3 ms·

What's the point of declaring "this is not a huge deal"? This, like an open wireless access point, can be very huge deal depending on the network/organization i

What's the point of declaring "this is not a huge deal"? This, like an open wireless access point, can be very huge deal depending on the network/organization in question. Moreover, a "vetted" user is any user that has acquired a vetted user's SSH keys or password. With individuals regularly SSH'ing from remote, compromised machines, this happens all surprisingly often.

jrockway 17y ago
All I'm saying is that the world is not coming to an end. Yeah, people can send spam or something. So keep it turned off. But the sky is not falling.
- antonovka 17y ago
  All I'm saying is that the world is not coming to an end. I never realized the issue existed when I've used command-limited SSH, and I should know better. The OpenBSD developers and administrators should really know better. I'm actually embarrassed that I didn't recognize the issue, and I'm glad someone noted it publicly so I won't repeat the mistake. Yeah, people can send spam or something. http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar.gz http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar.... Are the contents of that URL trustable? What about bypassing firewall restrictions? So keep it turned off. But the sky is not falling. Who said it was?
  - ars 17y ago
    You can do a lot more than that with CVS access. CVS is not secure. If you have write access to the ADMIN directory you can run arbitrary programs via CVS. And if you have no write access, then what is the point of running it via ssh anyway? BTW giving someone write access to CVS without also access to ADMIN is a lot harder than it looks. Running restricted account via SSH is not very common, while shell account via SSH is, so in that light the default is correct. It is really really hard to properly secure a restricted access account. So if you are going to do it, it's your job to do it properly.

jrockway 17y ago

All I'm saying is that the world is not coming to an end. Yeah, people can send spam or something. So keep it turned off. But the sky is not falling.

antonovka 17y ago
All I'm saying is that the world is not coming to an end. I never realized the issue existed when I've used command-limited SSH, and I should know better. The OpenBSD developers and administrators should really know better. I'm actually embarrassed that I didn't recognize the issue, and I'm glad someone noted it publicly so I won't repeat the mistake. Yeah, people can send spam or something. http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar.gz http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar.... Are the contents of that URL trustable? What about bypassing firewall restrictions? So keep it turned off. But the sky is not falling. Who said it was?
- ars 17y ago
  You can do a lot more than that with CVS access. CVS is not secure. If you have write access to the ADMIN directory you can run arbitrary programs via CVS. And if you have no write access, then what is the point of running it via ssh anyway? BTW giving someone write access to CVS without also access to ADMIN is a lot harder than it looks. Running restricted account via SSH is not very common, while shell account via SSH is, so in that light the default is correct. It is really really hard to properly secure a restricted access account. So if you are going to do it, it's your job to do it properly.