Portable OpenSSH 2.5.1p1

[Gert Doering]

Hi,

On Mon, Feb 19, 2001 at 01:52:47PM -0500, Michael H. Warfield wrote:
[..]
> 	I think the point here is that the reserved ports boundry is
> a Unix fiction that other operating systems don't have to adhere
> to.  That means that access to your server is based on policies present
> on the client system over which you probably have no control.  If you
> can't guarantee that the reserved port designation means anything at all
> to the client side, then using it to make security decisions doesn't
> really add anything to the security at all.

Ummm, well, yes.  But that's the "I have to trust 'root' on the client
system issue" in disguise.

If there's a client system that has a trusted admin, an operating system
that does have the notion of privileged ports, and I decide to permit
a specific account on *that* system to use my .shosts, there is a big
difference whether sshd checks for privileged ports or not.

Without checking for privileged ports, you're effectively making
RhostsRsaAuthentication completely useless, as every user can disguise as
every other user, and should then better drop it completely.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert.doering at physik.tu-muenchen.de