topic Re: OpenSSH and TCB in Operating System - HP-UX

OpenSSH and TCB

Karen Shen_1 — Mon, 07 Jul 2003 17:09:14 GMT

On hpux 11.00 server with TCB enabled and openssh 2.5.1p1 installed, users will be forced to change password as set up when they login using telnet. But this is skipped/by-passed when they use SSH.

Any idea why and how to prevent it?

Thanks!

Karen

Re: OpenSSH and TCB

Andrew Cowan — Tue, 08 Jul 2003 04:49:06 GMT

Hi Karen,

Unfortunately this is the same situation on all Unix platforms as SSH is written to be as generic and portable as possible. In order to generic the authors could not easily tie SSH into each OS's password ageing system.

You also have the same situation if you use keys to login, and there's nothing to stop you choosing a passphrase of /Nothing, and there is no history management or timeout.

The only solution I can offer is to only allow users to SSH to other unprivileged users, and then "su". You can then enforce the password ageing on those accounts, and you also have a record of who used them, and when.

Andrew

Re: OpenSSH and TCB

John Bolene — Tue, 08 Jul 2003 12:53:04 GMT

just hit submit once and wait

for some reason it comes back almost immediately but it is not done

Re: OpenSSH and TCB

D. Jackson_1 — Tue, 08 Jul 2003 20:50:53 GMT

I think this has been added as a "feature" in the latest openssh release..

GooD LUck

Re: OpenSSH and TCB

Andrew Cowan — Wed, 09 Jul 2003 03:54:36 GMT

Hi John,

Thanks for sorting out my duplicate posts. Sometimes when I press submit I can wait for 20 minutes and then get a "page not found" error, and perhaps nothing is posted. Here at the bank we have an E3 connection so it should (and 90% of the time does) happen pretty-much instantly, however every now and again it seems to go pear-shaped.

Re: OpenSSH and TCB

Steven Sim Kok Leong — Sat, 12 Jul 2003 01:54:48 GMT

Hi,

Your version of openssh is extremely old. You should upgrade it to the latest which fixes quite a number of security issues since openssh 2.5.1p1.

As for your question, offhand, I believe you can workaround this limitation by writing scripts to interface your system login scripts with /tcb files. With a combination of trap signals used in your script, you should be able to enforce password changes.

Hope this helps. Regards.

Steven Sim Kok Leong