Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 17 Mar 2009 16:02:44 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: Re: lxc-sshd security issues?

On Thu, 5 Mar 2009, Michael K. Johnson wrote:

> I finally got the right contact info upstream, and we're talking
> about this, so expect it to not be a problem in future releases.
> For the record, it's dummy auth data, but still could be seen as a
> backdoor, and will probably be changed to user-configured value.

By "dummy auth data," do you mean that it's replaced with real/unique
passwords/keys before the system becomes operational?  Or do these
pre-packaged values work unless the admin RTFM?  (If the latter, then it
needs a CVE; if the former, then there doesn't seem to be a vuln because
there's no impact on authentication).

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.