[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 3 Jun 2008 08:15:30 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSH key blacklisting
Hi,
On Tue, Jun 03, 2008 at 12:37:59AM +0100, Tim Brown wrote:
> AFAIK, SSH wasn't born of RFCs but rather the RFCs were born from an
> implementation. That being said, I don't consider an open source
One needs to dig in history but I think thats not quite true
for SSH2. At least the SSH clients/servers today are written
to implement the RFC.
> implementation (of a new standard) to be proprietry but rather a reference
> implementation which others can choose to follow (or not). Others may beg to
When I said "should not implement proprietary stuff" it was not meant
that they are actually doing it today. Rather I acknowledged that
it indeed meets the RFC quite well.
Blacklisting certain keys is probably not against the RFC,
but it would be better to specify such additional security
measurement in the RFC as well. Especially the point in time when it has
to happen. I'd prefer blacklisting before the key
is checked against the authorized_hosts file. (as it happens
with the blacklist patch in SSH2 pubkey authentication)
Sebastian
--
~
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
~ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
