3 ms·
This vulnerability is the kind of reason I would have a stripped-down OpenSSH for public users, if I were them. Hard-code to do what they need, don't use confi
by scintill76 12y ago
This vulnerability is the kind of reason I would have a stripped-down OpenSSH for public users, if I were them. Hard-code to do what they need, don't use configuration files, remove any features not needed. For example, to print the "You've successfully authenticated, but GitHub does not provide shell access." a user gets trying to ssh to github.com, don't invoke anything, print it directly from the SSH server.
- graylights 12y agoMuch easier to implement a custom captive shell (default login shell for user) then to mess with the crypto system.
- scintill76 12y agoMaybe. Actually, it looks like Github is using libssh, which is along the lines of what I was thinking, without having to mess with crypto too much, as you say.
- thejosh 12y agoThis is what Atlassian Stash does.