RE: setuid for "ssh"

So you are running ssh ver1?



Regards,



Gavin McDonald

========================

EVI Logistic Enterprises

email: me@xxxxxxxxxxxx

phone: (604) 313-3845





_____

From: Sachin Bhugra [mailto:bhugra.sachin@xxxxxxxxx]
Sent: Thursday, December 29, 2005 10:52 PM
To: General Red Hat Linux discussion list
Cc: gavitron@xxxxxxxxx; alan@xxxxxxxxxxxxxx
Subject: Re: setuid for "ssh"



Hi,

I understand that it is dangerous to give root permissions, but the issue is
if you want to use RhostsAuthentication then you need to enable privileged
ports for ssh i.e. UsePrivilegedPorts yes in ssh_config, which requires ssh
to setuid root. Actually thats the way it has been written in man
ssh_config. Here is what it says:

RhostsAuthentication
Specifies whether to try rhosts based authentication. Note that
this declaration only affects the client side and has no effect
whatsoever on security. Most servers do not permit RhostsAuthen-
tication because it is not secure (see RhostsRSAAuthentication).
The argument to this keyword must be "yes" or "no". The default
is "no". This option applies to protocol version 1 only and
requires ssh to be setuid root and UsePrivilegedPort to be set to
"yes".

PS: Also, i am enabling this form of Authentication only for my private
network.

--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list

Relevant Pages

  • Re: setuid for "ssh"
    ... I understand that it is dangerous to give root permissions, ... if you want to use RhostsAuthentication then you need to enable privileged ... ports for ssh i.e. UsePrivilegedPorts yes in ssh_config, ... Specifies whether to try rhosts based authentication. ...
    (RedHat)
  • Re: Question regarding shell user creation at login time
    ... In the last episode, ... Ah, but if he is in fact running /home/new/new, which is setuid root, ... can't think of how ssh would be nullifying the setuid bit on that ...
    (freebsd-hackers)
  • Re: sshd handing all authentication to shell
    ... >I would like to use SSH for transport only into an embedded device. ... >login/password authentication but since it is using SSH for transport, ... You don't state what SSH server you're planning to use, ... I believe that in principle a client should be able to request ...
    (comp.security.ssh)
  • Re: ssh
    ... ssh can use DSA or RSA keys for authentication. ... public key can decrypt. ... is significantly smaller than that for ssh RSA/DSA keypairs. ... host to capture the key (either an unprotected key or a capture of your ...
    (Vuln-Dev)
  • SSH 2.4.0/3.0.1 usernames guessable ?
    ... As we were playing a bit with some SSH versions we ... warning: Authentication failed. ... scp: warning: ssh2 client failed to authenticate. ...
    (Vuln-Dev)