4 ms·
This really is a bug in how OpenSSH USE_PAM is implemented. Particularly if you presume that PAM is the devil, the last thing you want to do, from a security s
by cbsmith 11y ago
This really is a bug in how OpenSSH USE_PAM is implemented.
Particularly if you presume that PAM is the devil, the last thing you want to do, from a security standpoint, is to let a client dictate how a server applies PAM. The policy _has_ to be entirely controlled by the server's config. Once you let the client decide, you're just asking for things to go wrong.
- acqq 11y agoYes, and this guy, quoted by the article author: "I wouldn't call that an OpenSSH bug. I would call it a systemic design flaw in PAM." is then clearly wrong, it is an OpenSSH bug.
- cbsmith 11y agoWell, it sort of isn't, because the OpenBSD team designed OpenSSH to not use PAM at all. PAM was patched in by some folks, and clearly they got it wrong, but I suspect the OpenSSH team doesn't see that as "part of OpenSSH".
- stsp 11y agoPAM support is part of OpenSSH portable releases. http://www.openssh.com/faq.html#3.15 http://www.openssh.com/faq.html#3.15