3 ms·

All I'm saying is that the world is not coming to an end. I never realized the issue existed when I've used command-limited SSH, and I should know better. The

All I'm saying is that the world is not coming to an end. I never realized the issue existed when I've used command-limited SSH, and I should know better. The OpenBSD developers and administrators should really know better. I'm actually embarrassed that I didn't recognize the issue, and I'm glad someone noted it publicly so I won't repeat the mistake. Yeah, people can send spam or something. http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar.gz http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar.... Are the contents of that URL trustable? What about bypassing firewall restrictions? So keep it turned off. But the sky is not falling. Who said it was?

ars 17y ago
You can do a lot more than that with CVS access. CVS is not secure. If you have write access to the ADMIN directory you can run arbitrary programs via CVS. And if you have no write access, then what is the point of running it via ssh anyway? BTW giving someone write access to CVS without also access to ADMIN is a lot harder than it looks. Running restricted account via SSH is not very common, while shell account via SSH is, so in that light the default is correct. It is really really hard to properly secure a restricted access account. So if you are going to do it, it's your job to do it properly.