Re: Security in a shell that starts ssh

2001-06-16 Thread Steven Huang
[some text omitted for brevity] On Wed, 13 Jun 2001, Tim van Erven wrote: [...] { char name[21]; /* Should be macro (#define NAMELEN 21) */ Possibly, but the name that can be entered is at most 20 chars long, so NAMELEN should arguably be defined to 20 and the declaration for name

Re: Security in a shell that starts ssh

2001-06-14 Thread David Ehle
I am in a similar situation as Miquel, and was consdering a similar option... but one thing keeps nagging at me as far as the security of the setup. SSH will encrypt all the data transmitted between the portal machine and other hosts, but what is keeping someone from sniffing everything going

Re: Security in a shell that starts ssh

2001-06-14 Thread Miquel Mart?n L?pez
Hi David! Well, in my case the terminal is an VT-100, so it's connected directly to the one of the serial ports of the server, so nothing's going wildly to the network in cleartext. I don't know about Xterminals, though... I guess they are networked, but I really don't know much about the

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 09:30:59PM +0200, Miquel Mart?n L?pez wrote: Hi David! Well, in my case the terminal is an VT-100, so it's connected directly to the one of the serial ports of the server, so nothing's going wildly to the network in cleartext. I don't know about Xterminals,

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 09:30:59PM +0200, Miquel Mart?n L?pez wrote: Hi David! Well, in my case the terminal is an VT-100, so it's connected directly to the one of the serial ports of the server, so nothing's going wildly to the network in cleartext. If you use really long RS-232 cables,

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 01:50:56AM +0400, Daniel Ginsburg wrote: Ctrl-@. It _won't_ be caught by fgets. See my other post. Please refer to manpages and the Standard to see what does fgets return and under what circumstances. The libc info page (run info libc, for those not familiar with

Re: Security in a shell that starts ssh

2001-06-14 Thread David Ehle
I am in a similar situation as Miquel, and was consdering a similar option... but one thing keeps nagging at me as far as the security of the setup. SSH will encrypt all the data transmitted between the portal machine and other hosts, but what is keeping someone from sniffing everything going

Re: Security in a shell that starts ssh

2001-06-14 Thread Steve Greenland
On 14-Jun-01, 14:30 (CDT), Miquel Mart?n L?pez [EMAIL PROTECTED] wrote: And changing topic, how about that code-revieu debian list? It sure sounds interesting, and many of us would learn a great deal :) Debian gurus out there, let's give it a shot! Where/who can we contact? I've submitted a

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 09:30:59PM +0200, Miquel Mart?n L?pez wrote: Hi David! Well, in my case the terminal is an VT-100, so it's connected directly to the one of the serial ports of the server, so nothing's going wildly to the network in cleartext. If you use really long RS-232 cables,

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 01:50:56AM +0400, Daniel Ginsburg wrote: [EMAIL PROTECTED] It _won't_ be caught by fgets. See my other post. Please refer to manpages and the Standard to see what does fgets return and under what circumstances. The libc info page (run info libc, for those not

Re: Security in a shell that starts ssh

2001-06-13 Thread Javier Fernandez-Sanguino Peña
Miquel Mart?n L?pez escribió: Hi all! We have several vt-100 terminal that log to the naub server at our office. Still, some users without account in the main server would like to login to another machine, so I was planning on creating a passwordless acount with a shell that's a program

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: #include stdio.h #include unistd.h /* For execlp */ #include stdlib.h /* For exit */ int main() int main(void) /* () != (void) in C */ { charname[21]; /* Should

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: #include stdio.h #include unistd.h /* For execlp */ #include stdlib.h /* For exit */ int main() int

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
Thanks for the feedback, I'll respond to both your replies at once. On Wed, Jun 13, 2001 at 08:24:32PM +0400, Daniel Ginsburg [EMAIL PROTECTED] wrote: On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 11:24 (CDT), Daniel Ginsburg [EMAIL PROTECTED] wrote: if(name[strlen(name) - 1] != '\n') { Possible access to unallocated memory if \0\n supplied as input. Oops, didn't catch that one. /* return 0; */ exit(EXIT_SUCCESS); /* return doesn't call atexit()

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 02:02:10PM -0500, Steve Greenland wrote: [snip] I'd still argue that exit(_macro_) is better style than return from main(), but I'm hard pressed to find a technical argument. There's subtle difference between returning from main and calling exit. Excelent explanation

Re: Security in a shell that starts ssh

2001-06-13 Thread Miquel Mart?n L?pez
Whoa! Amazing :) This is exactly the sort of feedback I expected, thanks a lot guys! I don't have trouble understanding your suggersions, my main delight comes from wondering how on earth can you think of so many tiny details :) And I thought I was paraonid :) Really, thanks a lot, that taught me

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 13:47 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: int main() int main(void) /* () != (void) in C */ The comp.lang.c faq (http://www.faqs.org/faqs/C-faq/faq/) says it's ok. Where does it say this?

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
On Wed, Jun 13, 2001 at 04:10:27PM -0500, Steve Greenland [EMAIL PROTECTED] wrote: On 13-Jun-01, 13:47 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: int main() int main(void) /* () != (void) in C */ The

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: #include stdio.h #include unistd.h /* For execlp */ #include stdlib.h /* For exit */ int main() int main(void) /* () != (void) in C */ { charname[21]; /* Should

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: #include stdio.h #include unistd.h /* For execlp */ #include stdlib.h /* For exit */ int main() int

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
Thanks for the feedback, I'll respond to both your replies at once. On Wed, Jun 13, 2001 at 08:24:32PM +0400, Daniel Ginsburg [EMAIL PROTECTED] wrote: On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 11:24 (CDT), Daniel Ginsburg [EMAIL PROTECTED] wrote: if(name[strlen(name) - 1] != '\n') { Possible access to unallocated memory if \0\n supplied as input. Oops, didn't catch that one. /* return 0; */ exit(EXIT_SUCCESS); /* return doesn't call atexit()

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 02:02:10PM -0500, Steve Greenland wrote: [snip] I'd still argue that exit(_macro_) is better style than return from main(), but I'm hard pressed to find a technical argument. There's subtle difference between returning from main and calling exit. Excelent explanation

Re: Security in a shell that starts ssh

2001-06-13 Thread Miquel Mart?n L?pez
Whoa! Amazing :) This is exactly the sort of feedback I expected, thanks a lot guys! I don't have trouble understanding your suggersions, my main delight comes from wondering how on earth can you think of so many tiny details :) And I thought I was paraonid :) Really, thanks a lot, that taught me

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 13:47 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: int main() int main(void) /* () != (void) in C */ The comp.lang.c faq (http://www.faqs.org/faqs/C-faq/faq/) says it's ok. Where does it say this?

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
On Wed, Jun 13, 2001 at 04:10:27PM -0500, Steve Greenland [EMAIL PROTECTED] wrote: On 13-Jun-01, 13:47 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: int main() int main(void) /* () != (void) in C */ The

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 04:10:27PM -0500, Steve Greenland wrote: On 13-Jun-01, 13:47 (CDT), Tim van Erven [EMAIL PROTECTED] wrote: On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: int main() int main(void) /* () != (void) in C */ The comp.lang.c faq

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 11:34:28PM +0200, Tim van Erven wrote: [snip] Possible access to unallocated memory if \0\n supplied as input. Only if strlen(name) = 0 and besides from being hard to achieve when entering data on stdin, fgets will return 0 if that happens. But not if

Security in a shell that starts ssh

2001-06-12 Thread Miquel Mart?n L?pez
Hi all! We have several vt-100 terminal that log to the naub server at our office. Still, some users without account in the main server would like to login to another machine, so I was planning on creating a passwordless acount with a shell that's a program that asks for usernames and then execs

Re: Security in a shell that starts ssh

2001-06-12 Thread Aaron Dewell
That would probably work, but for style I'd use 'break;' instead of 'i=100;'. You also don't need to be quite so paranoid with printf, it's generally safe unless you are printf'ing data entered by the user. If it's all your own text, they can't insert anything strange into it... Also, instead

Re: Security in a shell that starts ssh

2001-06-12 Thread Tim van Erven
On Tue, Jun 12, 2001 at 11:40:08PM +0200, Miquel Mart?n L?pez [EMAIL PROTECTED] wrote: #include stdio.h main(){ int i=0; char name[10]; write(1,Login as: ,10); while(i10) { read(0,name[i],1); if (name[i]=='\n') {name[i]='\0';i=100;} i++; }

Security in a shell that starts ssh

2001-06-12 Thread Miquel Mart?n L?pez
Hi all! We have several vt-100 terminal that log to the naub server at our office. Still, some users without account in the main server would like to login to another machine, so I was planning on creating a passwordless acount with a shell that's a program that asks for usernames and then execs

Re: Security in a shell that starts ssh

2001-06-12 Thread Aaron Dewell
That would probably work, but for style I'd use 'break;' instead of 'i=100;'. You also don't need to be quite so paranoid with printf, it's generally safe unless you are printf'ing data entered by the user. If it's all your own text, they can't insert anything strange into it... Also, instead