The Talk: ssh - are you nuts!?!
SSH - are you nuts!?! by Jesus Monroy, Jr. I'm too tired to get this out, but i promised it would be available, so here it is. The Offical Part On Jan. 4, 2001, a talk entitled "ssh - are you nuts!?!" will be given at the SVBUG (Silicon Valley BSD User Group) monthly meeting by Club President Jesse Monroy, Jr. Details available at: http://www.svbug.com/events/ My part --- Today at 7:45pm (local time) this talk will start. People say I'm nuts, sometimes I think they are right. Currently, I've heard hundreds of points of views, read dozens of papers, and comtemplated solutions with vicious circles. Two days before Christmas I related this to my brother-in-law, a Havard/Yale/Cambridge MBA. His response was, "Builds character."; hmm.. Thanks. Other club presidents ask me, "Are you serious about this?" My business partner expressed, just after Christmas, "Is this worth it?" I'll admit, at times, this whole thing has been a bit crazy. So as I've said today at 7:45pm local time, here in Silicon Valley, I will be speaking. The title is "SSH - are you nuts!?!" What do I mean by this? Well to get exactly what I mean you may: 1) Come to the talk. Details are available at: http://www.svbug.com/events/ 2) See my notes after the talk - posted to: http://www.svbug.com/past/ 3) Or see the event with on-line video when it's available later this year. For those you you interested, below are selected points from my talk. --- -What I won't be saying -SSH is evil. -SSH is useless. -SSH is a bad idea. -Authentication/Encryption is a hoax or does not work. -Public Key Encryption does not work. (I have no proof.) -I can break Public Key Encryption. (At least, not now.) -I USE SSH. (1 or 2) -I never intend to use SSH. -My systems have never been compromised. -My frame of reference -What I will be saying -Voice my personal complaints -Expose encryption/security myths -Investigate the technical specs/issues -Investigage Technical, Social, Economic, Financial Problems -Investigate attackers and attacks -Tell you where to get SSH -Showing alternatives -Why I'm doing this -My Personal Complaints -What people have to say -SSHv1 vs. SSHv2 -SSHv2 Features -The SSH Specs (the problems within) -Authentication/Encryption - Two methods to argue -can never be broken -can always be broken -SSH(v2) Faults -New Technical problems it creates -Technical Problems outside of SSH control -There are common misconceptions about it's functionality -Social Problems -Economic Problems -Financial Problems -Still Subject to ... -Who wants your data -What is the Man-In-The-Middle -Your Governments Involvement -What SSH programs there are -What alternatives you have -Start with a Strategem -Technical Prevention -Technical Counter Measures -Last words To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: Thread DIES [Re: ssh - are you nuts?!? ]
On 29 Dec, Wes Peters wrote: Bill Fumerola wrote: On Wed, Dec 27, 2000 at 04:04:36PM -0800, [EMAIL PROTECTED] wrote: Bill Fumerola, who states that security policy information is un-available. However, I might refer his comment to the Security Officer instead, if Bill feels this appropriate. for the public record: Its unavailable in a "I don't know of any place that it is currently stored publicly, so I have no idea how JmJr was making references to it"-way as opposed to a "It's super-secret-elite and you can't have it"-way. This is exactly what I meant when I wrote "we need to solve this problem." I.e., we need a published procedure for disseminating ssh keys for FreeBSD machines to those who need them. Simply publishing what is currently done, perhaps in the committer section of the Handbook or even in the committers instructions, would meet this need just fine. Boy, am I glad this is over. Wes, I reget that your response does not reference your original message. I have reposted your exact comments and your the Message ID to which your comments pertain. If you'd like me to repost that message, I will. Let me make clear that I believe your words and your intent. However, in light of your response being --un-referenced from the original-- , I must consider this response as NOT a repudiation* of earlier suggestions. *repudiation - rejecting as invalid respectfully, Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 28 Dec, Mark Murray wrote: Okay, can you be specific about what you mean by "There was a time that we were very lax". If there was a change of server identity, then we did not necessarily announce what the new identity was in a way that people could trust. These days, a member of the Security Officer team sends out an announcement (cryptograhically signed of course) letting folks know what identity (fingerprint) to expect. I'm sorry, but this opens up a can of worms. However, I've also promised further communications to be off-line. Anyone else, interested in this subject, email me and you'll be added to the CC on this issue. Please email ONLY from this message, else I cannot trace your request. Mark, Please expect my response in about 24 hours from the posting of this message. Respectfully, Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: Thread DIES [Re: ssh - are you nuts?!? ]
Bill Fumerola wrote: On Wed, Dec 27, 2000 at 04:04:36PM -0800, [EMAIL PROTECTED] wrote: Bill Fumerola, who states that security policy information is un-available. However, I might refer his comment to the Security Officer instead, if Bill feels this appropriate. for the public record: Its unavailable in a "I don't know of any place that it is currently stored publicly, so I have no idea how JmJr was making references to it"-way as opposed to a "It's super-secret-elite and you can't have it"-way. This is exactly what I meant when I wrote "we need to solve this problem." I.e., we need a published procedure for disseminating ssh keys for FreeBSD machines to those who need them. Simply publishing what is currently done, perhaps in the committer section of the Handbook or even in the committers instructions, would meet this need just fine. Boy, am I glad this is over. -- "Where am I, and what am I doing in this handbasket?" Wes Peters Softweyr LLC [EMAIL PROTECTED] http://softweyr.com/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
RE: Thread DIES [Re: ssh - are you nuts?!? ]
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Thursday, December 28, 2000 1:05 AM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Thread DIES [Re: ssh - are you nuts?!? ] On 26 Dec, Mike Smith wrote: If it is FUD as you claim, then the call should be made by the SO. This would seem to be prudent policy. Jesse, Kris *is* the Security Officer. Now, please let this thread die. Mike, You and I don't often agree, but this time is worth noting. I agree. Messages, flames and counter-claims have now reached a point of dis-information/noise. If you have emailed me, and I have not responded - I will privately. The only exception are Wes Peters, who claims I have mis-quoted him If I have I must make a public appoligy. Bill Fumerola, who states that security policy information is un-available. However, I might refer his comment to the Security Officer instead, if Bill feels this appropriate. Any further comments about this thread should be emailed to me directly. If you post I will respond, but privately. Lastly, I formally request any further continuation about this subject on this thread stop. Jessem. At last 8). Thank you, thank you, thank you. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: Thread DIES [Re: ssh - are you nuts?!? ]
On Wed, Dec 27, 2000 at 04:04:36PM -0800, [EMAIL PROTECTED] wrote: Bill Fumerola, who states that security policy information is un-available. However, I might refer his comment to the Security Officer instead, if Bill feels this appropriate. for the public record: Its unavailable in a "I don't know of any place that it is currently stored publicly, so I have no idea how JmJr was making references to it"-way as opposed to a "It's super-secret-elite and you can't have it"-way. -- Bill Fumerola - security yahoo / Yahoo! inc. - [EMAIL PROTECTED] / [EMAIL PROTECTED] To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: Thread DIES [Re: ssh - are you nuts?!? ]
On 28 Dec, Bill Fumerola wrote: On Wed, Dec 27, 2000 at 04:04:36PM -0800, [EMAIL PROTECTED] wrote: Bill Fumerola, who states that security policy information is un-available. However, I might refer his comment to the Security Officer instead, if Bill feels this appropriate. for the public record: Its unavailable in a "I don't know of any place that it is currently stored publicly, so I have no idea how JmJr was making references to it"-way as opposed to a "It's super-secret-elite and you can't have it"-way. My assumption was the former. Thank you for your response. I will follow up with the SO now. Thanks Again, Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Tue, Dec 26, 2000 at 07:45:36AM -0800, [EMAIL PROTECTED] wrote: If I read what you are saying, and please correct me if I'm wrong, you are saying "the original keys were never .". Which original keys are you talking about? Are you saying that the original SSH Public Keys for the servers were always sent in the clear, without PGP signature or anything? Is this correct? Does this, even remotely, have *anything* to do with the original posting that started this thread? Guys. Please stop this. "If I read what you are saying ..." and then a new thread starts all over. Oh, come on. Is this thread still proper for -hackers? Will we kill it some day? - giorgos To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 26 Dec, Wes Peters wrote: [EMAIL PROTECTED] wrote: On 25 Dec, David O'Brien wrote: On Fri, Dec 22, 2000 at 11:28:07PM -0800, Kris Kennaway wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. Is this correct? Can anyone confirm this. A message by Wes Peters suggests it to be so. No message from me suggested anything about ssh key handling by the FreeBSD project. Don't start quoting me out of context. I'll go back to the original message that was posted, if you like. Your message made a suggestion, nothing more. What exactly it *MEANT* to say IS NOT CLEAR. This is why I'm asking questions. I'm not going to quote you, if I'm not clear on what you are saying. But if you are saying something, please assist my understanding in this matter. Please email me what you are saying. If you believe, I have wronged you, as you are stating, I will appoligize, but I my original understanding of your posting is -what I posted/questioned. Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 26 Dec, Mark Murray wrote: Which original keys are you talking about? SSH public server keys. (Sometimes called "server identities"). Are you saying that the original SSH Public Keys for the servers were always sent in the clear, without PGP signature or anything? David was saying that, but he's wrong. There was a time that we were very lax about confirming the server public keys. The last round of changes have all been confirmed by digital signature by well-known server administrators. Okay, can you be specific about what you mean by "There was a time that we were very lax". I'll make the broad assumption that things are now "correct". To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 25 Dec, David O'Brien wrote: On Mon, Dec 25, 2000 at 06:34:09PM -0800, Mike Smith wrote: No, in several particulars. "The FreeBSD Project" doesn't change the SSH keys on the FreeBSD.org machines. Not changed for change sake, but failure to do anything to preserve them. David has probably been drinking too much; it's Christmas, after all. This was totally uncalled for in a public list. Especially from one that has been critical of me lately. I hate to tell you, but I've been on the BSDi clock all day long. David, I belive that Mike meant to say David Green. I expected that was what he meant. It was Christmas day. Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Thread DIES [Re: ssh - are you nuts?!? ]
On 26 Dec, Mike Smith wrote: If it is FUD as you claim, then the call should be made by the SO. This would seem to be prudent policy. Jesse, Kris *is* the Security Officer. Now, please let this thread die. Mike, You and I don't often agree, but this time is worth noting. I agree. Messages, flames and counter-claims have now reached a point of dis-information/noise. If you have emailed me, and I have not responded - I will privately. The only exception are Wes Peters, who claims I have mis-quoted him If I have I must make a public appoligy. Bill Fumerola, who states that security policy information is un-available. However, I might refer his comment to the Security Officer instead, if Bill feels this appropriate. Any further comments about this thread should be emailed to me directly. If you post I will respond, but privately. Lastly, I formally request any further continuation about this subject on this thread stop. Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
Okay Wes, This is your original message. You state: "This is exactly the sort of problem we need to solve..." In the context of this message I must assume that since the subject is SSH, then you are referring to SSH. If not, there is nothing in the message that would lead me to believe otherwise. If you I have mis-quoted you, please clarify your statement so that I might make appropriate reperations. respectfully, Jessem. BTW, your original message is below: = Message-ID: [EMAIL PROTECTED] On 25 Dec, Wes Peters wrote: David O'Brien wrote: On Fri, Dec 22, 2000 at 11:28:07PM -0800, Kris Kennaway wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. This is exactly the sort of problem we need to solve in a usable and secure manner, so we can be an example to hold up and say "this is one way you can make it work." I'm completely open to suggestions as to how we can accomplish that. A few ideas leap to mind, but unfortunately, short of an heirarchical calling list, none of them really work, relying on other key information that may have changed also. Sending an email with the new certs signed by the SO or other authoritative key would work, given that everyone already has the OS cert or key, unless it is the SO key that is changing. With a little bit of perspiration, we could probably create a calling list that minimizes overseas and long distance calls, but reaching far-flung people on the phone is often difficult, expensive work. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
Okay, can you be specific about what you mean by "There was a time that we were very lax". If there was a change of server identity, then we did not necessarily announce what the new identity was in a way that people could trust. These days, a member of the Security Officer team sends out an announcement (cryptograhically signed of course) letting folks know what identity (fingerprint) to expect. M -- Mark Murray Warning: this .sig is umop ap!sdn To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Mon, Dec 25, 2000 at 09:27:49PM -0800, David O'Brien wrote: On Mon, Dec 25, 2000 at 08:29:01PM -0800, Kris Kennaway wrote: Umm, are you actually talking about real incidents here, or just spreading FUD? REAL incidents. Please remember I've been a committer longer you have. This has nothing to do with it, since both of the times you are referring to are well after I became a committer. The last two times a freebsd.org host key has been changed, that I am aware of, a signed message has been sent about it confirming the new key. Uh no. Both of those times that a message was sent out, it wasn't even signed (Internet on 10 May 2000 and Freefall on 16 May 2000). Hop on over the the archives on hub.freebsd.org and get your facts straight. The Internat change didn't even list the new key. And the best we've ever done is in the "HEADS UP: New host key for freefall!" thread started by Peter Wemm on Tue, 16 May 2000 23:26:33. Bollocks. Since you insist, please check the following message IDs which contain PGP signed confirmations of the changed keys. The freefall one especially was just a mixup in timing, not an oversight or gap in policy: Message-Id: [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] So I say again, please stop spreading FUD and making it sound like FreeBSD admins routinely change SSH keys without warning or confirmation. It has happened once in the last year, and the new key was authoritatively confirmed very quickly thereafter. Kris PGP signature
Re: ssh - are you nuts?!?
On Tue, Dec 26, 2000 at 04:22:59AM -0800, David O'Brien wrote: On Tue, Dec 26, 2000 at 04:02:52AM -0800, Kris Kennaway wrote: REAL incidents. Please remember I've been a committer longer you have. This has nothing to do with it, since both of the times you are referring to are well after I became a committer. Both times?? Where in my original email did I ever refer to just two times? When you only gave references to two occasions, and no mention of others. I don't really know how much relevance the admin activities of the ancient past have - the project has changed a lot since those days, and the last two times the host key has publically changed there's been enough discussion of why it needs to be announced that it should have hopefully had an effect, modulo instances of human weakness when people genuinely forget to put the old key back after an upgrade. It isn't FUD, we have handled this poorly in the past five years. So stop calling me a liar, I know what I've freaking experienced in the past. I didn't call you a liar. I said you were exaggerating the incidence of inappropriate SSH key handling. If you feel I've given the wrong impression, fine. Just say that, and I'll clear up that I'm not saying it is intentionally done if that is what people think. But admit to the lack of care of the past. What happens after the next hardware failure? Who ever gets the box running again, will be glad their work is done, and they will not email out a notice. You are complaining to the wrong audience. Talk to [EMAIL PROTECTED], not the FreeBSD user community. Kris P.S. Please stop dropping the mailing list from the CC list of your responses..invest in a simple procmail duplicate message-ID filter if you want to deal with multiple CCs. I can give you one if you like. PGP signature
Re: ssh - are you nuts?!?
On 25 Dec, Warner Losh wrote: In message [EMAIL PROTECTED] [EMAIL PROTECTED] writes: : JKH, DG, CORE respond. Core does not respond to mail not directed to it. Posting rules do not allow me to send to more than to groups. Can you recommend a course of action? To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 25 Dec, Warner Losh wrote: In message [EMAIL PROTECTED] [EMAIL PROTECTED] writes: : JKH, DG, CORE respond. Core does not respond to mail not directed to it. Posting rules do not allow me to send to more than to groups. Can you recommend a course of action? Short of intensive treatment for hypochondria, no. -- ... every activity meets with opposition, everyone who acts has his rivals and unfortunately opponents also. But not because people want to be opponents, rather because the tasks and relationships force people to take different points of view. [Dr. Fritz Todt] V I C T O R Y N O T V E N G E A N C E To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 25 Dec, Mike Smith wrote: And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. Is this correct? No, in several particulars. "The FreeBSD Project" doesn't change the SSH keys on the FreeBSD.org machines. Notice is given when they are intention ally changed. The FreeBSD Project doesn't "train" committers to have sloppy habits. David has probably been drinking too much; it's Christmas, after all. There were a couple of incidents some time back when freefall's SSH keys were accidentally overwritten due to failure to follow procedure by individual administrators. The lengthy discussions which followed these incidents could not possibly have been construed as "training committers to have sloppy habits". Can anyone confirm this. No. But I'm damn sure that you'd have been fleeing Grover's Mill with the rest of the sheep. JKH, DG, CORE respond. Jordan is in Europe. David is unlikely to pay any attention to this sort of noise. Core does not administer the FreeBSD.org machines, and if you get a response at all, it will probably be "you are talking to the wrong people". Mike, I apprecitate your response. So, I'm paying particular attention to details; I don't want to get this wrong. Your statement says "in several particulars", What does this mean? I think you are meaning to say that "Notice is given when they are intenting all changes", Is this correct? Please, I'm just trying to get it straight what you are saying. As for JKH or DG being out, I would imagine more than one person is away for the holidays. Also, I see your name is listed on the page listing "core" members, so I appreciate this effor on your part. However, this rumor (as I read it now) sounds fantastic, so I'd like to get facts, or at least core's POV (Point Of View). Lastly, you are suggesting that I am talking to the "wrong" people on this. If I am, who are the "right" people? To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 25 Dec, Peter Wemm wrote: "David O'Brien" wrote: And the best we've ever done is in the "HEADS UP: New host key for freefall!" thread started by Peter Wemm on Tue, 16 May 2000 23:26:33. ... which the thread and FUD was a total load of shit, because the original keys were never announced or signed or anything. The new keys were no more or less trustworthy than the old ones. Wait, I'm trying to get this straight. If I read what you are saying, and please correct me if I'm wrong, you are saying "the original keys were never .". Which original keys are you talking about? Are you saying that the original SSH Public Keys for the servers were always sent in the clear, without PGP signature or anything? Is this correct? To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 26 Dec, Kris Kennaway wrote: On Mon, Dec 25, 2000 at 09:27:49PM -0800, David O'Brien wrote: On Mon, Dec 25, 2000 at 08:29:01PM -0800, Kris Kennaway wrote: Umm, are you actually talking about real incidents here, or just spreading FUD? REAL incidents. Please remember I've been a committer longer you have. .[TRIMMED]... Since you insist, please check the following message IDs which contain PGP signed confirmations of the changed keys. The freefall one especially was just a mixup in timing, not an oversight or gap in policy: Message-Id: [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] So I say again, please stop spreading FUD and making it sound like FreeBSD admins routinely change SSH keys without warning or confirmation. It has happened once in the last year, and the new key was authoritatively confirmed very quickly thereafter. Wait. If what David says is correct and what Kris says is correct, then I guess the next question is: What is the policy when a "commiter" reports this type of schenario? My guess is that such a situation would not be ignored, and as such, any commiter encountering such a situation should report the incident immediately. This should be the policy for if what I've read and heard about SSH is true, then what David is saying merits a policy and investigation by the SO. If it is FUD as you claim, then the call should be made by the SO. This would seem to be prudent policy. Lastly, I'm not here to question policy, just report on it. respectfully, Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
If it is FUD as you claim, then the call should be made by the SO. This would seem to be prudent policy. Jesse, Kris *is* the Security Officer. Now, please let this thread die. -- ... every activity meets with opposition, everyone who acts has his rivals and unfortunately opponents also. But not because people want to be opponents, rather because the tasks and relationships force people to take different points of view. [Dr. Fritz Todt] V I C T O R Y N O T V E N G E A N C E To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 26 Dec, Kris Kennaway wrote: On Tue, Dec 26, 2000 at 04:22:59AM -0800, David O'Brien wrote: If you feel I've given the wrong impression, fine. Just say that, and I'll clear up that I'm not saying it is intentionally done if that is what people think. But admit to the lack of care of the past. What happens after the next hardware failure? Who ever gets the box running again, will be glad their work is done, and they will not email out a notice. You are complaining to the wrong audience. Talk to [EMAIL PROTECTED], not the FreeBSD user community. I disagree with your statement. From what I'm reading, it seems that "the enforcement of policy" has been lacking of that current policies need revamping. If the former is the case, then the new SO has his work cut out for him. If the later is the case, then his complaint merits attention, and immediate action. Mind you I'm not suggesting this change. However, one of my counter-proposals to SSH (to be given at the talk) is the "enforcement of policy". And to wit, if said policy is weak, then the underlying structure (or framework) should be expected of similar condition. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
Which original keys are you talking about? SSH public server keys. (Sometimes called "server identities"). Are you saying that the original SSH Public Keys for the servers were always sent in the clear, without PGP signature or anything? David was saying that, but he's wrong. There was a time that we were very lax about confirming the server public keys. The last round of changes have all been confirmed by digital signature by well-known server administrators. M -- Mark Murray Warning: this .sig is umop ap!sdn To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Tue, Dec 26, 2000 at 08:04:20AM -0800, [EMAIL PROTECTED] wrote: You are complaining to the wrong audience. Talk to [EMAIL PROTECTED], not the FreeBSD user community. I disagree with your statement. From what I'm reading, it seems that "the enforcement of policy" has been lacking of that current policies need revamping. If the former is the case, then the new SO has his work cut out for him. It is impossible for you[or anyone not on committers/developers] to: 1) know the policies 2) know the specifics of the incidents that are being discussed 3) have read any of the mail regarding the incidents The FreeBSD admins do an excellent job and I've never felt insecure because of their policies. Please end this thread now, it doesn't belong on the public mailing lists. If the later is the case, then his complaint merits attention, and immediate action. Mind you I'm not suggesting this change. However, one of my counter-proposals to SSH (to be given at the talk) is the "enforcement of policy". And to wit, if said policy is weak, then the underlying structure (or framework) should be expected of similar condition. I can't find a point in the above paragraph besides "bad stuff is bad." -- Bill Fumerola - security yahoo / Yahoo! inc. - [EMAIL PROTECTED] / [EMAIL PROTECTED] To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
[EMAIL PROTECTED] wrote: This is one of the stupidest trolls I've ever found, and is completely inappropriate for freebsd-security. Try over on -chat. I'm not sure of this. SSH is about Secure SHell. It's this where I might get technical answers about security? This mailing list is for specific questions and answers about FreeBSD security. If you want to discuss ssh, find a mailing list or newsgroup about ssh. -- "Where am I, and what am I doing in this handbasket?" Wes Peters Softweyr LLC [EMAIL PROTECTED] http://softweyr.com/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Tue, Dec 26, 2000 at 04:43:37AM -0800, Kris Kennaway wrote: P.S. Please stop dropping the mailing list from the CC list of your responses.. Thank you for taking away my right to take a discussion private, and posting my *private* response to a public mailing list. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Tue, Dec 26, 2000 at 06:09:26PM +0200, Mark Murray wrote: Are you saying that the original SSH Public Keys for the servers were always sent in the clear, without PGP signature or anything? David was saying that, but he's wrong. How I enjoy when someone tries to put words in my mouth. No, I did not say "the original SSH Public Keys for the servers were always sent in the clear, without PGP signature", I said *announcement* of their change was. And as much as I'd like to back out of this discussion, I don't like being called a liar. Both Peter's *original* (see that word above) email sending out the fingerprint of the new key, WAS in the clear without PGP signature. As was John Hays announcement announcing the key change on Internet. Message-Id: [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] -- -- David ([EMAIL PROTECTED]) GNU is Not Unix / Linux Is Not UniX To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
[EMAIL PROTECTED] wrote: On 25 Dec, David O'Brien wrote: On Fri, Dec 22, 2000 at 11:28:07PM -0800, Kris Kennaway wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. Is this correct? Can anyone confirm this. A message by Wes Peters suggests it to be so. No message from me suggested anything about ssh key handling by the FreeBSD project. Don't start quoting me out of context. -- "Where am I, and what am I doing in this handbasket?" Wes Peters Softweyr LLC [EMAIL PROTECTED] http://softweyr.com/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Tue, Dec 26, 2000 at 11:20:34AM -0800, David O'Brien wrote: On Tue, Dec 26, 2000 at 04:43:37AM -0800, Kris Kennaway wrote: P.S. Please stop dropping the mailing list from the CC list of your responses.. Thank you for taking away my right to take a discussion private, and posting my *private* response to a public mailing list. Oops, here's what happened: the previous mail you sent to me in this thread was sent twice separately; one sent to me only, not the list, and another sent only to the list - perhaps you used a BCC. The message in my email inbox had the mailing list removed from it, and I had to add it back by hand - I assumed you had done the same thing here, but it turns out you only did send me a private reply. I guess this bears out my point above about why this was a bad thing to do. Kris P.S. I don't think there's anything else which needs to be said in this thread, so I'll be decoupling from it now.. PGP signature
Re: ssh - are you nuts?!?
On Sat, Dec 23, 2000 at 02:16:51AM -0800, [EMAIL PROTECTED] wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. Are you stateing that one of the issues with SSH is a social issue and not a technical? Yes, that is the single relevant (solvable) issue here. You're just going to make yourself sound ignorant, and possibly amuse, confuse or frighten a lot of your audience, if you claim otherwise. These flaws can be all but eliminated by telling SSH to not even give the poor weak confused human the choice of answering yes to the question, by setting of a simple configuration option. JMJr, a good place to start your talk on "The Evils of SSH" might be the Pavlovian conditioning of humans to answer "Yes" to every question a computer gives them..focus on the real problem here. I'm giving your comments some consideration. Is there any other evidence that might help this type of arugement out? I've consider it, but it is a weak arguement and it really needs a solid foundation for presentation. This comment was half tongue-in-cheek, but my assertion that the current flap over "insecurity" of SSH is not based on shortcomings or weaknesses of the SSH protocol, or even the UNIX SSH implementations of that protocol - is I think well justified (and fairly obvious to most people with crypto clue). For another reference which debunks the "End of SSH" article in more detail, see the article posted to slashdot yesterday. Be sure to distinguish between SSH and SSL when reading the original article or its followups (SSH has nothing to do with SSL except in a very broad sense). Kris PGP signature
Re: ssh - are you nuts?!?
On Fri, Dec 22, 2000 at 11:28:07PM -0800, Kris Kennaway wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
David O'Brien wrote: On Fri, Dec 22, 2000 at 11:28:07PM -0800, Kris Kennaway wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. This is exactly the sort of problem we need to solve in a usable and secure manner, so we can be an example to hold up and say "this is one way you can make it work." I'm completely open to suggestions as to how we can accomplish that. A few ideas leap to mind, but unfortunately, short of an heirarchical calling list, none of them really work, relying on other key information that may have changed also. Sending an email with the new certs signed by the SO or other authoritative key would work, given that everyone already has the OS cert or key, unless it is the SO key that is changing. With a little bit of perspiration, we could probably create a calling list that minimizes overseas and long distance calls, but reaching far-flung people on the phone is often difficult, expensive work. -- "Where am I, and what am I doing in this handbasket?" Wes Peters Softweyr LLC [EMAIL PROTECTED] http://softweyr.com/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Mon, Dec 25, 2000 at 03:37:38PM -0700, Wes Peters wrote: David O'Brien wrote: our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. This is exactly the sort of problem we need to solve in a usable and secure manner, so we can be an example to hold up and say "this is one way you can make it work." I'm completely open to suggestions as to how we can accomplish that. A few ideas leap to mind, but unfortunately, short of an heirarchical calling list, none of them really work, relying on other key information that may have changed also. Sending an email with the new certs signed by the SO or other authoritative key would work, given that everyone already has the OS cert or key, unless it is the SO key that is changing. With a little bit of perspiration, we could probably create a calling list that minimizes overseas and long distance calls, but reaching far-flung people on the phone is often difficult, expensive work. Faxes might be a better way of doing this part of the communication. -- Wilko Bulte Arnhem, the Netherlands [EMAIL PROTECTED] http://www.freebsd.org http://www.nlfug.nl To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 24 Dec, Dan Langille wrote: On 23 Dec 2000, at 2:00, [EMAIL PROTECTED] wrote: On 23 Dec, Dan Langille wrote: On 23 Dec 2000, at 13:25, David Preece wrote: At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. It is possible. It is not trivial. What leads you to believe that it's not trival? You are the one claiming it is trivial. The onus is on you to prove your own claim. Or conversely, prove me wrong. I'm not feeding you. I'm sorry, even after reading the attributes at the top of the messages. It says: At 15:37 22/12/00 -0800, you wrote: That does not mean the portion written is attibutable(sp?) to '[EMAIL PROTECTED]'. I can see how there might be a confusion on this since someone failed to put in attributes for my original messages. Sorry I cannot help you answer what is "not trivial". To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
Your comments noted. thanks Jessem. On 23 Dec, Christian Weisgerber wrote: [EMAIL PROTECTED] wrote: I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Indeed. Please ignore him, he's a troll. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
Your comments noted. Jessem. On 23 Dec, Bill Fumerola wrote: On Sat, Dec 23, 2000 at 02:00:54AM -0800, [EMAIL PROTECTED] wrote: It is possible. It is not trivial. What leads you to believe that it's not trival? A functioning brain. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 23 Dec, Bengt Richter wrote: You are clueless as to the effect of your word choices. Thank you for reading that. I would beg to differ. Please note that I am not writing this to flame, but in an attempt to be helpful ;-) I appreciate all person with the intent to help. At 15:37 2000-12-22 -0800 [EMAIL PROTECTED] wrote: Thank you for your attention. Your subject line got my attention, but so would having someone tug at my sleeve, or worse impertinence. How about "Please help me prepare for SSH talk" ? While I did consider something like your suggestion, my feeling was that it did not carry the correct impact for getting "expert" consideration. Next month I'm giving a talk about the evils of SSH. If you don't know that the above sentence strongly implies the existence of the referred-to "evils," may I suggest that you attend an English refresher. (Please don't tell me an empty set can exist). If you are going to invite others to express their opinions, the implicit assertion of your own as unqualified fact is not a good starting point. I've re-read this sentence many times. I've made no "implict" assertions. I you believe I have please feel free to email me personally. Perhaps I could have balace the statement with: "about the goods and evils of SSH." But again, that would have negligible impact. I realized that people might take my statement to mean "SSH is evil". In that, I concluded that those favoring SSH would defend it strongly, as the have. Those disliking SSH would send me information as to their sentiment(sp?) Those sitting on either side would send my their opinions and feelings, nothing more. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Your foreplay stinks. You are trying to take advantage of my natural interest, but your approach forces me to overcome negative feelings before I can participate, which I would otherwise willingly do. It's a shame, really. If you have negative feelings, then by all means chime in. I have had a rather balanced response and overall I feel the talk will go well, although I am pressed for time. (This leaves no option, but to ignore/minimalize non-substantive resonses.) Please note, I'm not here to flame or troll, just ask questions. Your responses determine the tone of all conversations. Your subject line resonated with the tone of crass attention grabbing. Do you disclaim all responsibility re tone, after thus giving everyone a goosing in an area of interest? If you are used that, you watch too much TV. Hmmm... I appoligize if the material is not to your suiting(sp?). Sometimes life is like that. If you have feelings or opinin about SSH, please email them to me. I guess your right about TV. One (1) hour a night of Star Trek is too much. Lastly, please trim the CC: line as you feel appropriate. Thanks. Jessem. That's ok. HTH. Really. Thanks for your comments. They are noted. Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 23 Dec, Wes Peters wrote: [EMAIL PROTECTED] wrote: Thank you for your attention. Next month I'm giving a talk about the evils of SSH. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. The simple fact that it doesn't transmit passwords in clear text? Thanks for your comment. Are there any other things you say about SSH? This is one of the stupidest trolls I've ever found, and is completely inappropriate for freebsd-security. Try over on -chat. I'm not sure of this. SSH is about Secure SHell. It's this where I might get technical answers about security? To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Mon, 25 Dec 2000 [EMAIL PROTECTED] wrote: I've re-read this sentence many times. I've made no "implict" assertions. I you believe I have please feel free to email me personally. Perhaps I could have balace the statement with: "about the goods and evils of SSH." But again, that would have negligible impact. It would have been very different. Clearly this is something you are incapable of comprehending. In any case, this is a technical discussion list: not a discussion forum for the varying interpretations of trolls. This discussion has strayed from what the original topic. Perhaps it's time for you to end it and go away. G "And then it comes to be that the soothing light at the end of your tunnel was just a freight train, comin' your way." George Reid * [EMAIL PROTECTED] To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 25 Dec, Kris Kennaway wrote: On Sat, Dec 23, 2000 at 02:16:51AM -0800, [EMAIL PROTECTED] wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. Are you stateing that one of the issues with SSH is a social issue and not a technical? Yes, that is the single relevant (solvable) issue here. You're just going to make yourself sound ignorant, and possibly amuse, confuse or frighten a lot of your audience, if you claim otherwise. Thanks for your comments, Kris. I'm not claiming I'm going to do anything at this point. However, I see you feel strongly about this as a "Social Issue". Can you comment more on this? I'd like to get your opinion and more facts as to your position. These flaws can be all but eliminated by telling SSH to not even give the poor weak confused human the choice of answering yes to the question, by setting of a simple configuration option. JMJr, a good place to start your talk on "The Evils of SSH" might be the Pavlovian conditioning of humans to answer "Yes" to every question a computer gives them..focus on the real problem here. I'm giving your comments some consideration. Is there any other evidence that might help this type of arugement out? I've consider it, but it is a weak arguement and it really needs a solid foundation for presentation. This comment was half tongue-in-cheek, but my assertion that the current flap over "insecurity" of SSH is not based on shortcomings or weaknesses of the SSH protocol, or even the UNIX SSH implementations of that protocol - is I think well justified (and fairly obvious to most people with crypto clue). For another reference which debunks the "End of SSH" article in more detail, see the article posted to slashdot yesterday. Be sure to distinguish between SSH and SSL when reading the original article or its followups (SSH has nothing to do with SSL except in a very broad sense). Wow!! Thanks I'll make not of your suggestion and follow up and my earliest time slot. Also, earlier in this message I said - send me positive "proof". This last section is extremely helpful. Can I quote you in the last paragraph you sent me. It would look like this: " [...] my assertion that the current flap over "insecurity" of SSH is not based on shortcomings or weaknesses of the SSH protocol, or even the UNIX SSH implementations of that protocol - [The insecurity of it] is I think well justified (and fairly obvious to most people with crypto clue). [The "insecurity" is the conditioning of humans to answer "Yes" to every question a computer gives them.] " To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 25 Dec, David O'Brien wrote: On Fri, Dec 22, 2000 at 11:28:07PM -0800, Kris Kennaway wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. Is this correct? Can anyone confirm this. A message by Wes Peters suggests it to be so. JKH, DG, CORE respond. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
In message [EMAIL PROTECTED] [EMAIL PROTECTED] writes: : JKH, DG, CORE respond. Core does not respond to mail not directed to it. Warner To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
In message [EMAIL PROTECTED], Warner Losh writes: In message [EMAIL PROTECTED] [EMAIL PROTECTED] writes : : JKH, DG, CORE respond. Core does not respond to mail not directed to it. Not to mention the basic problem of J Random Luser *demanding* a response. -s To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. Is this correct? No, in several particulars. "The FreeBSD Project" doesn't change the SSH keys on the FreeBSD.org machines. Notice is given when they are intention ally changed. The FreeBSD Project doesn't "train" committers to have sloppy habits. David has probably been drinking too much; it's Christmas, after all. There were a couple of incidents some time back when freefall's SSH keys were accidentally overwritten due to failure to follow procedure by individual administrators. The lengthy discussions which followed these incidents could not possibly have been construed as "training committers to have sloppy habits". Can anyone confirm this. No. But I'm damn sure that you'd have been fleeing Grover's Mill with the rest of the sheep. JKH, DG, CORE respond. Jordan is in Europe. David is unlikely to pay any attention to this sort of noise. Core does not administer the FreeBSD.org machines, and if you get a response at all, it will probably be "you are talking to the wrong people". Regards, Mike Smith FreeBSD Project Core team member, FreeBSD.org admin team member. -- ... every activity meets with opposition, everyone who acts has his rivals and unfortunately opponents also. But not because people want to be opponents, rather because the tasks and relationships force people to take different points of view. [Dr. Fritz Todt] V I C T O R Y N O T V E N G E A N C E To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
In message [EMAIL PROTECTED] Peter Seebach writes: : In message [EMAIL PROTECTED], Warner Losh writes: : In message [EMAIL PROTECTED] [EMAIL PROTECTED] writes : : : : JKH, DG, CORE respond. : : Core does not respond to mail not directed to it. : : Not to mention the basic problem of J Random Luser *demanding* a response. If anyones makes a request of core, there is an appropriate forum for that request. We try to answer all requeries we get. Warner To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Mon, Dec 25, 2000 at 11:46:16AM -0800, David O'Brien wrote: On Fri, Dec 22, 2000 at 11:28:07PM -0800, Kris Kennaway wrote: Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. And we, the FreeBSD Project, don't do a thing to help this situation. We change the SSH keys on the freebsd.org machines left and right w/o *ANY* notice to committers that they have been changed. So we've trained our own committers to have sloppy habits that could lead a malicious code added to the FreeBSD CVS source repository. Umm, are you actually talking about real incidents here, or just spreading FUD? The last two times a freebsd.org host key has been changed, that I am aware of, a signed message has been sent about it confirming the new key. Kris PGP signature
Re: ssh - are you nuts?!?
On Mon, Dec 25, 2000 at 06:34:09PM -0800, Mike Smith wrote: No, in several particulars. "The FreeBSD Project" doesn't change the SSH keys on the FreeBSD.org machines. Not changed for change sake, but failure to do anything to preserve them. David has probably been drinking too much; it's Christmas, after all. This was totally uncalled for in a public list. Especially from one that has been critical of me lately. I hate to tell you, but I've been on the BSDi clock all day long. There were a couple of incidents some time back when freefall's SSH keys were accidentally overwritten due to failure to follow procedure by individual administrators. You say I'm wrong, and then you admit the keys have changed. How much did you drink today? The only reason the last Freefall hardware upgrade keep the ssh host keys the same was because _I_personally_ made sure the person doing the upgrade copied the keys over before going live (they *were* different). It has happened on Freefall, as you mention, along with Hub, and Bento that I remember. I'll leave it up to the long-time committers to recall themselves the number of times they've gotten the "host key as changed" warning in the past. The *ONLY* time the key has changed on these machines that anybody announced it was Tue, 16 May 2000 when Peter Wemm regenerated Freefall's key because it had an off-by-one error that OpenSSH complained about. And even then, Peter sent it out in email w/o public key signing the email. Has anyone backed up the freebsd.org ssh host keys so that if a disk died (or two in the RAID5 machines), the keys could be restored? If we wanted to do this right, the FreeBSD Security Officer would collect the ssh host keys on all the freebsd.org machines (the ones at the COLO rack) on his home machine encrypted with the SO's PGP key. He would also take all the public host keys, put them in a webpage (which of course would be in the CVS repo) which is then signed by the SO's PGP key and put it up in the FreeBSD Internal section. -- -- David ([EMAIL PROTECTED]) GNU is Not Unix / Linux Is Not UniX To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Mon, Dec 25, 2000 at 08:29:01PM -0800, Kris Kennaway wrote: Umm, are you actually talking about real incidents here, or just spreading FUD? REAL incidents. Please remember I've been a committer longer you have. The last two times a freebsd.org host key has been changed, that I am aware of, a signed message has been sent about it confirming the new key. Uh no. Both of those times that a message was sent out, it wasn't even signed (Internet on 10 May 2000 and Freefall on 16 May 2000). Hop on over the the archives on hub.freebsd.org and get your facts straight. The Internat change didn't even list the new key. And the best we've ever done is in the "HEADS UP: New host key for freefall!" thread started by Peter Wemm on Tue, 16 May 2000 23:26:33. -- -- David ([EMAIL PROTECTED]) GNU is Not Unix / Linux Is Not UniX To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
-BEGIN PGP SIGNED MESSAGE- In message [EMAIL PROTECTED] "David O'Brien" writes: : Uh no. Both of those times that a message was sent out, it wasn't even : signed (Internet on 10 May 2000 and Freefall on 16 May 2000). Hop on : over the the archives on hub.freebsd.org and get your facts straight. : The Internat change didn't even list the new key. And the best we've : ever done is in the "HEADS UP: New host key for freefall!" thread started : by Peter Wemm on Tue, 16 May 2000 23:26:33. For freefall's key, Kris personally sent out a message with the key, signed with the FreeBSD Security Officer key. I don't recall what he did with Internat. This was done in extremely short order after the change. In the discussions that happened aferwards, it was agreed that future heads up messages would be pgp signed by the admin and that the security officer would verify things if there was any doubt. Warner P.S. I don't know where cvs-committers archives lives, so I could't provide message numbers. -BEGIN PGP SIGNATURE- Version: 2.6.3ia Charset: noconv Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBOkg0F9xynu/2qPVhAQHi3QQAlsrgJVAWawcixxsdXTwMx5hUBEj78p82 oi2AxxnnvgD43/MC0tvlZ44j3cUcrrekcx6xZS3Z5V5KQs0nuKGBFht8NNMVVNoe F9cy+eDAnXd9GiJM4wrjyoHJRyngCJYAL79V7fIo4yieBGHZ66LJXWOVlUiXgU/W pnQgyfhP9WA= =X1V1 -END PGP SIGNATURE- To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
"David O'Brien" wrote: And the best we've ever done is in the "HEADS UP: New host key for freefall!" thread started by Peter Wemm on Tue, 16 May 2000 23:26:33. .. which the thread and FUD was a total load of shit, because the original keys were never announced or signed or anything. The new keys were no more or less trustworthy than the old ones. You have commit access. Put the public keys and fingerprints on one of the doc pages somewhere and shut up already. Cheers, -Peter -- Peter Wemm - [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED] "All of this is for nothing if we don't go to the stars" - JMS/B5 To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
LOL :) On Sun, Dec 24, 2000 at 06:55:40PM +, void wrote: On Sat, Dec 23, 2000 at 02:00:54AM -0800, [EMAIL PROTECTED] wrote: On 23 Dec, Dan Langille wrote: It is possible. It is not trivial. What leads you to believe that it's not trival? Eliza, is that you? -- Ben 220 go.ahead.make.my.day ESMTP Postfix To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
void wrote: On Sat, Dec 23, 2000 at 02:00:54AM -0800, [EMAIL PROTECTED] wrote: On 23 Dec, Dan Langille wrote: It is possible. It is not trivial. What leads you to believe that it's not trival? Eliza, is that you? god that takes me back! -- __--_|\ Julian Elischer / \ [EMAIL PROTECTED] ( OZ) World tour 2000 --- X_.---._/ from Perth, presently in: Budapest v To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Fri, Dec 22, 2000 at 07:42:20PM -0500, Chris BeHanna wrote: (At least one large company I know of has stated flatly, for example, that sending a root password over the wire in the clear is grounds for immediate termination.) This is a very security consious company, but I think they are a bit out of the limits on this one :/ - giorgos To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
* Giorgos Keramidas [EMAIL PROTECTED] [001224 13:39] wrote: On Fri, Dec 22, 2000 at 07:42:20PM -0500, Chris BeHanna wrote: (At least one large company I know of has stated flatly, for example, that sending a root password over the wire in the clear is grounds for immediate termination.) This is a very security consious company, but I think they are a bit out of the limits on this one :/ Why? Anyone trusted with root should be clueful enough not to do something like this. -- -Alfred Perlstein - [[EMAIL PROTECTED]|[EMAIL PROTECTED]] "I have the heart of a child; I keep it in a jar on my desk." To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Sun, Dec 24, 2000 at 02:35:30PM -0800, Alfred Perlstein wrote: * Giorgos Keramidas [EMAIL PROTECTED] [001224 13:39] wrote: On Fri, Dec 22, 2000 at 07:42:20PM -0500, Chris BeHanna wrote: (At least one large company I know of has stated flatly, for example, that sending a root password over the wire in the clear is grounds for immediate termination.) This is a very security consious company, but I think they are a bit out of the limits on this one :/ Why? Anyone trusted with root should be clueful enough not to do something like this. Yes, but firing people? Well, in a way, I agree; but I am kind of paranoid when it comes to security issues. Seeing this become a part of the company policy is rather interesting, and somewhat intriguing at first. - giorgos To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
* Giorgos Keramidas [EMAIL PROTECTED] [001224 19:28] wrote: On Sun, Dec 24, 2000 at 02:35:30PM -0800, Alfred Perlstein wrote: * Giorgos Keramidas [EMAIL PROTECTED] [001224 13:39] wrote: On Fri, Dec 22, 2000 at 07:42:20PM -0500, Chris BeHanna wrote: (At least one large company I know of has stated flatly, for example, that sending a root password over the wire in the clear is grounds for immediate termination.) This is a very security consious company, but I think they are a bit out of the limits on this one :/ Why? Anyone trusted with root should be clueful enough not to do something like this. Yes, but firing people? Well, in a way, I agree; but I am kind of paranoid when it comes to security issues. Seeing this become a part of the company policy is rather interesting, and somewhat intriguing at first. What would your reaction be if an employee screamed out the company's safe combination each time he opened it? And what about after being warned not to? -- -Alfred Perlstein - [[EMAIL PROTECTED]|[EMAIL PROTECTED]] "I have the heart of a child; I keep it in a jar on my desk." To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 23 Dec, Dan Langille wrote: On 23 Dec 2000, at 13:25, David Preece wrote: At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. It is possible. It is not trivial. What leads you to believe that it's not trival? To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 22 Dec, Chris BeHanna wrote: On Sat, 23 Dec 2000, David Preece wrote: At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. Man-in-the-middle or not, the fact that your data aren't transmitted in the clear automatically gives ssh a leg up over telnet, rsh, rlogin, and ftp. (At least one large company I know of has stated flatly, for example, that sending a root password over the wire in the clear is grounds for immediate termination.) Is it possible to get the name of that company? You can certainly do your own server authentication, by carrying your known hosts file around on a floppy. ssh *does* warn you when you connect to a host that isn't present in your known hosts file--this isn't happening without your knowledge *and* consent. Some people have stated that the "first contact" scenario is difficult to over come. How do you feel about that? ssh may have its weaknesses, but telnet has little use other than as a diagnostic tool, IMHO (I only use it to send protocol commands to popd or sendmail these days). I'd *hardly* characterize ssh as "evil". I don't beleive I've ever said SSH is evil. It seems to be a common interpetation of the statement I made. I see that I'll have to make note of that in my talk. Are there any other points you feel might be either a "plus" or "minus" in behalf of ssh? Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 22 Dec, Garance A Drosihn wrote: At 3:37 PM -0800 12/22/00, [EMAIL PROTECTED] wrote: Thank you for your attention. Next month I'm giving a talk about the evils of SSH. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. People in the "FreeBSD community" are invited to read the rambling and pointless discussions that this sparked in the OpenBSD and NetBSD communities before repeating all those arguments in all the freebsd mailing lists. If you still think you have something to say which wasn't said in those threads, well, have fun at it. Mr. Drosishn, I'm not sure where you gather your information, but but other mailing list have been very helpful about this subject. As matter of fact, the harshes critics to date have been from OpenBSD. I'm not sure if we are both reading the same material. Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
Mr Clark, Could I trouble you to use your comments in my talk? Jessem. On 22 Dec, Crist J. Clark wrote: ||_ | PLEASE DO | | | | NOT FEED | | THANK | | THE TROLLS | | YOU | || |_| || | || | || | || | || | || | || | || | || |```|| |` Please, not on another list. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 22 Dec, Kris Kennaway wrote: On Sat, Dec 23, 2000 at 01:25:11PM +1300, David Preece wrote: At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. Are you stateing that one of the issues with SSH is a social issue and not a technical? These flaws can be all but eliminated by telling SSH to not even give the poor weak confused human the choice of answering yes to the question, by setting of a simple configuration option. JMJr, a good place to start your talk on "The Evils of SSH" might be the Pavlovian conditioning of humans to answer "Yes" to every question a computer gives them..focus on the real problem here. I'm giving your comments some consideration. Is there any other evidence that might help this type of arugement out? I've consider it, but it is a weak arguement and it really needs a solid foundation for presentation. Can you site(sp?) and specific studies or experiments that might aide in this area? Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On 23 Dec 2000, at 2:00, [EMAIL PROTECTED] wrote: On 23 Dec, Dan Langille wrote: On 23 Dec 2000, at 13:25, David Preece wrote: At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. It is possible. It is not trivial. What leads you to believe that it's not trival? You are the one claiming it is trivial. The onus is on you to prove your own claim. Or conversely, prove me wrong. I'm not feeding you. -- Dan Langille The FreeBSD Diary - http://freebsddiary.org/ FreshPorts - http://freshports.org/ NZ Broadband - http://unixathome.org/broadband/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Sat, Dec 23, 2000 at 02:00:54AM -0800, [EMAIL PROTECTED] wrote: It is possible. It is not trivial. What leads you to believe that it's not trival? A functioning brain. -- Bill Fumerola - security yahoo / Yahoo! inc. - [EMAIL PROTECTED] / [EMAIL PROTECTED] PS. I liked it better when you trolled advocacy, it was much easier to unsubscribe from that. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
You are clueless as to the effect of your word choices. Thank you for reading that. Please note that I am not writing this to flame, but in an attempt to be helpful ;-) At 15:37 2000-12-22 -0800 [EMAIL PROTECTED] wrote: Thank you for your attention. Your subject line got my attention, but so would having someone tug at my sleeve, or worse impertinence. How about "Please help me prepare for SSH talk" ? Next month I'm giving a talk about the evils of SSH. If you don't know that the above sentence strongly implies the existence of the referred-to "evils," may I suggest that you attend an English refresher. (Please don't tell me an empty set can exist). If you are going to invite others to express their opinions, the implicit assertion of your own as unqualified fact is not a good starting point. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Your foreplay stinks. You are trying to take advantage of my natural interest, but your approach forces me to overcome negative feelings before I can participate, which I would otherwise willingly do. It's a shame, really. Please note, I'm not here to flame or troll, just ask questions. Your responses determine the tone of all conversations. Your subject line resonated with the tone of crass attention grabbing. Do you disclaim all responsibility re tone, after thus giving everyone a goosing in an area of interest? If you are used that, you watch too much TV. Lastly, please trim the CC: line as you feel appropriate. Thanks. Jessem. That's ok. HTH. Really. Regards, Bengt Richter To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Fri, Dec 22, 2000 at 03:37:43PM -0800, [EMAIL PROTECTED] wrote: Thank you for your attention. Next month I'm giving a talk about the evils of SSH. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Please note, I'm not here to flame or troll, just ask questions. Your responses determine the tone of all conversations. The tone of your initial post will more likely set the tone of this conversation. Try to be more objective when you find technical problems with security software that people trust. Saying "ssh - are you nuts?!?" is kind of like yelling "fire" in a theater. It makes you look like a troll (despite your claim that you are not), and it trivializes anything important that you might have to say. Because of your tone, it is unlikely that anyone here will take you seriously. This is a shame considering that you might have important issues to raise. Good luck on your talk, -brian -- Brian O'Shea [EMAIL PROTECTED] To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
At 2:11 AM -0800 12/23/00, [EMAIL PROTECTED] wrote: On 22 Dec, Garance A Drosihn wrote: People in the "FreeBSD community" are invited to read the rambling and pointless discussions that this sparked in the OpenBSD and NetBSD communities before repeating all those arguments in all the freebsd mailing lists. If you still think you have something to say which wasn't said in those threads, well, have fun at it. I'm not sure where you gather your information, but but other mailing list have been very helpful about this subject. As matter of fact, the harshes critics to date have been from OpenBSD. I'm not sure if we are both reading the same material. a. I am part of the openbsd community too, although I am much more of a lurker there. You have your opinion of how well the thread went there, I have mine. b. All I said was that it would be a good idea for people to read the other threads before commenting. There is no sense repeating arguments which have already been presented. Assuming you are just collecting ideas for some presentation, you already have those ideas. There is no need to have them repeated here. -- Garance Alistair Drosehn= [EMAIL PROTECTED] Senior Systems Programmer or [EMAIL PROTECTED] Rensselaer Polytechnic Instituteor [EMAIL PROTECTED] To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
[EMAIL PROTECTED] wrote: Thank you for your attention. Next month I'm giving a talk about the evils of SSH. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. The simple fact that it doesn't transmit passwords in clear text? This is one of the stupidest trolls I've ever found, and is completely inappropriate for freebsd-security. Try over on -chat. -- "Where am I, and what am I doing in this handbasket?" Wes Peters Softweyr LLC [EMAIL PROTECTED] http://softweyr.com/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
ssh - are you nuts?!?
Thank you for your attention. Next month I'm giving a talk about the evils of SSH. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Please note, I'm not here to flame or troll, just ask questions. Your responses determine the tone of all conversations. Lastly, please trim the CC: line as you feel appropriate. Thanks. Jessem. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Friday, December 22, 2000, [EMAIL PROTECTED] wrote: Thank you for your attention. Next month I'm giving a talk about the evils of SSH. If you don't know anything about it, why do you claim it's evil? -- +---+--+ | Chris Costello| I modem, but they grew back. | | [EMAIL PROTECTED] | | +---+--+ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
In message [EMAIL PROTECTED], Chris Costello writes: On Friday, December 22, 2000, [EMAIL PROTECTED] wrote: Next month I'm giving a talk about the evils of SSH. If you don't know anything about it, why do you claim it's evil? I think it's safe to assume that anything you don't understand is evil, dangerous, and not to be trusted. This simple strategy has gotten us from humble roots to near total domination of the land masses of a whole planet. Why argue with success? -s p.s.: That said, I'm not going to the talk, because I'm not sure I know who this guy is who wants to give it, so I distrust him. To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Friday, December 22, 2000, [EMAIL PROTECTED] wrote: Next month I'm giving a talk about the evils of SSH. ... p.s.: That said, I'm not going to the talk, because I'm not sure I know who this guy is who wants to give it, so I distrust him. http://www.svbug.com/events/ reports the name Jesus Monroy Jr., i am sure this will tell you something... cheers luigi --+- Luigi RIZZO, [EMAIL PROTECTED] . ACIRI/ICSI (on leave from Univ. di Pisa) http://www.iet.unipi.it/~luigi/ . 1947 Center St, Berkeley CA 94704 Phone: (510) 666 2927 --+- To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. As ever, IMHO. Dave :) To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
* Dan Langille [EMAIL PROTECTED] [001222 16:33] wrote: On 23 Dec 2000, at 13:25, David Preece wrote: At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. It is possible. It is not trivial. No, it's practically impossible when correct precautions are taken. -- -Alfred Perlstein - [[EMAIL PROTECTED]|[EMAIL PROTECTED]] "I have the heart of a child; I keep it in a jar on my desk." To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
At 3:37 PM -0800 12/22/00, [EMAIL PROTECTED] wrote: Thank you for your attention. Next month I'm giving a talk about the evils of SSH. The talk schedule is posted on: http://www.svbug.com/events/ I've already circulated this message to the OpenBSD 'tech' mailing list and the NetBSD 'security' mailing list. Now, I've like to hear from the FreeBSD community. People in the "FreeBSD community" are invited to read the rambling and pointless discussions that this sparked in the OpenBSD and NetBSD communities before repeating all those arguments in all the freebsd mailing lists. If you still think you have something to say which wasn't said in those threads, well, have fun at it. -- Garance Alistair Drosehn= [EMAIL PROTECTED] Senior Systems Programmer or [EMAIL PROTECTED] Rensselaer Polytechnic Instituteor [EMAIL PROTECTED] To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
||_ | PLEASE DO | | | | NOT FEED | | THANK | | THE TROLLS | | YOU | || |_| || | || | || | || | || | || | || | || | || |```|| |` Please, not on another list. -- Crist J. Clark [EMAIL PROTECTED] To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: ssh - are you nuts?!?
On Sat, Dec 23, 2000 at 01:25:11PM +1300, David Preece wrote: At 15:37 22/12/00 -0800, you wrote: The question asked is: why you believe ssh is beter than say telnet. Or what advantages SSH has in general. Sorry, don't have time to reply to this properly. The main evil of ssh is that server authentication is not enforced, making mounting a man-in-the-middle attack basically trivial. Incorrect..the problems with SSH come down to flaws in the human operator who ignore the warnings SSH gives them, and tell it explicitly to do insecure things like connect to a server which is suddenly not the one you're used to connecting to. These flaws can be all but eliminated by telling SSH to not even give the poor weak confused human the choice of answering yes to the question, by setting of a simple configuration option. JMJr, a good place to start your talk on "The Evils of SSH" might be the Pavlovian conditioning of humans to answer "Yes" to every question a computer gives them..focus on the real problem here. Kris PGP signature
