Ssh2

[Roger Baptiste]

Hi,

Here is a scenario of security
breach with ssh2, when there
are users home directories which
have write permission for group/world.

UserA generates his public and
private keys through the ssh-keygen2 command. To break
into other user accounts, all he
needs to do is to copy his
public key file in that user's
.ssh2 subdirectory and append
an entry to the 'authorization' file
pointing to his publickey file.
Once he has done this, he
can simply login as that user
with ssh2.

For folks who have setup ssh2,
can you please share your
thoughts and guidelines you
followed in setting up SSH2?

thanks
raj

[Peter Brimacombe]

we use ssh2

I think that it provides a useful level of security

we are not worried about one legitimate user getting acces to the account of another legimate user

I had looked at DCE , dfs and servers to do certification, it was scary, the central systems group didn't know anything about it , but they did support ssh (1) at the time and ssh2 is working okay

[Dan Hetzel]

Hi Raj,

Allowing write permission for group/world in user directories is a security risk anyway; with or without ssh2.

For example, a user could create another .rhosts file, allowing him remote login from a given host without password.

A system will only be as secure as the weakest element. If you open the doors, don't be surprised that people walk in...

Best regards,

Dan