[Bug 1893] New: change ssh-keisign to setgid from setuid

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=1893

           Summary: change ssh-keisign to setgid from setuid
           Product: Portable OpenSSH
           Version: 5.8p1
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Miscellaneous
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: jchadima at redhat.com


the setgid programs are potentially less dangerous than setuid ones.

the only setuid program in the openssh suite is ssh-keysign. It need to
access private server keys.

The solution is to create one dedicated group (ssh_keys).
The keys then should be rw-r---- root:ssh_keys
The ssh-keysign should be setgid ssh_keys
And finally authfile.c should be patched to accept such keys.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.