getpeereid

[Darren Tucker]

Darren Tucker wrote:
> Corinna Vinschen wrote:
>> ?  Is there any good reason why root should be able to connect to the
>> ssh-agent of a user?  What is that reason?
> 
> ssh is setuid root in some configurations (eg for 
> RhostsRSAAuthentication, UsePrivilegedPort).

Hmm, on the other hand, ssh should have dropped privs by that point anyway.

On the other, other hand, it doesn't buy any additional protection since 
all root has to do is "su user -c ssh whatever".

Maybe it's to allow the use of the agent when someone su's (or sudo's) to 
root?  The cvs log on ssh-agent.c (rev 1.113) says:

  - markus at cvs.openbsd.org 2002/10/01 20:34:12
    [ssh-agent.c]
    allow root to access the agent, since there is no protection from root.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.