GWeOvTw+ZU6oE= =BYCZ -----END PGP SIGNATURE----- --7ZAtKRhVyVSsbBD2-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010601143755.B88206>