topic Re: getsockopt/getpeereid for openssh in Operating System - HP-UX

getsockopt/getpeereid for openssh

Alex Lavrov. — Mon, 17 Oct 2005 17:21:25 GMT

Hello,
trying to compile openssh here on 11i (goldpack september 2005). At the end of the configure I got this warning:

WARNING: the operating system that you are using does not
appear to support either the getpeereid() API nor the
SO_PEERCRED getsockopt() option. These facilities are used to
enforce security checks to prevent unauthorised connections to
ssh-agent. Their absence increases the risk that a malicious
user can connect to your agent.

Tried to figure out what I have to install/enable to get on of these 2 funcs work, but can't find anything. I see that I have "getsockopt" man pages :)

Thanx, Alex.

Re: getsockopt/getpeereid for openssh

Arunvijai_4 — Mon, 17 Oct 2005 23:54:57 GMT

Hi Alex,

Which version of OpenSSH you are trying to compile ? You can get 4.1p1 from software.hp.com http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

-Arun

Re: getsockopt/getpeereid for openssh

Alex Lavrov. — Tue, 18 Oct 2005 03:56:17 GMT

I compiled the newest version I found there. 4.2p1

I wonder if the HP supplied depot contains that functionality I mentioned.

Alex.

Re: getsockopt/getpeereid for openssh

Arunvijai_4 — Tue, 18 Oct 2005 04:01:31 GMT

Alex, Checked with SSH developer, he says its not yet available on HP-UX and no work arounds either, you have to live with that...

-Arun

Re: getsockopt/getpeereid for openssh

Alex Lavrov. — Tue, 18 Oct 2005 04:11:02 GMT

I know that getpeereid() is available only on BSD systems.

But I wonder what about getsockopt(). This patch for example PHNE_33159, contains fixes for this function.

Alex.

Re: getsockopt/getpeereid for openssh

Arunvijai_4 — Tue, 18 Oct 2005 04:23:00 GMT

PHNE_33159 contains fixes for getsockopt SO_ERROR on a listen() socket causes a conflict with accept() processing.and some man page related stuffs. I feel, it doesnt have SO_PEERCRED ..

-Arun