[Bug 402] New: Suggested sshrc script unsafe

[bugzilla-daemon at mindrot.org]

http://bugzilla.mindrot.org/show_bug.cgi?id=402

           Summary: Suggested sshrc script unsafe
           Product: Portable OpenSSH
           Version: -current
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: minor
          Priority: P2
         Component: Documentation
        AssignedTo: openssh-unix-dev at mindrot.org
        ReportedBy: kolya at mit.edu


The sshrc code suggested at the bottom of sshd(8) is unsafe,
in that it passes around the xauth key as an argument to
xauth -- while xauth is running, the key is, on most systems,
visible to other users on the same machine.  A more secure
way to pass the key is something like:

  echo add $DISPLAY $proto $cookie | xauth -q

which, in /bin/sh on most systems, uses the built-in echo
command.

While this isn't strictly a bug, it seems poor to suggest
code that exposes the xauth key.  Incidentally, it may also
be nice to use "xauth -q" instead of just "xauth", since the
same manpage also warns that sshrc shouldn't output anything
to stdout, which "xauth" does.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.