oss-security - Re: OpenSSH key blacklisting

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 4 Jun 2008 18:18:26 +0000
From: The Fungi <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSH key blacklisting

On Wed, Jun 04, 2008 at 11:14:12AM -0400, Nathanael Hoyle wrote:
[...]
> However, the reason debian got into the mess they did in the first
> place with this was specifically because they were trying to
> remove responsibility from the can't-be-bothered users for
> configuration. At one point, nearly all ssh key generation systems
> required the user the type keys 'at random' on the keyboard,
> and/or to move the mouse to generate an entropy pool for a seed
> value for key generation. Because debian performs key-generation
> on first boot in most cases, that early in the startup there might
> not be sufficient entropy in the network traffic for utility. I
> guess they found that users were either incapable of or
> disinclined to participate in the key generation process.
[...]

Not to be argumentative, but have you installed OpenBSD lately
(effectively the reference platform for OpenSSH development)? For
years, its base install has run sshd by default, generated host keys
at first boot, and not prompted at the console for human interaction
to augment entropy for this process. I find it hard to blame this
*particular* behavior on Debian (unless you're suggesting that they
strong-armed OpenSSH upstream to integrate these changes on their
behalf?).
-- 
{ IRL(Jeremy_Stanley); PGP(9E8DFF2E4F5995F8FEADDC5829ABF7441FB84657);
SMTP(fungi@...goth.org); IRC(fungi@....yuggoth.org#ccl); ICQ(114362511);
AIM(dreadazathoth); YAHOO(crawlingchaoslabs); FINGER(fungi@...goth.org);
MUD(fungi@...arsis.mudpy.org:6669); WWW(http://fungi.yuggoth.org/); }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.