This is the mail archive of the mailing list for the Cygwin project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: [ANNOUNCEMENT] Updated: OpenSSH-3.5p1-1

On Thu, Nov 07, 2002 at 06:59:08AM -0800, Karl M wrote:
> Hi All...
> I just updated to 3.5p1-1. I had to set PermitUserEnvironment in my 
> sshd_config file. Should this be included by default in the ssh-host-config 
> script?

You're right that PermitUserEnvironment should be added to ssh-host-config.
But it's set to no by default, so you have to change it anyway.

> I was a bit puzzled by the file owner and permission checking for the host 
> keys now (with StrictModes enabled)...If the owner is wrong, the mode 
> checking is ignored. I recall this test being stronger in the past...didn't 
> the owner have to be correct (SYSTEM)? If so, why the change to a kinder 
> gentler (less effective) safety check?

auth.c, line 378ff:

  if (options.strict_modes &&
      (stat(user_hostfile, &st) == 0) &&
      ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
      (st.st_mode & 022) != 0)) {
	  log("Authentication refused for %.100s: "
	      "bad owner or modes for %.200s",
	      pw->pw_name, user_hostfile);

The above code checks the mode additionally to the user id so what's
gentler here?  Or do you mean another piece of code?

> Given the host local security issues with using Cygwim, is there much 
> advantage to priv sep? Could someone please give a brief overview of what it 
> is and how and why it helps?



Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Developer                      
Red Hat, Inc.

Unsubscribe info:
Bug reporting:

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]