Portable OpenSSH 2.5.1p1

[Gert Doering]

Hi,

On Tue, Feb 20, 2001 at 03:00:00AM +1100, Damien Miller wrote:
> 5) Important changes in the implementation of SSH 1 protocol:
> 
>     The OpenSSH server does not require a privileged source port for
>     RhostsRsaAuthentication, since it adds no additional security.

I don't buy (understand?) that.

Using RhostsRsaAuthentication, I can give user "A" the right to log into an
account, but not user "B" on the same client machine.  

Requiring privileged ports for this means "user B can't compile his own
ssh client that pretents he's user A", so user B can't easily hack into my
account.  Now if I don't trust "root" on the client machine, or if B can
get root access, I'm lost anyway, that's true (but if they have root 
access, they can hijack my ssh sessions by fiddling with ttys, so in 
that case, I have lost in any case).

But if no suid port is required, RostsRsaAuthentication is effectively 
useless if you're doing this on a multi-user system.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert.doering at physik.tu-muenchen.de