ssh -2 and hostbasedauth

[Dan Astoorian]

On Sat, 17 Nov 2001 08:07:27 EST, Markus Friedl writes:
> On Fri, Nov 16, 2001 at 12:16:10PM -0500, Dan Astoorian wrote:
> > I think that if this is done, it might be worth considering (if this
> > isn't already what you had in mind) setting it up such that if the
> > client requests it, debug messages--at least the ones which disclose
> > questionable information--are produced and logged on the server side,
> > but _not_ sent back to the client.
> 
> too complicated, would need a protocol change.

Sorry.  I hadn't realized that SSH[2]_MSG_DEBUG messages were sent
unconditionally, and only displayed if the client was in verbose mode; I
had assumed the client solicited the debugging messages.  You're right:
extending the protocol for this would be a bad idea.

Can I at least recommend that, at least by default, any
authentication-related debugging be recorded via local (syslog/stderr)
interfaces only (e.g., verbose() or debug()), and not disclosed via
packet_send_debug()?

Moreover, perhaps existing instances of packet_send_debug()--such as the
"accepted by .shosts" message previously discussed--be reevaluated for
the appropriateness and necessity of the information they disclose.

Thanks,

-- 
Dan Astoorian               People shouldn't think that it's better to have
Sysadmin, CSLab             loved and lost than never loved at all.  It's
djast at cs.toronto.edu        not, it's better to have loved and won.  All
www.cs.toronto.edu/~djast/  the other options really suck.    --Dan Redican