From owner-freebsd-security Mon Jun 28 23:45:33 1999 Delivered-To: freebsd-security@freebsd.org Received: from alfik.ms.mff.cuni.cz (alfik.ms.mff.cuni.cz [195.113.19.71]) by hub.freebsd.org (Postfix) with ESMTP id 0F79E14C87 for ; Mon, 28 Jun 1999 23:45:27 -0700 (PDT) (envelope-from mencl@nenya.ms.mff.cuni.cz) Received: from nenya.ms.mff.cuni.cz by alfik.ms.mff.cuni.cz; (8.8.8/v1.00/19990210.0854) id IAA17299; Tue, 29 Jun 1999 08:45:26 +0200 (MET DST) Received: from localhost by nenya.ms.mff.cuni.cz (SMI-8.6/SMI-SVR4) id IAA02093; Tue, 29 Jun 1999 08:40:51 +0200 Date: Tue, 29 Jun 1999 08:40:51 +0200 (MET DST) From: "Vladimir Mencl, MK, susSED" X-Sender: mencl@nenya To: security@FreeBSD.ORG Subject: Re: ssh from windows In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, 28 Jun 1999, Barrett Richardson wrote: > > > On Thu, 24 Jun 1999, Dan Langille wrote: > > > > The password you enter is the password for your account. > > > > Granted. I was worried they were transmitting the password in clear text. > > Oh. The client encrypts it with the public key sent by the server - but > the server's private key isn't passphrase protected (it is, however, > readable only by root -- unless you change it). I'm afraid you are wrong. The RSA keys stored on disk are used for host authentication only. Passwords (and all other session data) are encrypted by a ``session key'', which is generated every (?3?) hours, and is not stored anywhere. And is not bound to RSA, the session encryption uses other encryption algorithms (with not that much overhead). Like blowfish, idea ... and I think, it generally uses shorter keys. However, if you are root, you can attach to the sshd process, and get the session keys out of its memory ... BTW, is there any way of limiting attaching to system processes at higher securelevels? I was thinking about attaching to init (because "init can lower securelevel"), but I received a "permission denied" at securelevel 2, and a signal 11 at securelevel -1 ???? I don't know why, I received it not only in 'gdb `which init` 1', but also in a later 'gdb `which gdb` gdb.core' ... is init protected against debugging in a special way? Vladimir Mencl To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message