[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080516221056.GI16945@mandriva.com>
Date: Fri, 16 May 2008 19:10:58 -0300
From: "Gustavo De Nardin (spuk)" <gustavodn@...driva.com>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSH key blacklisting
* Solar Designer <solar@...nwall.com> [2008-05-17 01:58 +0400]:
> On Fri, May 16, 2008 at 05:10:43PM -0300, Gustavo De Nardin (spuk) wrote:
> > If this is going to be accepted as a more general solution, it'd be good to
> > allow also for local, admin-maintened, blacklists, not just upstream
> > maintened (and automatically updated).
>
> I agree that this might be desirable functionality, but unfortunately it
> has a price - we'd have to maintain two file parsers and lookup
> algorithms (perhaps binary and indexed, and text and sequential) or an
> additional program to update the binary file. (If we only create the
> binary file ourselves, then that program can be a quick hack - maybe
> even a Perl script.)
>
> Has there been any demand for such blacklists, prior to the Debian issue
> coming up? If not, then this additional feature is probably not worth
> implementing right away.
Not that I know of. I just imagined somewhere could have a policy like "all
keys must have X bits" or ".. X or larger" X being a non-default size. So
even if the database would be customized to have the extra keys,
auto-upgrading it (which would be desirable) could be a problem. Not a big
deal to me, personally.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
