Functionality

[Darren Moffat]

>vs.
>
>	ssh -l root host
>	<with hostbased, public key, and SRP>
>
>and if you want a better audit trail:
>
>	root:x:0:0:root:/root:/bin/sh
>	fred:x:0:0:root:/root:/bin/sh
>	joe:x:0:0:root:/root:/bin/sh
>	frank:x:0:0:root:/root:/bin/sh
>
>where they all have different passwords (and 'root' has no valid password).


First this isn't the correct alias to be disussing the virtues of
direct or non direct root login so it is offtopic.

This does NOT provide the correct level of auditing because all the uid's
are the same.  The kernel doesn't know about names it only cares about uids
so in systems where the auditing is kernel based this doesn't help you
to identify which real person it was.

It also increases the vulnerability of the machine because now there are
4 passwords that give access to the root account rather than 1.  So the
probability of cracking or social engineering attempts has moved in favour
of the attacker.

As for the traffic analysis argument I though that current OpenSSH snapshots
had a fix for that.

--
Darren J Moffat