getsockopt/getpeereid for openssh

[Alex Lavrov.]

Hello,
trying to compile openssh here on 11i (goldpack september 2005). At the end of the configure I got this warning:

WARNING: the operating system that you are using does not
appear to support either the getpeereid() API nor the
SO_PEERCRED getsockopt() option. These facilities are used to
enforce security checks to prevent unauthorised connections to
ssh-agent. Their absence increases the risk that a malicious
user can connect to your agent.


Tried to figure out what I have to install/enable to get on of these 2 funcs work, but can't find anything. I see that I have "getsockopt" man pages :)

Thanx, Alex.

[Arunvijai_4]

Hi Alex,

Which version of OpenSSH you are trying to compile ? You can get 4.1p1 from software.hp.com http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

-Arun

[Alex Lavrov.]

I compiled the newest version I found there. 4.2p1

I wonder if the HP supplied depot contains that functionality I mentioned.

Alex.

[Arunvijai_4]

Alex, Checked with SSH developer, he says its not yet available on HP-UX and no work arounds either, you have to live with that...

-Arun

[Alex Lavrov.]

I know that getpeereid() is available only on BSD systems.

But I wonder what about getsockopt(). This patch for example PHNE_33159, contains fixes for this function.


Alex.

[Arunvijai_4]

PHNE_33159 contains fixes for getsockopt SO_ERROR on a listen() socket causes a conflict with accept() processing.and some man page related stuffs. I feel, it doesnt have SO_PEERCRED ..

-Arun