3 ms·
As an example of who might be impacted, since openssh preserves the original command line passed to the ssh server when authenticating a public key that has a f
by _wmd 12y ago
As an example of who might be impacted, since openssh preserves the original command line passed to the ssh server when authenticating a public key that has a fixed command associated in authorized_keys, GitHub and BitBucket security teams are probably both having a really exciting day.
- scintill76 12y agoThis vulnerability is the kind of reason I would have a stripped-down OpenSSH for public users, if I were them. Hard-code to do what they need, don't use configuration files, remove any features not needed. For example, to print the "You've successfully authenticated, but GitHub does not provide shell access." a user gets trying to ssh to github.com, don't invoke anything, print it directly from the SSH server.
- graylights 12y agoMuch easier to implement a custom captive shell (default login shell for user) then to mess with the crypto system.
- scintill76 12y agoMaybe. Actually, it looks like Github is using libssh, which is along the lines of what I was thinking, without having to mess with crypto too much, as you say.
- thejosh 12y agoThis is what Atlassian Stash does.