Date: Sat, 17 May 2008 16:46:30 +0200 From: Robert Buchholz <rbu@...too.org> To: oss-security@...ts.openwall.com Cc: Solar Designer <solar@...nwall.com> Subject: Re: OpenSSH key blacklisting On Friday 16 May 2008, Solar Designer wrote: > Thanks for the "bug" reference. FWIW, the shell script in this > comment is vulnerable itself, in more than one way: > > http://bugs.gentoo.org/show_bug.cgi?id=221759#c9 > > For example, it lets a user have any other user's or root's > authorized_keys removed, by replacing .ssh with a symlink to someone > else's .ssh directory. Do you mean the race condition between finding and removing the key? Otherwise, I cannot see how to have someone else's removed. > > I assume whichever version has the acceptance of the OpenSSH > > upstream is what most of us would be willing to go with. Did you > > discuss either blacklist format with them already? > > Yes, very briefly. They don't intend to implement key blacklisting. That's not too helpful for our case. Do you have a patch to propose, implementing your idea? There has been approval of your idea inside Gentoo's hardened team. Robert Download attachment "signature.asc " of type "application/pgp-signature" (836 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.