Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 2 Sep 2000 22:32:44 +0200
From:      Neil Blakey-Milner <nbm@mithrandr.moria.org>
To:        Poul-Henning Kamp <phk@critter.freebsd.dk>
Cc:        Brian Somers <brian@Awfulhak.org>, "Jacques A. Vidrine" <n@nectar.com>, Dan Nelson <dnelson@emsphone.com>, sthaug@nethelp.no, ume@FreeBSD.ORG, arch@FreeBSD.ORG
Subject:   Re: setuid ssh should die (Re: Request for review: nsswitch)
Message-ID:  <20000902223244.A39844@mithrandr.moria.org>
In-Reply-To: <41784.967926245@critter>; from phk@critter.freebsd.dk on Sat, Sep 02, 2000 at 10:24:05PM %2B0200
References:  <200009022015.e82KFN740808@hak.lan.Awfulhak.org> <41784.967926245@critter>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sat 2000-09-02 (22:24), Poul-Henning Kamp wrote:
> In message <200009022015.e82KFN740808@hak.lan.Awfulhak.org>, Brian Somers write
> s:
> >> On Sat, Sep 02, 2000 at 02:58:22PM -0500, Dan Nelson wrote:
> >> > Rather, it's so it can read the host key, which is only readable by
> >> > root.
> >> 
> >> We're talking about ssh, not sshd.
> >> 
> >> IMHO, ssh should be mode 0555.  I have to change this all the time on
> >> my machines, since I often socksify ssh.
> >
> >Yes, a make.conf variable would be in order, defaulting to 0555 in 
> >line with FallBackToRsh being set to no in /etc/ssh/ssh_config. 
> 
> Uhm, how about a ssh_config variable where you tell it to drop
> the setuid bit right away, wouldn't that work ?

I'd prefer to leave it off.  It means one less file to assure myself is
safe, if I were thinking with my paranoid security hat on.

Most configurations don't need it, and those that do have to edit
/etc/ssh/sshd_config on the server side anyway.  A comment there will be
the most effective way to getting to it.

/etc/ssh/sshd_config has already:

IgnoreRhosts yes
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
RhostsRSAAuthentication no

The make.conf variable would be useful not to whack that suid bit off
next time you buildworld.

Neil
-- 
Neil Blakey-Milner
Sunesi Clinical Systems
nbm@mithrandr.moria.org


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000902223244.A39844>