[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <200805171646.37622.rbu@gentoo.org>
Date: Sat, 17 May 2008 16:46:30 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: Solar Designer <solar@...nwall.com>
Subject: Re: OpenSSH key blacklisting
On Friday 16 May 2008, Solar Designer wrote:
> Thanks for the "bug" reference. FWIW, the shell script in this
> comment is vulnerable itself, in more than one way:
>
> http://bugs.gentoo.org/show_bug.cgi?id=221759#c9
>
> For example, it lets a user have any other user's or root's
> authorized_keys removed, by replacing .ssh with a symlink to someone
> else's .ssh directory.
Do you mean the race condition between finding and removing the key?
Otherwise, I cannot see how to have someone else's removed.
> > I assume whichever version has the acceptance of the OpenSSH
> > upstream is what most of us would be willing to go with. Did you
> > discuss either blacklist format with them already?
>
> Yes, very briefly. They don't intend to implement key blacklisting.
That's not too helpful for our case.
Do you have a patch to propose, implementing your idea? There has been
approval of your idea inside Gentoo's hardened team.
Robert
Download attachment "signature.asc " of type "application/pgp-signature" (836 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
