<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: Call for testing for 3.5 OpenSSH</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>It's an organizational value, not a personal one. It's much harder to get an exception from way on high to turn off password aging on 500 unix servers than it is to just turn off privsep.</FONT></P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: Damien Miller [<A HREF="mailto:djm@mindrot.org">mailto:djm@mindrot.org</A>]</FONT>
<BR><FONT SIZE=2>Sent: Thursday, September 26, 2002 8:31 AM</FONT>
<BR><FONT SIZE=2>To: Lacoss-Arnold, Jason</FONT>
<BR><FONT SIZE=2>Cc: 'Darren Tucker'; Jeff Koenig; Portable OpenSSH</FONT>
<BR><FONT SIZE=2>Subject: RE: Call for testing for 3.5 OpenSSH</FONT>
</P>
<BR>
<P><FONT SIZE=2>On Thu, 2002-09-26 at 23:14, Lacoss-Arnold, Jason wrote:</FONT>
<BR><FONT SIZE=2>> For whatever its worth, we're doing the same thing with no problems so far.</FONT>
<BR><FONT SIZE=2>> We turned the auth-pam stuff on and privsep off. We'd love to use privsep,</FONT>
<BR><FONT SIZE=2>> but usable password aging is more important.</FONT>
</P>
<P><FONT SIZE=2>You are so wrong...</FONT>
</P>
<P><FONT SIZE=2>How many break-ins are achieved by guessed passwords? </FONT>
</P>
<P><FONT SIZE=2>How many by exploiting bugs in server software?</FONT>
</P>
<P><FONT SIZE=2>-d</FONT>
</P>
<CODE><FONT SIZE=3><BR>
<BR>
***********************************************************************************<BR>
WARNING: All e-mail sent to and from this address will be received or<BR>
otherwise recorded by the A.G. Edwards corporate e-mail system and is<BR>
subject to archival, monitoring or review by, and/or disclosure to,<BR>
someone other than the recipient.<BR>
************************************************************************************<BR>
</FONT></CODE></BODY>
</HTML>