From owner-freebsd-stable Wed May 30 8:58:12 2001 Delivered-To: freebsd-stable@freebsd.org Received: from earth.backplane.com (earth-nat-cw.backplane.com [208.161.114.67]) by hub.freebsd.org (Postfix) with ESMTP id ECF8737B422 for ; Wed, 30 May 2001 08:58:09 -0700 (PDT) (envelope-from dillon@earth.backplane.com) Received: (from dillon@localhost) by earth.backplane.com (8.11.3/8.11.2) id f4UFvxh40288; Wed, 30 May 2001 08:57:59 -0700 (PDT) (envelope-from dillon) Date: Wed, 30 May 2001 08:57:59 -0700 (PDT) From: Matt Dillon Message-Id: <200105301557.f4UFvxh40288@earth.backplane.com> To: Vivek Khera Cc: Seth , stable@FreeBSD.ORG Subject: Re: adding "noschg" to ssh and friends References: <15124.4635.887375.682204@onceler.kciLink.com> <20010529145609.A1209@xor.obsecurity.org> <15124.7132.963202.560009@onceler.kciLink.com> <200105292211.f4TMBpB30316@earth.backplane.com> <20010529183239.B14308@psychotic.aberrant.org> <200105292315.f4TNFOu31573@earth.backplane.com> <15125.1433.517037.245078@onceler.kciLink.com> Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG :I guess in general, that may be correct. But wouldn't you want some :reassurance that your only "secure" connection to the machine is not :tamered with? That is, if your machine is compromised, and the only :way you can connect to it is via a trojaned service, then you're :really hosed. I think ssh should be protected from this type of :attack. Well, lets see... what if someone modified /etc/ssh/config ? Or what if someone added a command= directive to your public key in ~/.ssh/authorized_keys ? Or what if someone modified pam (which ssh uses) ? Or what if someone changed the ldconfig path? etc etc etc. So the answer is no. :In any case, what about my other question? If I "schg" the ssh :related executables and libs, will installworld croak or does it know :to noschg all files first? I can't see that it does it even for the :binaries that are schg in the system already (like rsh). I've no idea on that one. -Matt To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message