poor permissions on ssh binary

[Geoff Raye]

I just installed portable openssh 2.9p2, but the issue I have shouldn't
be unique to the portable version.

I built with
% ../configure --prefix=/usr/local/encap/openssh-2.9p2
--sysconfdir=/etc --with-cflags=-O2 --with-tcp-wrappers
--with-ssl-dir=/usr/local --with-md5-passwords --disable-suid-ssh

When it came time to make install, this command was executed:
/usr/local/bin/install -c -m 0711 -s ssh /usr/local/encap/openssh-2.9p2/bin/ssh

I consider it a poor choice of permissions to make ssh be 0711, and I
believe that configure.in should be changed on line 1624:
       SSHMODE=0755
would make more sense than
       SSHMODE=0711

For that matter, I believe that the suid root binary has no compelling
reason not to be world-readable, either, but I don't know whether there
have been past security implications of this which would warrant keeping
the file unreadable and not copyable.

In any event, keeping non-suid ssh binaries 0711 is a choice which goes
back to the original f-secure/commercial/tatu SSH.

Thank you for your consideration.

Geoff Raye

-- 
Geoff Raye       \ All irregularities will be handled by the forces
geoff at raye.com    \ controlling each dimension.  Transuranic heavy
                   \ elements may not be used where there is life.