PermitUserEnvironment in sshd match block?

[Darren Tucker]

Daniel Allen wrote:
> Hello,
> 
> Our campus environment would find it very useful to pass 
> user-environment variables for certain login ssh connections, but of 
> course want to avoid the security problems with LD_PRELOAD and 
> PermitUserEnvironment as described in sshd_config manpages.
> 
> Would the best answer be a patch that adds PermitUserEnvironment support 
> inside match blocks?

That seems like a reasonable thing to do.

> Are there technical or other reasons this has 
> already been considered and rejected?

The approach to adding things to Match has been on a case by case basis, 
checking if the thing is a) useful and b) safe.  It's a lot easier to 
evaluate these thing one at a time than in a large batch of them.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.