From owner-freebsd-security Sat Jan 1 10:50:28 2000 Delivered-To: freebsd-security@freebsd.org Received: from hellohost (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id EBEA91507B for ; Sat, 1 Jan 2000 10:50:07 -0800 (PST) (envelope-from green@FreeBSD.org) Date: Sat, 1 Jan 2000 13:49:22 -0500 (EST) From: Brian Fundakowski Feldman X-Sender: green@green.dyndns.org To: security@FreeBSD.org Subject: OpenSSH protocol 1.6 proposal Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I've been thinking what the best way to make OpenSSH more secure would be, and now it seems to be a change in the protocol. What change? Well, SSH version 1.5 and below (all versions so far) have been vulnerable to attacks based upon properties of the highly insecure CRC32 hash used. In my version 1.6, whose clients and servers are completely backward- compatible, the insecure CRC method is replaced with a SHA-1 cryptographic hash; in addition, even more security is afforded because the hash is sent per packet using total collective data output from that side's transmission. This should effectively negate any chances of e.g. playback attacks, even if the malicious intercepter does manage to fool the network stack into accepting his packets. Thanks to peter@ and dan@ for the help they gave me for this. The port-relative patch for this is located at: http://www.FreeBSD.org/~green/openssh.SHA-1.patch MD5 (public_html/openssh.SHA-1.patch) = e21a896f59474a31ab3b9103acf44c35 Let me know what you all think! I still haven't quite decided, but I think packets which fail the SHA-1 test should be silently dropped, or have a counter of them, rather than dropping the connection. Currently, the connection is dropped and error messages displayed/transmitted. I welcome input on that and all parts of this proposal :) P.S.: I realize other people may have proposed something very similar. Indeed, markus's proposal may be something like this. However, since it's impossible to work with anyone who is Theo, or "under" Theo, it's unrealistic to work with that. Hence the reason we need to make a code fork of OpenSSH as soon as convenient. -- Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / green@FreeBSD.org `------------------------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 11:40: 9 2000 Delivered-To: freebsd-security@freebsd.org Received: from erouter0.it-datacntr.louisville.edu (erouter0.it-datacntr.louisville.edu [136.165.1.36]) by hub.freebsd.org (Postfix) with ESMTP id BA78C1507B; Sat, 1 Jan 2000 11:40:02 -0800 (PST) (envelope-from k.stevenson@louisville.edu) Received: from osaka.louisville.edu (osaka.louisville.edu [136.165.1.114]) by erouter0.it-datacntr.louisville.edu (Postfix) with ESMTP id CA3DC24D14; Sat, 1 Jan 2000 14:40:01 -0500 (EST) Received: by osaka.louisville.edu (Postfix, from userid 15) id 8608718605; Sat, 1 Jan 2000 14:39:51 -0500 (EST) Date: Sat, 1 Jan 2000 14:39:51 -0500 From: Keith Stevenson To: Brian Fundakowski Feldman Cc: security@FreeBSD.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000101143951.A4719@osaka.louisville.edu> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0pre3i In-Reply-To: Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, Jan 01, 2000 at 01:49:22PM -0500, Brian Fundakowski Feldman wrote: > Let me know what you all think! I still haven't quite decided, but I > think packets which fail the SHA-1 test should be silently dropped, or > have a counter of them, rather than dropping the connection. Currently, > the connection is dropped and error messages displayed/transmitted. I > welcome input on that and all parts of this proposal :) > > P.S.: I realize other people may have proposed something very similar. > Indeed, markus's proposal may be something like this. However, > since it's impossible to work with anyone who is Theo, or > "under" Theo, it's unrealistic to work with that. Hence the > reason we need to make a code fork of OpenSSH as soon as > convenient. First of all, allow me to thank you for all of the work you have done maintaining OpenSSH for FreeBSD. I am looking forward to its entry into the base tree. (I'm also planning to convert from SSH to OpenSSH on all my systems as soon as it is feasible.) That said, the prospect of having a FreeBSD specific branch of OpenSSH disturbs me. I manage an extremely heterogeneous Unix environment and eventually hope to have OpenSSH running an all of my systems. I am concerned that if OpenSSH branches, that there will be inter-operability problems at some point down the road. While I appreciate the work that you are doing to make OpenSSH more secure, and I understand the difficulties involved in working with the OpenBSD folks, I urge you to try to avoid a code fork if it is at all possible. I don't want to one day have to decide which OpenSSH to deploy on my systems. Regards, --Keith Stevenson-- -- Keith Stevenson System Programmer - Data Center Services - University of Louisville k.stevenson@louisville.edu PGP key fingerprint = 4B 29 A8 95 A8 82 EA A2 29 CE 68 DE FC EE B6 A0 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 11:52:36 2000 Delivered-To: freebsd-security@freebsd.org Received: from funky.monkey.org (ns1.monkey.org [63.77.239.12]) by hub.freebsd.org (Postfix) with ESMTP id 5319D14ED5; Sat, 1 Jan 2000 11:52:32 -0800 (PST) (envelope-from dugsong@monkey.org) Received: by funky.monkey.org (Postfix, from userid 1001) id F34AE15187; Sat, 1 Jan 2000 14:51:57 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by funky.monkey.org (Postfix) with ESMTP id E528614A01; Sat, 1 Jan 2000 14:51:57 -0500 (EST) Date: Sat, 1 Jan 2000 14:51:57 -0500 (EST) From: Dug Song To: Brian Fundakowski Feldman Cc: security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, 1 Jan 2000, Brian Fundakowski Feldman wrote: > http://www.FreeBSD.org/~green/openssh.SHA-1.patch > MD5 (public_html/openssh.SHA-1.patch) = e21a896f59474a31ab3b9103acf44c35 > > P.S.: I realize other people may have proposed something very similar. > Indeed, markus's proposal may be something like this. However, > since it's impossible to work with anyone who is Theo, or > "under" Theo, it's unrealistic to work with that. Hence the > reason we need to make a code fork of OpenSSH as soon as > convenient. i'm sorry you feel this way. so far, the OpenBSD OpenSSH developers and the Linux/Solaris/etc. OpenSSH developers led by Damien Miller have been getting along just fine. we hereby cordially invite you to join the party! http://violet.ibs.com.au/openssh/list.html best wishes for the new year. -d. --- http://www.monkey.org/~dugsong/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 13:30:46 2000 Delivered-To: freebsd-security@freebsd.org Received: from hellohost (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id 0BCC5150AC; Sat, 1 Jan 2000 13:30:18 -0800 (PST) (envelope-from green@FreeBSD.org) Date: Sat, 1 Jan 2000 16:29:32 -0500 (EST) From: Brian Fundakowski Feldman X-Sender: green@green.dyndns.org To: Keith Stevenson Cc: security@FreeBSD.org Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: <20000101143951.A4719@osaka.louisville.edu> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, 1 Jan 2000, Keith Stevenson wrote: > On Sat, Jan 01, 2000 at 01:49:22PM -0500, Brian Fundakowski Feldman wrote: > > > > P.S.: I realize other people may have proposed something very similar. > > Indeed, markus's proposal may be something like this. However, > > since it's impossible to work with anyone who is Theo, or > > "under" Theo, it's unrealistic to work with that. Hence the > > reason we need to make a code fork of OpenSSH as soon as > > convenient. > > First of all, allow me to thank you for all of the work you have done > maintaining OpenSSH for FreeBSD. I am looking forward to its entry into the > base tree. (I'm also planning to convert from SSH to OpenSSH on all my systems > as soon as it is feasible.) Thank you for the feedback, too :) > That said, the prospect of having a FreeBSD specific branch of OpenSSH > disturbs me. I manage an extremely heterogeneous Unix environment and > eventually hope to have OpenSSH running an all of my systems. I am concerned > that if OpenSSH branches, that there will be inter-operability problems at some > point down the road. While I appreciate the work that you are doing to make > OpenSSH more secure, and I understand the difficulties involved in working > with the OpenBSD folks, I urge you to try to avoid a code fork if it is at > all possible. I don't want to one day have to decide which OpenSSH to deploy > on my systems. Don't mistake a code fork for interoperability problems. The big issue is that there is so much work being done for OpenSSH by FreeBSDers which will never go in the OpenBSD's OpenSSH, it's not worth it to try to keep things a "straight port". Yes, this is one of those things where we know that we can do a much better job. As for interoperability, it is paramount to be compatible with the protocols that everyone implements. It's only natural to provide an extension to a previous protocol, and implement it backward-compatibly in every respect. Don't think of it as "embrace and extend" if it's really improving the protocol in an open manner, easily implemented by others, and that improvement is paramount in completely securing a protocol. Yes, I think this would be generating a de facto standard, but it's not a negative thing. Most standards are de facto. Besides, if few people appreciate the security a protocol change can afford, they'll be losing out. If something can be done to make something more secure, especially when whatever that is is designed to provide security, it should be done. That may include extending a protocol, but extending a protocol to a new version is not a bad thing if it's done with the proper steps to maintain complete compatibility in all respects. =] > > Regards, > --Keith Stevenson-- > > -- > Keith Stevenson > System Programmer - Data Center Services - University of Louisville > k.stevenson@louisville.edu > PGP key fingerprint = 4B 29 A8 95 A8 82 EA A2 29 CE 68 DE FC EE B6 A0 > -- Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / green@FreeBSD.org `------------------------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 13:38:26 2000 Delivered-To: freebsd-security@freebsd.org Received: from hellohost (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id AB68214E83; Sat, 1 Jan 2000 13:37:53 -0800 (PST) (envelope-from green@FreeBSD.org) Date: Sat, 1 Jan 2000 16:37:07 -0500 (EST) From: Brian Fundakowski Feldman X-Sender: green@green.dyndns.org To: Dug Song Cc: security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, 1 Jan 2000, Dug Song wrote: > On Sat, 1 Jan 2000, Brian Fundakowski Feldman wrote: > > > http://www.FreeBSD.org/~green/openssh.SHA-1.patch > > MD5 (public_html/openssh.SHA-1.patch) = e21a896f59474a31ab3b9103acf44c35 > > > > P.S.: I realize other people may have proposed something very similar. > > Indeed, markus's proposal may be something like this. However, > > since it's impossible to work with anyone who is Theo, or > > "under" Theo, it's unrealistic to work with that. Hence the > > reason we need to make a code fork of OpenSSH as soon as > > convenient. > > i'm sorry you feel this way. so far, the OpenBSD OpenSSH developers and > the Linux/Solaris/etc. OpenSSH developers led by Damien Miller have been > getting along just fine. we hereby cordially invite you to join the party! > > http://violet.ibs.com.au/openssh/list.html > > best wishes for the new year. Have you, personally, ever tried to talk to Theo? I know I'm not the only one who has tried, and only gotten flames in response. I don't think someone like that should be the head of any project, and it's truly impossible to work with such a... person. Now, if you come to tell me there's a way to actually discuss things with ration human beings, not having to deal with flaming egomaniacs, I am all ears! I would love to have more people to work with, where the people could actually remain civil. > -d. > > --- > http://www.monkey.org/~dugsong/ -- Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / green@FreeBSD.org `------------------------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 18:39:53 2000 Delivered-To: freebsd-security@freebsd.org Received: from spirit.jaded.net (liv3-3.hamilton.idirect.com [209.161.208.3]) by hub.freebsd.org (Postfix) with ESMTP id 4D5F314F3D; Sat, 1 Jan 2000 18:39:40 -0800 (PST) (envelope-from dan@spirit.jaded.net) Received: (from dan@localhost) by spirit.jaded.net (8.9.3/8.9.3) id VAA01143; Sat, 1 Jan 2000 21:44:42 -0500 (EST) Date: Sat, 1 Jan 2000 21:44:42 -0500 From: Dan Moschuk To: Brian Fundakowski Feldman Cc: freebsd-security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000101214442.A1127@spirit.jaded.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: ; from green@FreeBSD.ORG on Sat, Jan 01, 2000 at 01:49:22PM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org | Let me know what you all think! I still haven't quite decided, but I | think packets which fail the SHA-1 test should be silently dropped, or | have a counter of them, rather than dropping the connection. Currently, | the connection is dropped and error messages displayed/transmitted. I | welcome input on that and all parts of this proposal :) Hi Brian, Forgive my ignorance of the SSH protocol, but what would happen if two projects forked the OpenSSH code and also bumped the minor version number up with their own expansions and modifications? -- Dan Moschuk (TFreak!dan@freebsd.org) "No good deed goes unpunished." To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 20:24:28 2000 Delivered-To: freebsd-security@freebsd.org Received: from hellohost (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id 0250E14F60; Sat, 1 Jan 2000 20:24:17 -0800 (PST) (envelope-from green@FreeBSD.org) Date: Sat, 1 Jan 2000 23:24:13 -0500 (EST) From: Brian Fundakowski Feldman X-Sender: green@green.dyndns.org To: Dan Moschuk Cc: freebsd-security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: <20000101214442.A1127@spirit.jaded.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, 1 Jan 2000, Dan Moschuk wrote: > > | Let me know what you all think! I still haven't quite decided, but I > | think packets which fail the SHA-1 test should be silently dropped, or > | have a counter of them, rather than dropping the connection. Currently, > | the connection is dropped and error messages displayed/transmitted. I > | welcome input on that and all parts of this proposal :) > > Hi Brian, > > Forgive my ignorance of the SSH protocol, but what would happen if two > projects forked the OpenSSH code and also bumped the minor version number > up with their own expansions and modifications? They'd make sure that they were compatible with eachother :) Really, I think the same thing will be adopted by both sides, but it would need people who can cooperate. Alfred and I have already confirmed that it's not possible to work with theo; markus, on the other hand, seems to just be ignoring us. I really think the code fork is necessary because OpenBSD (Theo) simply will not listen to reason and correct his code. It's fighting an uphill battle when you have to keep fixing code that someone else keeps breaking. Yes, we have pointed out specific bugs, and only gotten flames in return. You can't have collaboration without communication, and communication with the one who's "in charge" is pointless. > > -- > Dan Moschuk (TFreak!dan@freebsd.org) > "No good deed goes unpunished." > -- Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / green@FreeBSD.org `------------------------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 20:52:45 2000 Delivered-To: freebsd-security@freebsd.org Received: from spirit.jaded.net (liv3-3.hamilton.idirect.com [209.161.208.3]) by hub.freebsd.org (Postfix) with ESMTP id 84E1F14D5C; Sat, 1 Jan 2000 20:52:42 -0800 (PST) (envelope-from dan@spirit.jaded.net) Received: (from dan@localhost) by spirit.jaded.net (8.9.3/8.9.3) id XAA01604; Sat, 1 Jan 2000 23:57:44 -0500 (EST) Date: Sat, 1 Jan 2000 23:57:44 -0500 From: Dan Moschuk To: Brian Fundakowski Feldman Cc: freebsd-security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000101235744.A1550@spirit.jaded.net> References: <20000101214442.A1127@spirit.jaded.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: ; from green@FreeBSD.ORG on Sat, Jan 01, 2000 at 11:24:13PM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org | > Forgive my ignorance of the SSH protocol, but what would happen if two | > projects forked the OpenSSH code and also bumped the minor version number | > up with their own expansions and modifications? | | They'd make sure that they were compatible with eachother :) Really, I | think the same thing will be adopted by both sides, but it would need | people who can cooperate. Alfred and I have already confirmed that | it's not possible to work with theo; markus, on the other hand, seems | to just be ignoring us. You can't simply assume that this will be the case. If Project X decides to implement the same security check but with a different hash (say MD5) and update their minor version to 1.6, you have two incompatible versions. As I mentioned, I'm fairly ignorant to the SSH protocol, but is it not a RFC-defined protocol now? If so, it may not be a good idea to tinker with version numbers. Perhaps include a new cipher (like idea+sha1 and so on), that way if the other end doesn't support it, we can fall back to idea with the regular CRC checks. | I really think the code fork is necessary because OpenBSD (Theo) | simply will not listen to reason and correct his code. It's fighting | an uphill battle when you have to keep fixing code that someone else | keeps breaking. Yes, we have pointed out specific bugs, and only | gotten flames in return. You can't have collaboration without | communication, and communication with the one who's "in charge" is | pointless. I have no problems forking the code branch as long as the other projects see what we are doing and vice versa. It would be nice if we could keep the development teams together though. -- Dan Moschuk (TFreak!dan@freebsd.org) "But time turned a new page, blank for the best." To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 20:57:33 2000 Delivered-To: freebsd-security@freebsd.org Received: from alcove.wittsend.com (alcove.wittsend.com [130.205.0.20]) by hub.freebsd.org (Postfix) with ESMTP id 1C68114F83; Sat, 1 Jan 2000 20:57:28 -0800 (PST) (envelope-from mhw@alcove.wittsend.com) Received: (from mhw@localhost) by alcove.wittsend.com (8.9.3/8.9.3) id XAA16516; Sat, 1 Jan 2000 23:57:21 -0500 Date: Sat, 1 Jan 2000 23:57:21 -0500 From: "Michael H. Warfield" To: Brian Fundakowski Feldman Cc: Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000101235721.A15256@alcove.wittsend.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: ; from green@FreeBSD.org on Sat, Jan 01, 2000 at 04:37:07PM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, Jan 01, 2000 at 04:37:07PM -0500, Brian Fundakowski Feldman wrote: > On Sat, 1 Jan 2000, Dug Song wrote: > > On Sat, 1 Jan 2000, Brian Fundakowski Feldman wrote: > > > http://www.FreeBSD.org/~green/openssh.SHA-1.patch > > > MD5 (public_html/openssh.SHA-1.patch) = e21a896f59474a31ab3b9103acf44c35 > > > P.S.: I realize other people may have proposed something very similar. > > > Indeed, markus's proposal may be something like this. However, > > > since it's impossible to work with anyone who is Theo, or > > > "under" Theo, it's unrealistic to work with that. Hence the > > > reason we need to make a code fork of OpenSSH as soon as > > > convenient. > > i'm sorry you feel this way. so far, the OpenBSD OpenSSH developers and > > the Linux/Solaris/etc. OpenSSH developers led by Damien Miller have been > > getting along just fine. we hereby cordially invite you to join the party! > > http://violet.ibs.com.au/openssh/list.html > > best wishes for the new year. > Have you, personally, ever tried to talk to Theo? I know I'm not the > only one who has tried, and only gotten flames in response. I don't As a matter of fact I have. Theo and I shared more than a few beers down in San Antonio at the Usenix Security Symposium a while back. I found that he was just as opinionated and arrogant as I was. I quickly figured out that one did NOT come to debate one's position with Theo unless one was fully prepared to defend one's position. I like that man! I don't agree with him on all points and we may send some people scrambling for 911 when we debate, but I like him. He knows his position and he IS prepared to debate it and defend it. Anyone who attempts to argue with him who is not prepared it engaging in a self inflicted injury. I don't know and don't really care if he remembers our debates (hell, it was 2 in the morning). He has my respect, whether I agree with him or not. > think someone like that should be the head of any project, and it's > truly impossible to work with such a... person. Excuse "my french" at this point. No... He is easy to work with... I know plently of assholes who don't know jack shit about what they are managing, but the are "the manager". THEY are impossible to work with. I have watched at least one totally incompetant moron, whose sole goal in life is to be a role model for a dilbert comic strip, totally destroy a corporate position with regard to platforms and support. This man micromanaged by "buzzword". Buzzword bingo is no fun when everyone goes balistic five minutes into one of his monologs. I would work under Theo in a heart beat, even if they had to call the goon squad to keep us from throtalling each other. Theo knows his shit and is prepared to defend his position. Anyone who argues with him and is NOT prepared to do this same gets what they deserve. > Now, if you come to tell me there's a way to actually discuss things > with ration human beings, not having to deal with flaming egomaniacs, > I am all ears! I would love to have more people to work with, where > the people could actually remain civil. I had this with Theo. If you are prepared to defend your ideas and are prepared to LISTEN to his, you CAN have a productive debate with him. You will not win all the arguements. You may even win a few points with him. You may even part as friends (I hope I can claim that). He may concede some points and learn some things and so may you. You DON'T engage him in debate to convince him of something. You engage him in debate expecting that you BOTH MIGHT learn something. And you will... > > -d. > > --- > > http://www.monkey.org/~dugsong/ > -- > Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / > green@FreeBSD.org `------------------------------' Mike -- Michael H. Warfield | (770) 985-6132 | mhw@WittsEnd.com (The Mad Wizard) | (770) 331-2437 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 22: 0:25 2000 Delivered-To: freebsd-security@freebsd.org Received: from hellohost (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id A70DB14E9B; Sat, 1 Jan 2000 22:00:21 -0800 (PST) (envelope-from green@FreeBSD.org) Date: Sun, 2 Jan 2000 01:00:17 -0500 (EST) From: Brian Fundakowski Feldman X-Sender: green@green.dyndns.org To: "Michael H. Warfield" Cc: Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: <20000101235721.A15256@alcove.wittsend.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I'm sorry for bringing this up under all these public eyes. Let me suffice it to say that all the communcation so far I have had with Theo regarding OpenSSH has come down to (on my receiving side): a. name-calling b. NIHism c. ignoring of all technical arguments d. "religious" issues e. "disappearing" from a discussion when proven wrong Therefore, I do not find it unreasonable to state that it is nearly impossible to try to communicate with him. I had no bias at all, but what I've experienced from attempting rational discussion with him has obviously given me an opinion. I'd be elated if it were possible to have a rational discussion with him. I suppose if I wasn't affiliated with the FreeBSD project, I might be able to. All the evidence of possibility of rational discussion, so far, has pointed to there being none. -- Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / green@FreeBSD.org `------------------------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 23: 8:49 2000 Delivered-To: freebsd-security@freebsd.org Received: from public.bta.net.cn (public.bta.net.cn [202.96.0.97]) by hub.freebsd.org (Postfix) with ESMTP id E140714D09 for ; Sat, 1 Jan 2000 23:08:43 -0800 (PST) (envelope-from robinson@netrinsics.com) Received: from netrinsics.com (gj-05-046.bta.net.cn [202.106.5.46]) by public.bta.net.cn (8.9.3/8.9.3) with ESMTP id PAA20301 for ; Sun, 2 Jan 2000 15:08:32 +0800 (CST) Received: (from robinson@localhost) by netrinsics.com (8.9.3/8.9.3) id PAA00600 for security@FreeBSD.ORG; Sun, 2 Jan 2000 15:09:23 +0800 (CST) (envelope-from robinson) Date: Sun, 2 Jan 2000 15:09:23 +0800 (CST) From: Michael Robinson Message-Id: <200001020709.PAA00600@netrinsics.com> To: security@freebsd.org Subject: Re: OpenSSH protocol 1.6 proposal Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org [...to fork or not to fork...] My apologies if this has been sorted out someplace else, but I'm sort of wondering what the point is of trying to fix the SSH protocol. A lot of very smart people worked long and hard on IPSEC. It's an open, interoperable standard. It's simple to implement and understand. It is (I've been led to understand) well-analyzed and theoretically robust. It works. And, significantly, FreeBSD still doesn't have a documented, user-friendly, fully-featured implementation. What is the compelling attraction of yet another potentially shortlived variation on a proprietary protocol? -Michael Robinson To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 23:26:30 2000 Delivered-To: freebsd-security@freebsd.org Received: from verdi.nethelp.no (verdi.nethelp.no [158.36.41.162]) by hub.freebsd.org (Postfix) with SMTP id 9E57014D92 for ; Sat, 1 Jan 2000 23:26:27 -0800 (PST) (envelope-from sthaug@nethelp.no) Received: (qmail 45441 invoked by uid 1001); 2 Jan 2000 07:26:25 +0000 (GMT) To: robinson@netrinsics.com Cc: security@freebsd.org Subject: Re: OpenSSH protocol 1.6 proposal From: sthaug@nethelp.no In-Reply-To: Your message of "Sun, 2 Jan 2000 15:09:23 +0800 (CST)" References: <200001020709.PAA00600@netrinsics.com> X-Mailer: Mew version 1.05+ on Emacs 19.34.2 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Date: Sun, 02 Jan 2000 08:26:25 +0100 Message-ID: <45439.946797985@verdi.nethelp.no> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > What is the compelling attraction of yet another potentially shortlived > variation on a proprietary protocol? A very large installed user base? Also, I'd hardly call SSH1 proprietary - at least not in the same sense that Microsoft is proprietary. Source code has been available all along. Steinar Haug, Nethelp consulting, sthaug@nethelp.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 1 23:45:39 2000 Delivered-To: freebsd-security@freebsd.org Received: from public.bta.net.cn (public.bta.net.cn [202.96.0.97]) by hub.freebsd.org (Postfix) with ESMTP id 3C78914E00 for ; Sat, 1 Jan 2000 23:45:36 -0800 (PST) (envelope-from robinson@netrinsics.com) Received: from netrinsics.com (gj-05-046.bta.net.cn [202.106.5.46]) by public.bta.net.cn (8.9.3/8.9.3) with ESMTP id PAA27053 for ; Sun, 2 Jan 2000 15:45:30 +0800 (CST) Received: (from robinson@localhost) by netrinsics.com (8.9.3/8.9.3) id PAA00772; Sun, 2 Jan 2000 15:46:19 +0800 (CST) (envelope-from robinson) Date: Sun, 2 Jan 2000 15:46:19 +0800 (CST) From: Michael Robinson Message-Id: <200001020746.PAA00772@netrinsics.com> To: robinson@netrinsics.com, sthaug@nethelp.no Subject: Re: OpenSSH protocol 1.6 proposal Cc: security@freebsd.org In-Reply-To: <45439.946797985@verdi.nethelp.no> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Steinar Haug writes: >> What is the compelling attraction of yet another potentially shortlived >> variation on a proprietary protocol? > >A very large installed user base? When you start talking about making non-upward-compatible protocol changes, that point becomes somewhat moot, doesn't it? -Michael Robinson To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 1:23:37 2000 Delivered-To: freebsd-security@freebsd.org Received: from server.research.zopps.fi (ws99.research.zopps.fi [195.165.196.99]) by hub.freebsd.org (Postfix) with ESMTP id A9A2E14C17 for ; Sun, 2 Jan 2000 01:23:23 -0800 (PST) (envelope-from martti@research.zopps.fi) Received: (from uucp@localhost) by server.research.zopps.fi (8.9.3/8.9.3) id LAA33507 for ; Sun, 2 Jan 2000 11:23:14 +0200 (EET) (envelope-from martti.kuparinen) Received: from ws125.research.zopps.fi(195.165.196.125) via SMTP by ws99.research.zopps.fi, id smtpdA33505; Sun Jan 2 11:23:09 2000 Date: Sun, 2 Jan 2000 11:23:09 +0200 (EET) From: Martti Kuparinen To: freebsd-security@freebsd.org Subject: zero checksums in tripwire Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi! I'm using tripwire-1.2 to check the filesystems for modifications. Something weird happened today: ### Phase 5: Generating observed/expected pairs for changed files ### ### Attr Observed (what it is) Expected (what it should be) ### =========== ============================= ============================= /usr/sbin/mergemaster snefru (sig2): 0 1YtxO4k.hi8WCaxeN2OeK7 crc32 (sig3): 0 2.CHwf crc16 (sig4): 0 0009Yl md4 (sig5): 0 36WHBVUe1VKbe71GDuAfPx md2 (sig6): 0 1ME7ZPdw3AEDfbiH9EqzQ1 sha (sig7): 0 5GitfGU8C56VXcAZTHHw0IsJJ6W haval (sig8): 0 08FTJNA4mat.Yv8nFwfbkT ---> File: '/usr/sbin/mergemaster' ---> Update entry? [YN(y)nh?] There are several other similar cases where all the checksums are zeros. Any idea what's going on? /Martti To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 3:20:59 2000 Delivered-To: freebsd-security@freebsd.org Received: from hilda.bohemians.lexington.ky.us (hilda.bohemians.lexington.ky.us [207.246.92.4]) by hub.freebsd.org (Postfix) with ESMTP id 215FE14D09; Sun, 2 Jan 2000 03:20:52 -0800 (PST) (envelope-from drankin@bohemians.lexington.ky.us) Received: from rumpole.bohemians.lexington.ky.us (rumpole.bohemians.lexington.ky.us [207.246.92.3]) by hilda.bohemians.lexington.ky.us (8.9.3/8.9.3) with ESMTP id DAA01650; Sun, 2 Jan 2000 03:20:36 -0800 (PST) Received: (from drankin@localhost) by rumpole.bohemians.lexington.ky.us (8.9.3/8.9.3) id GAA01743; Sun, 2 Jan 2000 06:15:49 -0500 (EST) Date: Sun, 2 Jan 2000 06:15:48 -0500 From: David Rankin To: Brian Fundakowski Feldman Cc: "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000102061545.A1691@rumpole.bohemians.lexington.ky.us> References: <20000101235721.A15256@alcove.wittsend.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.6us In-Reply-To: ; from Brian Fundakowski Feldman on Sun, Jan 02, 2000 at 01:00:17AM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, Jan 02, 2000 at 01:00:17AM -0500, Brian Fundakowski Feldman wrote: > I'm sorry for bringing this up under all these public eyes. Let me suffice > it to say that all the communcation so far I have had with Theo regarding > OpenSSH has come down to (on my receiving side): *rest deleted* Since I've never dealt with Theo, I won't comment on the ability (or lack thereof) of Theo to hold a public discussion with others. What I AM concerned about is the discussion of a possible 1.6 protocol. Since the openssh-dev-list was never involved in that discussion, could someone please let us know the details. Speaking completely without facts, I am personally skeptical about enhancing the 1.x protocol when all of the standards processes are focused on getting 2.0 out the door. That said, I am willing to be convinced on the matter. Thanks, David -- David W. Rankin, Jr. Husband, Father, and UNIX Sysadmin. Email: drankin@bohemians.lexington.ky.us Address/Phone Number: Ask me. "It is no great thing to be humble when you are brought low; but to be humble when you are praised is a great and rare accomplishment." St. Bernard To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 4:53:32 2000 Delivered-To: freebsd-security@freebsd.org Received: from florence.pavilion.net (florence.pavilion.net [212.74.0.25]) by hub.freebsd.org (Postfix) with ESMTP id B86A714F34 for ; Sun, 2 Jan 2000 04:53:29 -0800 (PST) (envelope-from joe@florence.pavilion.net) Received: (from joe@localhost) by florence.pavilion.net (8.9.3/8.8.8) id MAA25485; Sun, 2 Jan 2000 12:53:26 GMT (envelope-from joe) Date: Sun, 2 Jan 2000 12:53:26 +0000 From: Josef Karthauser To: Michael Robinson Cc: security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000102125326.B24810@florence.pavilion.net> References: <200001020709.PAA00600@netrinsics.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0pre2i In-Reply-To: <200001020709.PAA00600@netrinsics.com> X-NCC-RegID: uk.pavilion Organisation: Pavilion Internet plc, Lees House, 21-23 Dyke Road, Brighton, England Phone: +44-845-333-5000 Fax: +44-845-333-5001 Mobile: +44-403-596893 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, Jan 02, 2000 at 03:09:23PM +0800, Michael Robinson wrote: > > A lot of very smart people worked long and hard on IPSEC. It's an open, > interoperable standard. It's simple to implement and understand. It is > (I've been led to understand) well-analyzed and theoretically robust. > It works. > > And, significantly, FreeBSD still doesn't have a documented, user-friendly, > fully-featured implementation. > That may be true, but work is progressing at a pace in 4.X to add this functionality for the 4.0 release. It won't be long now. On the other hand even with the completed I'm still not going to be able to connect to a FreeBSD box from a Windows box, for example, because one of them lacks the IPSEC code. Ssh has been, and will continue to be, a a great stop-gap solution. Joe -- Josef Karthauser FreeBSD: Take the red pill and we'll show you just how Technical Manager deep the rabbit hole goes. (http://www.uk.freebsd.org) Pavilion Internet plc. [joe@pavilion.net, joe@freebsd.org, joe@tao.org.uk] To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 6:12:44 2000 Delivered-To: freebsd-security@freebsd.org Received: from folly.informatik.uni-erlangen.de (muedi43-145-253-165-004.arcor-ip.net [145.253.165.4]) by hub.freebsd.org (Postfix) with ESMTP id 57D2F14A2F; Sun, 2 Jan 2000 06:12:14 -0800 (PST) (envelope-from markus.friedl@informatik.uni-erlangen.de) Received: by folly.informatik.uni-erlangen.de (Postfix, from userid 31451) id 91FE0B98; Sun, 2 Jan 2000 15:12:09 +0100 (CET) Date: Sun, 2 Jan 2000 15:12:08 +0100 From: Markus Friedl To: David Rankin Cc: Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000102151208.A21548@folly.informatik.uni-erlangen.de> References: <20000101235721.A15256@alcove.wittsend.com> <20000102061545.A1691@rumpole.bohemians.lexington.ky.us> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.7i In-Reply-To: <20000102061545.A1691@rumpole.bohemians.lexington.ky.us> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, Jan 02, 2000 at 06:15:48AM -0500, David Rankin wrote: > Speaking completely without facts, I am personally skeptical about > enhancing the 1.x protocol when all of the standards processes are > focused on getting 2.0 out the door. That said, I am willing to be > convinced on the matter. i have put the latest revisions of my SSH 1.6 patches to http://wwwcip.informatik.uni-erlangen.de/~msfriedl/openssh/ basically they consist of: (1) CRC is replaced with hmac-sha1 + sequence-numbers. the bytes needed for the hmac-key are taken from the shared session-key (2) authentication for parameters passed in the clear: the session-id is extended from session_id := MD5 (host_key_n |session_key_n|cookie); to session_id := MD5 (host_key_n |session_key_n| supported_ciphers|supported_authentications| client_flags|server_flags| client_version_string|server_version_string| cookie); and yes, having openssh speak SSH-2.0 would be nice. mail me if you are interested in helping implement 2.0. -markus To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 9:20:56 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.rpi.edu (mail.rpi.edu [128.113.100.7]) by hub.freebsd.org (Postfix) with ESMTP id 21ABB14D6D; Sun, 2 Jan 2000 09:20:54 -0800 (PST) (envelope-from drosih@rpi.edu) Received: from [128.113.24.47] (gilead.acs.rpi.edu [128.113.24.47]) by mail.rpi.edu (8.9.3/8.9.3) with ESMTP id MAA78936; Sun, 2 Jan 2000 12:20:52 -0500 Mime-Version: 1.0 X-Sender: drosih@mail.rpi.edu Message-Id: In-Reply-To: <20000101143951.A4719@osaka.louisville.edu> References: <20000101143951.A4719@osaka.louisville.edu> Date: Sun, 2 Jan 2000 12:20:34 -0500 To: Brian Fundakowski Feldman From: Garance A Drosihn Subject: Re: OpenSSH protocol 1.6 proposal Cc: security@FreeBSD.ORG Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 2:39 PM -0500 1/1/00, Keith Stevenson wrote: >On Sat, Jan 01, 2000 at 01:49:22PM -0500, Brian Fundakowski Feldman wrote: > > Let me know what you all think! > > >First of all, allow me to thank you for all of the work you have done >maintaining OpenSSH for FreeBSD. I am looking forward to its entry >into the base tree. (I'm also planning to convert from SSH to OpenSSH >on all my systems as soon as it is feasible.) > >That said, the prospect of having a FreeBSD specific branch of OpenSSH >disturbs me. I manage an extremely heterogeneous Unix environment and >eventually hope to have OpenSSH running an all of my systems. I wouldn't mind having a freebsd-specific branch of OpenSSH, but I am uneasy that this is being proposed so soon after OpenSSH appeared. They are still in the process of rapid development, and I'd like to see their work settle down a bit before the freebsd project decides it "must" branch. We've all lived with the deficiencies of the ssh1 protocol for several years now, and my guess is that we could live a few more months with it to see if openSSH gets something closer to the version 2 protocol working. I have a much bigger problem trying to interrupt a flood of output to my ssh session (due to cat-ing the wrong file, for instance), then I have with malicious interceptors trying playback attacks (or any other kind of attacks). A control-channel for interrupts would be of much more practical benefit to me. I am also uneasy about a fork at this time because I use ssh on multiple platforms. I do understand that your change is backward-compatible, but what good is an improvement which only happens between a half-dozen freebsd boxes I have, if it isn't going to be on the 300-400 aix, irix, and solaris boxes which is where I'm making most of my connections to? I have some optimism that the OpenSSH project will track cross-platform issues (maybe not "supreme confidence", but "optimism"). If freebsd is going to fork so soon, is it also going to track cross-platform issues? My guess is "they won't be a priority". The actual change you're proposing seems fine to me (not that I'd know enough to debate the issues anyway...). I'm just uneasy that we couldn't let openssh settle down a bit before considering forks. (note that I'm also assuming that openSSH will find itself forking from the original protocols to address deficiencies, so I'd like any freebsd-version to catch those changes before adding more improvements). You asked what for our thoughts. The above are mine. Note that my thoughts are unrelated on how easy or hard it is to work with Theo, or much of anyone else on the planet. I'm not going to debate that topic at all, as that would certainly be an utterly fruitless debate. And as Keith noted, I do appreciate the work to get OpenSSH into the freebsd world so rapidly. --- Garance Alistair Drosehn = gad@eclipse.acs.rpi.edu Senior Systems Programmer or drosih@rpi.edu Rensselaer Polytechnic Institute To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 10: 5:25 2000 Delivered-To: freebsd-security@freebsd.org Received: from verdi.nethelp.no (verdi.nethelp.no [158.36.41.162]) by hub.freebsd.org (Postfix) with SMTP id 370E014EB3 for ; Sun, 2 Jan 2000 10:05:01 -0800 (PST) (envelope-from sthaug@nethelp.no) Received: (qmail 50875 invoked by uid 1001); 2 Jan 2000 18:04:58 +0000 (GMT) To: drosih@rpi.edu Cc: green@FreeBSD.ORG, security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal From: sthaug@nethelp.no In-Reply-To: Your message of "Sun, 2 Jan 2000 12:20:34 -0500" References: X-Mailer: Mew version 1.05+ on Emacs 19.34.2 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Date: Sun, 02 Jan 2000 19:04:58 +0100 Message-ID: <50873.946836298@verdi.nethelp.no> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > We've all lived with the deficiencies of the ssh1 protocol for several > years now, and my guess is that we could live a few more months with it > to see if openSSH gets something closer to the version 2 protocol working. > I have a much bigger problem trying to interrupt a flood of output to my > ssh session (due to cat-ing the wrong file, for instance), then I have > with malicious interceptors trying playback attacks (or any other kind > of attacks). A control-channel for interrupts would be of much more > practical benefit to me. Agreed. > I am also uneasy about a fork at this time because I use ssh on multiple > platforms. I do understand that your change is backward-compatible, > but what good is an improvement which only happens between a half-dozen > freebsd boxes I have, if it isn't going to be on the 300-400 aix, irix, > and solaris boxes which is where I'm making most of my connections to? > I have some optimism that the OpenSSH project will track cross-platform > issues (maybe not "supreme confidence", but "optimism"). If freebsd is > going to fork so soon, is it also going to track cross-platform issues? > My guess is "they won't be a priority". These thoughts echo my own pretty well. I use SSH on a lot of machines and platforms - and I can safely say that a FreeBSD-specific version would *not* be used (this despite FreeBSD being my preferred platform). Interoperability, plus having the same features on all platforms, are the important points here. Steinar Haug, Nethelp consulting, sthaug@nethelp.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 11:46:58 2000 Delivered-To: freebsd-security@freebsd.org Received: from hellohost (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id 6871A14DC1; Sun, 2 Jan 2000 11:46:53 -0800 (PST) (envelope-from green@FreeBSD.org) Date: Sun, 2 Jan 2000 14:46:49 -0500 (EST) From: Brian Fundakowski Feldman X-Sender: green@green.dyndns.org To: Markus Friedl Cc: David Rankin , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: <20000102151208.A21548@folly.informatik.uni-erlangen.de> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, 2 Jan 2000, Markus Friedl wrote: > On Sun, Jan 02, 2000 at 06:15:48AM -0500, David Rankin wrote: > > Speaking completely without facts, I am personally skeptical about > > enhancing the 1.x protocol when all of the standards processes are > > focused on getting 2.0 out the door. That said, I am willing to be > > convinced on the matter. > > i have put the latest revisions of my SSH 1.6 patches to > http://wwwcip.informatik.uni-erlangen.de/~msfriedl/openssh/ My concern here is, how much does it convolute the code? I believe that it's probably not as useful to make the old SSH 1.X protocol as infinitely more secure as it is useful to make OpenSSH support the 2.X protocol. > > basically they consist of: > (1) CRC is replaced with hmac-sha1 + sequence-numbers. the bytes > needed for the hmac-key are taken from the shared session-key I really don't see why we should need sequence numbers if we do a continuous SHA-1 hash of the entire stream. Are you proposing just one use per SHA_CTX, each packet having its own independent hash and sequence number? > (2) authentication for parameters passed in the clear: the session-id > is extended from > session_id := MD5 (host_key_n |session_key_n|cookie); > to > session_id := MD5 (host_key_n |session_key_n| > supported_ciphers|supported_authentications| > client_flags|server_flags| > client_version_string|server_version_string| > cookie); That does sound better, although I wouldn't know ow much better than before. > > and yes, having openssh speak SSH-2.0 would be nice. > mail me if you are interested in helping implement 2.0. Of course! > > -markus > -- Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / green@FreeBSD.org `------------------------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 14:12: 3 2000 Delivered-To: freebsd-security@freebsd.org Received: from folly.informatik.uni-erlangen.de (nbgdi3-145-253-131-130.arcor-ip.net [145.253.131.130]) by hub.freebsd.org (Postfix) with ESMTP id 8202A14D24; Sun, 2 Jan 2000 14:11:59 -0800 (PST) (envelope-from markus.friedl@informatik.uni-erlangen.de) Received: by folly.informatik.uni-erlangen.de (Postfix, from userid 31451) id B383AC00; Sun, 2 Jan 2000 23:11:47 +0100 (CET) Date: Sun, 2 Jan 2000 23:11:46 +0100 From: Markus Friedl To: Brian Fundakowski Feldman Cc: David Rankin , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org, niels@openbsd.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000102231146.C10118@folly.informatik.uni-erlangen.de> References: <20000102151208.A21548@folly.informatik.uni-erlangen.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.7i In-Reply-To: Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, Jan 02, 2000 at 02:46:49PM -0500, Brian Fundakowski Feldman wrote: > My concern here is, how much does it convolute the code? I believe > that it's probably not as useful to make the old SSH 1.X protocol > as infinitely more secure as it is useful to make OpenSSH support > the 2.X protocol. i don't think the patch 'convolutes' the code, it just replaces the CRC with a real authenticating MAC, hmac-sha1 in this case. > I really don't see why we should need sequence numbers if we do > a continuous SHA-1 hash of the entire stream. Are you proposing > just one use per SHA_CTX, each packet having its own independent > hash and sequence number? yes, each packet has an independent MAC that depends on the current packet and current packet number. this number is not transmitted. i don't know a protocol that uses a continuous hash for authentication. both ipsec and ssh2 use hmacs. usage of hmac is common practice for authentication (hmac-sha1 is required for SSH2). > > session_id := MD5 (host_key_n |session_key_n| > > supported_ciphers|supported_authentications| > > client_flags|server_flags| > > client_version_string|server_version_string| > > cookie); > > That does sound better, although I wouldn't know ow much better than > before. it _authenticates_ the cleartext parameters that are transmitted before the session key can be used for authentication/encrytion. -markus To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 22:17:10 2000 Delivered-To: freebsd-security@freebsd.org Received: from bsdie.rwsystems.net (bsdie.rwsystems.net [209.197.223.2]) by hub.freebsd.org (Postfix) with ESMTP id 82157150D7; Sun, 2 Jan 2000 22:17:07 -0800 (PST) (envelope-from jwyatt@rwsystems.net) Received: from bsdie.rwsystems.net([209.197.223.2]) (1768 bytes) by bsdie.rwsystems.net via sendmail with P:esmtp/R:bind_hosts/T:inet_zone_bind_smtp (sender: ) id for ; Mon, 3 Jan 2000 00:12:02 -0600 (CST) (Smail-3.2.0.106 1999-Mar-31 #1 built 1999-Aug-7) Date: Mon, 3 Jan 2000 00:12:02 -0600 (CST) From: James Wyatt To: Garance A Drosihn Cc: Brian Fundakowski Feldman , security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, 2 Jan 2000, Garance A Drosihn wrote: [ ... ] > I have some optimism that the OpenSSH project will track cross-platform > issues (maybe not "supreme confidence", but "optimism"). If freebsd is > going to fork so soon, is it also going to track cross-platform issues? > My guess is "they won't be a priority". I would like for the OpenSSH developers to feel their work to support FreeBSD is appreciated and needed. I don't *ever* like hearing "Oh, we don't have to support that platform, they do things *their* way." because everyone loses those optimizations. 8{( I also have AIX/NT/Linux machines to interconnect, so I want a good common tool. That aside, I *like* the change. I'm also of the mind to watch the OpenSSH folks for a bit. Strong, open cross-platform security is a very laudable and worthwhile goal and I see what looks like a good start with wide support inclusive of FreeBSD. Having never had contact with him, I can make no Theo-rhetorical comments either. 8{) I've worked on teams with personality disorders and have seen too many sides to given conversations to speculate. My two bits, one paragraph each - Jy@ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 22:53:37 2000 Delivered-To: freebsd-security@freebsd.org Received: from coconut.itojun.org (coconut.itojun.org [210.160.95.97]) by hub.freebsd.org (Postfix) with ESMTP id 42F5D14D34 for ; Sun, 2 Jan 2000 22:53:28 -0800 (PST) (envelope-from itojun@itojun.org) Received: from kiwi.itojun.org (localhost.itojun.org [127.0.0.1]) by coconut.itojun.org (8.9.3+3.2W/3.7W) with ESMTP id PAA24851; Mon, 3 Jan 2000 15:53:21 +0900 (JST) To: Garance A Drosihn Cc: security@FreeBSD.ORG In-reply-to: drosih's message of Sun, 02 Jan 2000 12:20:34 EST. X-Template-Reply-To: itojun@itojun.org X-Template-Return-Receipt-To: itojun@itojun.org X-PGP-Fingerprint: F8 24 B4 2C 8C 98 57 FD 90 5F B4 60 79 54 16 E2 Subject: Re: OpenSSH protocol 1.6 proposal From: itojun@iijlab.net Date: Mon, 03 Jan 2000 15:53:21 +0900 Message-ID: <24849.946882401@coconut.itojun.org> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >>First of all, allow me to thank you for all of the work you have done >>maintaining OpenSSH for FreeBSD. I am looking forward to its entry >>into the base tree. (I'm also planning to convert from SSH to OpenSSH >>on all my systems as soon as it is feasible.) >> >>That said, the prospect of having a FreeBSD specific branch of OpenSSH >>disturbs me. I manage an extremely heterogeneous Unix environment and >>eventually hope to have OpenSSH running an all of my systems. I'm not sure which one to add my $0.02, but anyway I throw in mine. *Please do not split, or make freebsd branch on, openssh repository.* Splitting repository will chew up developers time by merging efforts, patching back and forth, and other branch-synchronize-again efforts. Use developers' time for real development, not for repository synchronization. Brian, make sure your changes go back to openssh repository (openbsd src/usr.bin/ssh), and not anywhere else. Make sure you work with openssh people. If you have problem (personal, framewar, whatever) directly contacting openssh guys, try to find someone help you do that. I have no particular opinion about protocol improvement, but please be sure to (1) get your change reviewed by as many guys as you can before go in (of course, including openssh folks) as it is security protocol issue, and (2) make sure the change directly go back to openssh repository, not other place. I personally have no problem talking with theo. I agree I've seen him react to emails with strong word sometimes (to me and to others), but once you understand his concern and what he cares about (security and robustness I believe, but I may be wrong) communication becomes much easier. $0.02 from a guy burnt his lifetime with multiple *BSD IPv6 support:-) (*every* tiny little difference between *BSD really killing us!) itojun To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 22:55:26 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.cybcon.com (mail.cybcon.com [216.190.188.5]) by hub.freebsd.org (Postfix) with ESMTP id 95D841524D; Sun, 2 Jan 2000 22:55:24 -0800 (PST) (envelope-from freebsd@cybcon.com) Received: from laptop.cybcon.com (william@usr1-11.cybcon.com [205.147.75.12]) by mail.cybcon.com (8.9.3/8.9.3) with ESMTP id WAA07863; Sun, 2 Jan 2000 22:54:46 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.0 on FreeBSD X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Sun, 02 Jan 2000 22:56:10 -0800 (PST) From: William Woods To: James Wyatt Subject: Re: OpenSSH protocol 1.6 proposal Cc: security@FreeBSD.ORG, Brian Fundakowski Feldman , Garance A Drosihn Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Please dont flame me for this, but I would like to know which is reccomened, ssh1 ssh2 openssh I do a lot of remote work and clients dont like haveint Telnet open and would like to use ssh, I would like to reccomend the best solution...which, in your opinion is the best. ---------------------------------- E-Mail: William Woods Date: 02-Jan-00 Time: 22:54:29 FreeBSD 3.4 ---------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sun Jan 2 23:28:42 2000 Delivered-To: freebsd-security@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id 5EE6D14D0F; Sun, 2 Jan 2000 23:28:40 -0800 (PST) (envelope-from robert@cyrus.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.9.3/8.9.3) with SMTP id CAA07950; Mon, 3 Jan 2000 02:28:33 -0500 (EST) (envelope-from robert@cyrus.watson.org) Date: Mon, 3 Jan 2000 02:28:33 -0500 (EST) From: Robert Watson X-Sender: robert@fledge.watson.org Reply-To: Robert Watson To: David Rankin Cc: Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: <20000102061545.A1691@rumpole.bohemians.lexington.ky.us> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, 2 Jan 2000, David Rankin wrote: > Speaking completely without facts, I am personally skeptical about > enhancing the 1.x protocol when all of the standards processes are > focused on getting 2.0 out the door. That said, I am willing to be > convinced on the matter. I agree entirely. I'd love to see a free, BSD-licensed, SSH 2.x implementation out there. The continuing emphasis on improving the non-standard, albeit widely deployed, SSH 1.x protocol seems to be a less useful allocation of resources. While a free version of 1.x is extremely useful, it's not the end-all. :-) If you can get people to upgrade to modified 1.x with backwards compatibility, wouldn't you be better served getting them to upgrade to 2.x with backwards compatibility? :-) Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 0:31:28 2000 Delivered-To: freebsd-security@freebsd.org Received: from toad.mindrot.org (intern12.lnk.telstra.net [139.130.53.38]) by hub.freebsd.org (Postfix) with ESMTP id 8BB1C14E97; Mon, 3 Jan 2000 00:31:19 -0800 (PST) (envelope-from djm@mindrot.org) Received: from mothra.mindrot.org (mothra.mindrot.org [203.36.198.97]) by toad.mindrot.org (Postfix) with ESMTP id 84AB026F90; Mon, 3 Jan 2000 19:31:06 +1100 (EST) Received: by mothra.mindrot.org (Postfix, from userid 500) id E190827444; Mon, 3 Jan 2000 19:31:02 +1100 (EST) Received: from localhost (localhost [127.0.0.1]) by mothra.mindrot.org (Postfix) with ESMTP id C9DE21792C; Mon, 3 Jan 2000 19:31:02 +1100 (EST) Date: Mon, 3 Jan 2000 19:30:58 +1100 (EST) From: Damien Miller To: Robert Watson Cc: David Rankin , Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: Message-ID: X-Paranoia: just because you're paranoid doesn't mean they aren't out to get you MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mon, 3 Jan 2000, Robert Watson wrote: > I agree entirely. I'd love to see a free, BSD-licensed, SSH 2.x > implementation out there. The continuing emphasis on improving the > non-standard, albeit widely deployed, SSH 1.x protocol seems to be > a less useful allocation of resources. While a free version of 1.x > is extremely useful, it's not the end-all. :-) If you can get people > to upgrade to modified 1.x with backwards compatibility, wouldn't > you be better served getting them to upgrade to 2.x with backwards > compatibility? :-) While I agree that a free version of SSH 2.x is a worthwhile goal, it will take _months_ of effort (of course I would be happy to be proved wrong on this). We already have a strong SSH 1.x implementation, why not clean up its few remaining nits (which may take only weeks)? Apart from standards-compliance, what does SSH2 buy you over a cleaned up SSH1? Regards, Damien Miller - -- | "Bombay is 250ms from New York in the new world order" - Alan Cox | Damien Miller - http://www.mindrot.org/ | Email: djm@mindrot.org (home) -or- djm@ibs.com.au (work) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE4cF5GormJ9RG1dI8RAooeAKCz3U4Riz1CL1ikvlWVfkTdZAU0MQCfcli1 mMn9rFYT50BnvFFIKEFZDiY= =bL3g -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 1:49:12 2000 Delivered-To: freebsd-security@freebsd.org Received: from citi.umich.edu (citi.umich.edu [141.211.92.141]) by hub.freebsd.org (Postfix) with SMTP id C359414FB2 for ; Mon, 3 Jan 2000 01:49:10 -0800 (PST) (envelope-from provos@citi.umich.edu) Received: from citi.umich.edu [141.211.92.147] by citi.umich.edu for robert+freebsd@cyrus.watson.org drankin@bohemians.lexington.ky.us green@FreeBSD.org mhw@wittsend.com dugsong@monkey.org security@FreeBSD.org openssh-unix-dev@mindrot.org with SMTP; Mon, 03 Jan 100 04:48:09 -0500 From: Niels Provos To: Robert Watson Cc: David Rankin , Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Date: Mon, 03 Jan 2000 04:48:09 -0500 Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: Robert Watson, Mon, 03 Jan 2000 02:28:33 EST Message-Id: <20000103094910.C359414FB2@hub.freebsd.org> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message , Robert Watson writes: >I agree entirely. I'd love to see a free, BSD-licensed, SSH 2.x >implementation out there. The continuing emphasis on improving the >non-standard, albeit widely deployed, SSH 1.x protocol seems to be a less >useful allocation of resources. While a free version of 1.x is extremely >useful, it's not the end-all. :-) If you can get people to upgrade to Actually, Markus' modifications for the 1.6 protocol contain elements that may be reused in a SSH 2.x implementation. I would not call it a waste of time at all. The diff is rather small, more a necessary cleanup. Greetings, Niels. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 5: 0: 2 2000 Delivered-To: freebsd-security@freebsd.org Received: from camelot.netcom.net.uk (camelot.netcom.net.uk [194.42.225.1]) by hub.freebsd.org (Postfix) with ESMTP id F216715134 for ; Mon, 3 Jan 2000 04:59:55 -0800 (PST) (envelope-from phil@hands.com) Received: from fist.hands.com (dialup-14-11.netcomuk.co.uk [194.42.231.139]) by camelot.netcom.net.uk (8.8.8/8.8.8) with SMTP id MAA13812 for ; Mon, 3 Jan 2000 12:59:53 GMT Received: (qmail 32557 invoked from network); 3 Jan 2000 13:35:04 -0000 Received: from sheikh-dmz.hands.com (HELO sheikh.hands.com) (qmailr@193.195.34.10) by fist.hands.com with SMTP; 3 Jan 2000 13:35:03 -0000 Received: (qmail 13712 invoked by uid 1000); 3 Jan 2000 13:00:12 -0000 To: Markus Friedl Cc: David Rankin , Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal References: <20000101235721.A15256@alcove.wittsend.com> <20000102061545.A1691@rumpole.bohemians.lexington.ky.us> <20000102151208.A21548@folly.informatik.uni-erlangen.de> From: Philip Hands Date: 03 Jan 2000 13:00:11 +0000 In-Reply-To: <20000102151208.A21548@folly.informatik.uni-erlangen.de> (Markus Friedl's message of "Sun, 2 Jan 2000 15:12:08 +0100") Message-ID: <87g0wfmht0.fsf@sheikh.hands.com> Lines: 24 User-Agent: T-gnus/6.13.3 (based on Pterodactyl Gnus v0.98) Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Markus Friedl writes: > On Sun, Jan 02, 2000 at 06:15:48AM -0500, David Rankin wrote: > > Speaking completely without facts, I am personally skeptical about > > enhancing the 1.x protocol when all of the standards processes are > > focused on getting 2.0 out the door. That said, I am willing to be > > convinced on the matter. > > i have put the latest revisions of my SSH 1.6 patches to > http://wwwcip.informatik.uni-erlangen.de/~msfriedl/openssh/ Quick question. Does this fall foul of this clause in the license: Any derived versions of this software must be clearly marked as such, and if the derived work is incompatible with the protocol description in the RFC file, it must be called by a name other than "ssh" or "Secure Shell". If so, are these new features worth losing the right to call the executable ssh? Cheers, Phil. -- Boycott Amazon! --- http://linuxtoday.com/stories/13652.html To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 5:21:36 2000 Delivered-To: freebsd-security@freebsd.org Received: from ns1.yes.no (ns1.yes.no [195.204.136.10]) by hub.freebsd.org (Postfix) with ESMTP id 62C4F152E3; Mon, 3 Jan 2000 05:21:22 -0800 (PST) (envelope-from eivind@bitbox.follo.net) Received: from bitbox.follo.net (bitbox.follo.net [195.204.143.218]) by ns1.yes.no (8.9.3/8.9.3) with ESMTP id OAA08288; Mon, 3 Jan 2000 14:20:52 +0100 (CET) Received: (from eivind@localhost) by bitbox.follo.net (8.8.8/8.8.6) id OAA06485; Mon, 3 Jan 2000 14:20:51 +0100 (MET) Date: Mon, 3 Jan 2000 14:20:51 +0100 From: Eivind Eklund To: Damien Miller Cc: Brian Fundakowski Feldman , security@FreeBSD.ORG, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000103142050.B6173@bitbox.follo.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: ; from djm@mindrot.org on Mon, Jan 03, 2000 at 07:30:58PM +1100 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, Jan 03, 2000 at 07:30:58PM +1100, Damien Miller wrote: > Apart from standards-compliance, what does SSH2 buy you over a cleaned > up SSH1? Functional support for challenge/response authentication, at least. When I looked, I could not find any good way to add this to the 1.x protocol. I think it still doesn't fix my biggest beef with ssh, though: Agent forwarding. The implementation of this in SSH essensially gives out access for all your accounts to all machines you log into with * no logs * no way of restricting who gets authenticated (beyond turning a-f off) * no way for the machine having the original authentication to verify who is asking for authentication and for what purpose (where to log into) * a default of sending out agent forwarding * no way to change the default and still selectively forward The patches for the latter two problems are trivial; I'm including them below for completeness. Fixing the other problems is not as easy (it require a bit of thought and several orders of magnitude more coding); if anybody wants to do this, contact me and I'll send you an outline for how get a reasonable implementation, including backwards compatibility (allows the enhancements to be used securely even when forwarding through servers that have not got support for the enhancements.) Eivind. Central patch, to make it possible to selectively enable agent forwarding: --- ssh.c.orig Wed May 12 13:19:28 1999 +++ ssh.c Sat Nov 6 20:50:55 1999 @@ -280,6 +280,7 @@ fprintf(stderr, " -l user Log in using this user name.\n"); fprintf(stderr, " -n Redirect input from /dev/null.\n"); fprintf(stderr, " -a Disable authentication agent forwarding.\n"); + fprintf(stderr, " -A Enable authentication agent forwarding.\n"); #if defined(KERBEROS_TGT_PASSING) && defined(KRB5) fprintf(stderr, " -k Disable Kerberos ticket passing.\n"); #endif /* defined(KERBEROS_TGT_PASSING) && defined(KRB5) */ @@ -537,6 +538,10 @@ case 'a': options.forward_agent = 0; + break; + + case 'A': + options.forward_agent = 1; break; case 'k': Change the default to the correct (security rule #1: Disable everything, enable what you need.) --- readconf.c.orig Wed May 12 13:19:27 1999 +++ readconf.c Sat Nov 6 20:47:49 1999 @@ -716,7 +716,7 @@ void fill_default_options(Options *options) { if (options->forward_agent == -1) - options->forward_agent = 1; + options->forward_agent = 0; if (options->forward_x11 == -1) options->forward_x11 = 1; if (options->rhosts_authentication == -1) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 5:24:38 2000 Delivered-To: freebsd-security@freebsd.org Received: from ns1.yes.no (ns1.yes.no [195.204.136.10]) by hub.freebsd.org (Postfix) with ESMTP id 9FACC15353 for ; Mon, 3 Jan 2000 05:24:32 -0800 (PST) (envelope-from eivind@bitbox.follo.net) Received: from bitbox.follo.net (bitbox.follo.net [195.204.143.218]) by ns1.yes.no (8.9.3/8.9.3) with ESMTP id OAA08343; Mon, 3 Jan 2000 14:24:05 +0100 (CET) Received: (from eivind@localhost) by bitbox.follo.net (8.8.8/8.8.6) id OAA06498; Mon, 3 Jan 2000 14:24:05 +0100 (MET) Date: Mon, 3 Jan 2000 14:24:05 +0100 From: Eivind Eklund To: Philip Hands Cc: security@FreeBSD.ORG, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000103142405.C6173@bitbox.follo.net> References: <20000101235721.A15256@alcove.wittsend.com> <20000102061545.A1691@rumpole.bohemians.lexington.ky.us> <20000102151208.A21548@folly.informatik.uni-erlangen.de> <87g0wfmht0.fsf@sheikh.hands.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <87g0wfmht0.fsf@sheikh.hands.com>; from phil@hands.com on Mon, Jan 03, 2000 at 01:00:11PM +0000 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, Jan 03, 2000 at 01:00:11PM +0000, Philip Hands wrote: > Markus Friedl writes: > > > On Sun, Jan 02, 2000 at 06:15:48AM -0500, David Rankin wrote: > > > Speaking completely without facts, I am personally skeptical about > > > enhancing the 1.x protocol when all of the standards processes are > > > focused on getting 2.0 out the door. That said, I am willing to be > > > convinced on the matter. > > > > i have put the latest revisions of my SSH 1.6 patches to > > http://wwwcip.informatik.uni-erlangen.de/~msfriedl/openssh/ > > Quick question. Does this fall foul of this clause in the license: > > Any derived versions of this software must be clearly marked as > such, and if the derived work is incompatible with the protocol > description in the RFC file, it must be called by a name other than > "ssh" or "Secure Shell". IANAL - but in my interpretation, no. It stays compatible; it just can negotiate higher security. Eivind. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 6:13:26 2000 Delivered-To: freebsd-security@freebsd.org Received: from hilda.bohemians.lexington.ky.us (hilda.bohemians.lexington.ky.us [207.246.92.4]) by hub.freebsd.org (Postfix) with ESMTP id 7D86214A08; Mon, 3 Jan 2000 06:12:36 -0800 (PST) (envelope-from drankin@bohemians.lexington.ky.us) Received: from rumpole.bohemians.lexington.ky.us (rumpole.bohemians.lexington.ky.us [207.246.92.3]) by hilda.bohemians.lexington.ky.us (8.9.3/8.9.3) with ESMTP id GAA26907; Mon, 3 Jan 2000 06:11:56 -0800 (PST) Received: (from drankin@localhost) by rumpole.bohemians.lexington.ky.us (8.9.3/8.9.3) id JAA03820; Mon, 3 Jan 2000 09:07:09 -0500 (EST) Date: Mon, 3 Jan 2000 09:07:08 -0500 From: David Rankin To: Damien Miller Cc: Robert Watson , David Rankin , Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000103090708.A3780@rumpole.bohemians.lexington.ky.us> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.6us In-Reply-To: ; from Damien Miller on Mon, Jan 03, 2000 at 07:30:58PM +1100 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, Jan 03, 2000 at 07:30:58PM +1100, Damien Miller wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > While I agree that a free version of SSH 2.x is a worthwhile goal, > it will take _months_ of effort (of course I would be happy to be > proved wrong on this). It's probably a 2-4 month job to take OpenSSH 1.2.1 and implement SSH 2.0 start to finish, but it could be significantly less. The main difference between 1.5 and 2.0 is the change in the transport protocol (and those aren't that major). All of the encryption changes (DSS/DSA, blowfish, etc.) are already in OpenSSL, with the exception of twofish. > We already have a strong SSH 1.x implementation, why not clean up its > few remaining nits (which may take only weeks)? Please don't get me wrong. I believe that OpenSSH 1.2.1 needs to be working now. I just happen to think that extending the SSH 1.5 protocol should yield to implementing the 2.0 protocol, especially where the 1.6 features are a subset of the 2.0 protocol. Of course IMHO. > Apart from standards-compliance, what does SSH2 buy you over a cleaned > up SSH1? I know it's been mentioned already, but the #1 is you can do PAM challenge/response authentication correctly. You can also handle "You must change your password" correctly. David -- David W. Rankin, Jr. Husband, Father, and UNIX Sysadmin. Email: drankin@bohemians.lexington.ky.us Address/Phone Number: Ask me. "It is no great thing to be humble when you are brought low; but to be humble when you are praised is a great and rare accomplishment." St. Bernard To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 6:32:36 2000 Delivered-To: freebsd-security@freebsd.org Received: from hilda.bohemians.lexington.ky.us (hilda.bohemians.lexington.ky.us [207.246.92.4]) by hub.freebsd.org (Postfix) with ESMTP id 2A83A15198; Mon, 3 Jan 2000 06:32:27 -0800 (PST) (envelope-from drankin@bohemians.lexington.ky.us) Received: from rumpole.bohemians.lexington.ky.us (rumpole.bohemians.lexington.ky.us [207.246.92.3]) by hilda.bohemians.lexington.ky.us (8.9.3/8.9.3) with ESMTP id GAA27391; Mon, 3 Jan 2000 06:32:20 -0800 (PST) Received: (from drankin@localhost) by rumpole.bohemians.lexington.ky.us (8.9.3/8.9.3) id JAA03836; Mon, 3 Jan 2000 09:27:34 -0500 (EST) Date: Mon, 3 Jan 2000 09:27:33 -0500 From: David Rankin To: Brian Fundakowski Feldman Cc: Markus Friedl , David Rankin , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000103092733.B3780@rumpole.bohemians.lexington.ky.us> References: <20000102151208.A21548@folly.informatik.uni-erlangen.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.6us In-Reply-To: ; from Brian Fundakowski Feldman on Sun, Jan 02, 2000 at 02:46:49PM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, Jan 02, 2000 at 02:46:49PM -0500, Brian Fundakowski Feldman wrote: > On Sun, 2 Jan 2000, Markus Friedl wrote: > > and yes, having openssh speak SSH-2.0 would be nice. > > mail me if you are interested in helping implement 2.0. > Of course! Since it looks like there's a significant interest in this, I propose that we look at an "OpenSSH 2" project. At this point, we need a mailing list. I'd love to host the list, but the US laws make that too painful for me should someone post encryption code. Once we get someone to make a list, I think we can start working on the details. No use flooding security@FreeBSD.org or openssh-dev-list with a lot of off-topic discussion (and can stop the monster CC:... :) David -- David W. Rankin, Jr. Husband, Father, and UNIX Sysadmin. Email: drankin@bohemians.lexington.ky.us Address/Phone Number: Ask me. "It is no great thing to be humble when you are brought low; but to be humble when you are praised is a great and rare accomplishment." St. Bernard To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 6:39:45 2000 Delivered-To: freebsd-security@freebsd.org Received: from ns1.via-net-works.net.ar (ns1.via-net-works.net.ar [200.10.100.10]) by hub.freebsd.org (Postfix) with ESMTP id 515BF15095; Mon, 3 Jan 2000 06:39:41 -0800 (PST) (envelope-from fpscha@ns1.via-net-works.net.ar) Received: (from fpscha@localhost) by ns1.via-net-works.net.ar (8.8.5/8.8.4) id LAA04124; Mon, 3 Jan 2000 11:37:44 -0300 (GMT) From: Fernando Schapachnik Message-Id: <200001031437.LAA04124@ns1.via-net-works.net.ar> Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: <20000103092733.B3780@rumpole.bohemians.lexington.ky.us> from David Rankin at "Jan 3, 0 09:27:33 am" To: drankin@bohemians.lexington.ky.us (David Rankin) Date: Mon, 3 Jan 2000 11:37:43 -0300 (GMT) Cc: green@FreeBSD.ORG, markus.friedl@informatik.uni-erlangen.de, drankin@bohemians.lexington.ky.us, mhw@wittsend.com, dugsong@monkey.org, security@FreeBSD.ORG, openssh-unix-dev@mindrot.org Reply-To: Fernando Schapachnik X-Mailer: ELM [version 2.4ME+ PL40 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I can host one. Please contact me privatedly for details. Regards! En un mensaje anterior, David Rankin escribió: > On Sun, Jan 02, 2000 at 02:46:49PM -0500, Brian Fundakowski Feldman wrote: > > On Sun, 2 Jan 2000, Markus Friedl wrote: > > > > and yes, having openssh speak SSH-2.0 would be nice. > > > mail me if you are interested in helping implement 2.0. > > > Of course! > > Since it looks like there's a significant interest in this, I propose > that we look at an "OpenSSH 2" project. At this point, we need a mailing > list. I'd love to host the list, but the US laws make that too painful for > me should someone post encryption code. Fernando P. Schapachnik Administración de la red VIA NET.WORKS ARGENTINA S.A. fernando@via-net-works.net.ar (54-11) 4323-3333 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 11:41:33 2000 Delivered-To: freebsd-security@freebsd.org Received: from camelot.netcom.net.uk (camelot.netcom.net.uk [194.42.225.1]) by hub.freebsd.org (Postfix) with ESMTP id 78E8214E01 for ; Mon, 3 Jan 2000 11:41:21 -0800 (PST) (envelope-from phil@hands.com) Received: from fist.hands.com (dialup-06-24.netcomuk.co.uk [194.42.229.152]) by camelot.netcom.net.uk (8.8.8/8.8.8) with SMTP id TAA15457 for ; Mon, 3 Jan 2000 19:41:07 GMT Received: (qmail 1786 invoked from network); 3 Jan 2000 20:16:21 -0000 Received: from sheikh-dmz.hands.com (HELO sheikh.hands.com) (qmailr@193.195.34.10) by fist.hands.com with SMTP; 3 Jan 2000 20:16:21 -0000 Received: (qmail 14999 invoked by uid 1000); 3 Jan 2000 19:41:27 -0000 To: Eivind Eklund Cc: Damien Miller , Brian Fundakowski Feldman , security@FreeBSD.ORG, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal References: <20000103142050.B6173@bitbox.follo.net> From: Philip Hands Date: 03 Jan 2000 19:41:27 +0000 In-Reply-To: <20000103142050.B6173@bitbox.follo.net> (Eivind Eklund's message of "Mon, 3 Jan 2000 14:20:51 +0100") Message-ID: <87d7rjkkns.fsf@sheikh.hands.com> Lines: 25 User-Agent: T-gnus/6.13.3 (based on Pterodactyl Gnus v0.98) Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Eivind Eklund writes: ... > * a default of sending out agent forwarding > * no way to change the default and still selectively forward > > The patches for the latter two problems are trivial; I'm including > them below for completeness. I've included this in the Debian packages of ssh and OpenSSH for some time. I also disable X forwarding by default, since that allows classic X attacks to be launched by untrustworthy remote systems. These patches should be accepted upstream IMO. As ever, my openssh stuff can be found here: http://www.hands.com/~phil/debian/openssh/openssh_1.2.1pre24-1.diff.gz I think all changes except the debian/ directory itself should be either useful or at worst harmless upstream. Cheers, Phil. -- Boycott Amazon! --- http://linuxtoday.com/stories/13652.html To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 12:21:40 2000 Delivered-To: freebsd-security@freebsd.org Received: from smtp.ntrnet.net (smtp.ntrnet.net [206.66.160.16]) by hub.freebsd.org (Postfix) with ESMTP id 30E95150DA; Mon, 3 Jan 2000 12:21:32 -0800 (PST) (envelope-from jmknoble@shell.ntrnet.net) Received: from mail.ntrnet.net (mail.ntrnet.net [206.66.160.4]) by smtp.ntrnet.net (Postfix) with ESMTP id 2F5BF1F057; Mon, 3 Jan 2000 15:21:31 -0500 (EST) Received: from shell.ntrnet.net (squid.ntrnet.net [206.66.160.7]) by mail.ntrnet.net (Postfix) with ESMTP id 1DFF176806; Mon, 3 Jan 2000 15:21:26 -0500 (EST) Received: (from jmknoble@localhost) by shell.ntrnet.net (8.8.5/8.8.5) id PAA18984; Mon, 3 Jan 2000 15:21:13 -0500 Message-ID: <20000103152112.C18625@ntrnet.net> Date: Mon, 3 Jan 2000 15:21:12 -0500 From: Jim Knoble To: David Rankin , Brian Fundakowski Feldman Cc: Markus Friedl , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Reply-To: Jim Knoble Mail-Followup-To: David Rankin , Brian Fundakowski Feldman , Markus Friedl , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org References: <20000102151208.A21548@folly.informatik.uni-erlangen.de> <20000103092733.B3780@rumpole.bohemians.lexington.ky.us> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Mailer: Mutt 0.93.2i In-Reply-To: <20000103092733.B3780@rumpole.bohemians.lexington.ky.us>; from David Rankin on Mon, Jan 03, 2000 at 09:27:33AM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Is there a reason why we ought not to use openssh-unix-dev? It's already here, and i suspect most folks on the list would be interested in an SSH-Protocol-2.0 implementation. I don't particularly think it's off-topic, either (except for the bit about whether certain folks can be communicated with effectively). -- jim knoble jmknoble@pobox.com På 2000-Jan-03 klokka 09:27:33 -0500 skrivet David Rankin: : Since it looks like there's a significant interest in this, I propose : that we look at an "OpenSSH 2" project. At this point, we need a mailing : list. I'd love to host the list, but the US laws make that too painful for : me should someone post encryption code. : : Once we get someone to make a list, I think we can start working on : the details. No use flooding security@FreeBSD.org or openssh-dev-list : with a lot of off-topic discussion (and can stop the monster CC:... :) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 13:25:52 2000 Delivered-To: freebsd-security@freebsd.org Received: from hilda.bohemians.lexington.ky.us (hilda.bohemians.lexington.ky.us [207.246.92.4]) by hub.freebsd.org (Postfix) with ESMTP id 9992F14E78; Mon, 3 Jan 2000 13:25:43 -0800 (PST) (envelope-from drankin@bohemians.lexington.ky.us) Received: from rumpole.bohemians.lexington.ky.us (rumpole.bohemians.lexington.ky.us [207.246.92.3]) by hilda.bohemians.lexington.ky.us (8.9.3/8.9.3) with ESMTP id NAA17120; Mon, 3 Jan 2000 13:25:35 -0800 (PST) Received: (from drankin@localhost) by rumpole.bohemians.lexington.ky.us (8.9.3/8.9.3) id QAA04302; Mon, 3 Jan 2000 16:20:49 -0500 (EST) Date: Mon, 3 Jan 2000 16:20:48 -0500 From: David Rankin To: Jim Knoble Cc: Markus Friedl , security@FreeBSD.org, openssh-unix-dev@mindrot.org, Brian Fundakowski Feldman Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000103162048.A4248@rumpole.bohemians.lexington.ky.us> References: <20000102151208.A21548@folly.informatik.uni-erlangen.de> <20000103092733.B3780@rumpole.bohemians.lexington.ky.us> <20000103152112.C18625@ntrnet.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.6us In-Reply-To: <20000103152112.C18625@ntrnet.net>; from Jim Knoble on Mon, Jan 03, 2000 at 03:21:12PM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, Jan 03, 2000 at 03:21:12PM -0500, Jim Knoble wrote: > Is there a reason why we ought not to use openssh-unix-dev? It's > already here, and i suspect most folks on the list would be interested > in an SSH-Protocol-2.0 implementation. I don't particularly think it's > off-topic, either (except for the bit about whether certain folks can > be communicated with effectively). It's Damien's list, so his will be the deciding opinion, but IMHO openssh-unix-dev isn't the best place for the discussion since it's for development of the OpenSSH 1.2.1 port. OpenSSH 2.0 is going to be (at first) a design and organization effort that will interfere with the "daily business" of OpenSSH 1.2 on a shared list. Thanks, David -- David W. Rankin, Jr. Husband, Father, and UNIX Sysadmin. Email: drankin@bohemians.lexington.ky.us Address/Phone Number: Ask me. "It is no great thing to be humble when you are brought low; but to be humble when you are praised is a great and rare accomplishment." St. Bernard To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 14:30:11 2000 Delivered-To: freebsd-security@freebsd.org Received: from toad.mindrot.org (intern12.lnk.telstra.net [139.130.53.38]) by hub.freebsd.org (Postfix) with ESMTP id 5217914FA5; Mon, 3 Jan 2000 14:29:48 -0800 (PST) (envelope-from djm@mindrot.org) Received: from mothra.mindrot.org (mothra.mindrot.org [203.36.198.97]) by toad.mindrot.org (Postfix) with ESMTP id E203726FA7; Tue, 4 Jan 2000 09:29:45 +1100 (EST) Received: by mothra.mindrot.org (Postfix, from userid 500) id 5BE3527446; Tue, 4 Jan 2000 09:29:43 +1100 (EST) Received: from localhost (localhost [127.0.0.1]) by mothra.mindrot.org (Postfix) with ESMTP id 5A43617915; Tue, 4 Jan 2000 09:29:43 +1100 (EST) Date: Tue, 4 Jan 2000 09:29:39 +1100 (EST) From: Damien Miller To: David Rankin Cc: Jim Knoble , Markus Friedl , security@FreeBSD.org, openssh-unix-dev@mindrot.org, Brian Fundakowski Feldman Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: <20000103162048.A4248@rumpole.bohemians.lexington.ky.us> Message-ID: X-Paranoia: just because you're paranoid doesn't mean they aren't out to get you MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mon, 3 Jan 2000, David Rankin wrote: > It's Damien's list, so his will be the deciding opinion, but IMHO > openssh-unix-dev isn't the best place for the discussion since it's > for development of the OpenSSH 1.2.1 port. OpenSSH 2.0 is going to be > (at first) a design and organization effort that will interfere with the > "daily business" of OpenSSH 1.2 on a shared list. I don't mind discussions pertaining to the extension of OpenSSH to support SSH2. If they become too intrusive then we can move them to another list. Regards, Damien - -- | "Bombay is 250ms from New York in the new world order" - Alan Cox | Damien Miller - http://www.mindrot.org/ | Email: djm@mindrot.org (home) -or- djm@ibs.com.au (work) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE4cSLWormJ9RG1dI8RAgLRAKCB70v1PcF65o5nz5KZYIehwiVe0wCeJGQA 4EftSGVRBa6IBcmVZvPIRdg= =zxHc -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Mon Jan 3 14:49:45 2000 Delivered-To: freebsd-security@freebsd.org Received: from folly.informatik.uni-erlangen.de (nbgdi4-145-253-132-004.arcor-ip.net [145.253.132.4]) by hub.freebsd.org (Postfix) with ESMTP id A016C14C2B; Mon, 3 Jan 2000 14:49:41 -0800 (PST) (envelope-from markus.friedl@informatik.uni-erlangen.de) Received: by folly.informatik.uni-erlangen.de (Postfix, from userid 31451) id E8714B7F; Mon, 3 Jan 2000 23:49:31 +0100 (CET) Date: Mon, 3 Jan 2000 23:49:30 +0100 From: Markus Friedl To: David Rankin Cc: Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000103234930.A10240@folly.informatik.uni-erlangen.de> References: <20000102151208.A21548@folly.informatik.uni-erlangen.de> <20000103092733.B3780@rumpole.bohemians.lexington.ky.us> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.7i In-Reply-To: <20000103092733.B3780@rumpole.bohemians.lexington.ky.us> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I hope this is my last mail on this subject. All this discussion about SSH2 misses the fact that we are talking about a security product, so 'features' should not be overrated. Especially for ssh it should be remembered that "complexity is the enemy". You almost get my SSH1.6 for free. The patches consist of minor modifications that are supposed to makes SSH1 much more secure. Compare the code size of OpenSSH (~ 20.000 lines) with the code size of ssh-2.0.1x (~ 100.000 lines), an incarnation of SSH2. Do secure protocols leed to secure implementations? Security is also about trust. SSH1 is old, stable, venerable, widely used, reviewed and testetd. Thus it consists of trusted code. Minor modifications, e.g. SSH1.6, should not reduce trust. But what happens with major modifications, i.e. SSH2? Can you still trust the code? Or can you trust an entirely new implementation of a complex protocol? Wrt 'features': SSH1 has some support for challenge/response authentication, OpenSSH does s/key within the SSH1 framework. Wrt OpenSSH 2: I don't think we need a special mailing-list. If you know of the internals of OpenSSH and/or the SecSH-drafts and want to help implement SSH2, send private mail to me and I'll share my code fragements. But it's too soon for publication. If you want an implementation that does not use the old code: LSH speaks SSH2. cheers, -markus To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Tue Jan 4 9:43:38 2000 Delivered-To: freebsd-security@freebsd.org Received: from hilda.bohemians.lexington.ky.us (hilda.bohemians.lexington.ky.us [207.246.92.4]) by hub.freebsd.org (Postfix) with ESMTP id 23CCA15097; Tue, 4 Jan 2000 09:43:32 -0800 (PST) (envelope-from drankin@bohemians.lexington.ky.us) Received: from rumpole.bohemians.lexington.ky.us (rumpole.bohemians.lexington.ky.us [207.246.92.3]) by hilda.bohemians.lexington.ky.us (8.9.3/8.9.3) with ESMTP id JAA17875; Tue, 4 Jan 2000 09:43:09 -0800 (PST) Received: (from drankin@localhost) by rumpole.bohemians.lexington.ky.us (8.9.3/8.9.3) id MAA06230; Tue, 4 Jan 2000 12:38:23 -0500 (EST) Date: Tue, 4 Jan 2000 12:38:23 -0500 From: David Rankin To: Markus Friedl Cc: David Rankin , Brian Fundakowski Feldman , "Michael H. Warfield" , Dug Song , security@FreeBSD.org, openssh-unix-dev@mindrot.org Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000104123822.B6035@rumpole.bohemians.lexington.ky.us> References: <20000102151208.A21548@folly.informatik.uni-erlangen.de> <20000103092733.B3780@rumpole.bohemians.lexington.ky.us> <20000103234930.A10240@folly.informatik.uni-erlangen.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.6us In-Reply-To: <20000103234930.A10240@folly.informatik.uni-erlangen.de>; from Markus Friedl on Mon, Jan 03, 2000 at 11:49:30PM +0100 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I'll condense two different responses into one letter. Also, I have posted what I'd call a "draft action plan" for an OpenSSH 2.0 project to http://www.bohemians.lexington.ky.us/~drankin/openssh2.proposal for anyone interested to examine. I suggest that we limit further discussion of this thread to openssh-dev-list. Thanks, David On Mon, Jan 03, 2000 at 07:47:15PM +0000, Philip Hands wrote: > David Rankin writes: > > Once we get someone to make a list, I think we can start working on > > the details. No use flooding security@FreeBSD.org or openssh-dev-list > > with a lot of off-topic discussion (and can stop the monster CC:... :) > Would it not be better to attempt to get lsh finished off, since that > doesn't have any possible licensing problem related to the > protocol/name thing. So long as we maintain compatability with SSH 1.5, I don't think that there are licensing issues. This should be true even when/if SSH 2.0 support is included. As for lsh, I like what is already there, but there's a couple of fundamental design choices that I don't agree with in lsh. They are: 1> Lack of compatability with the SSH 1.5 protocol. This is of course the biggest issue for me. There are a ton of SSH 1.x implementations out there. 2> Non-forking server. A select() system is inherantly more complex than a fork/exec design. I can see a lightweight thread replacement for fork/exec, but not a monolithic non-forking server. > Cheers, Phil. On Mon, Jan 03, 2000 at 11:49:30PM +0100, Markus Friedl wrote: } I hope this is my last mail on this subject. All this discussion } about SSH2 misses the fact that we are talking about a security } product, so 'features' should not be overrated. } Especially for ssh it should be remembered that "complexity is the } enemy". You almost get my SSH1.6 for free. The patches consist } of minor modifications that are supposed to makes SSH1 much more } secure. Compare the code size of OpenSSH (~ 20.000 lines) with the } code size of ssh-2.0.1x (~ 100.000 lines), an incarnation of SSH2. } Do secure protocols leed to secure implementations? I wasn't aware of how close to completion your SSH 1.6 patches are. In this case, I think that it'd be a Good Thing(tm) to include them right after OpenSSH 1.2.1 is ready. Also, I'm not sure if comparing code lines is fair. OpenSSH + OpenSSL are more than ~20000 lines, although still not in the 100k range. That said, your point is valid: SSH 2.0 is more complex, and any SSH 2.0 implementation is also more complex. That means that it's going to be a while before OpenSSH 1.2 is obsolete. I agree with your SSH 1.6 proposal as an interim solution, possibly its completion driving OpenSSH 1.3. Thanks, David -- David W. Rankin, Jr. Husband, Father, and UNIX Sysadmin. Email: drankin@bohemians.lexington.ky.us Address/Phone Number: Ask me. "It is no great thing to be humble when you are brought low; but to be humble when you are praised is a great and rare accomplishment." St. Bernard To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Wed Jan 5 2: 9:48 2000 Delivered-To: freebsd-security@freebsd.org Received: from pogo.caustic.org (pogo.caustic.org [208.44.193.69]) by hub.freebsd.org (Postfix) with ESMTP id 094BD14CC4 for ; Wed, 5 Jan 2000 02:09:46 -0800 (PST) (envelope-from jan@caustic.org) Received: from localhost (jan@localhost) by pogo.caustic.org (8.9.3/ignatz) with ESMTP id CAA38346; Wed, 5 Jan 2000 02:09:57 -0800 (PST) Date: Wed, 5 Jan 2000 02:09:57 -0800 (PST) From: "f.johan.beisser" To: William Woods Cc: security@FreeBSD.ORG Subject: SSH recomendations - Re: OpenSSH protocol 1.6 proposal In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, 2 Jan 2000, William Woods wrote: > Please dont flame me for this, but I would like to know which is reccomened, > > ssh1 > ssh2 > openssh out of the three, i'd recommend ssh1. why? 1. tested, proven, stable. 2. no licensing issues, and the code doesn't change much 3. no major licensing restrictions. (read the licensing info in the source distribution first.) 4. Cross Platform Compatibility! > I do a lot of remote work and clients dont like haveint Telnet open and would > like to use ssh, I would like to reccomend the best solution...which, in your > opinion is the best. there ya go. my opinion on the ssh's. -- jan +-----// f. johan beisser //------------------------------+ email: jan[at]caustic.org web: http://www.caustic.org/~jan "knowledge is power. power corrupts. study hard, be evil." To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Wed Jan 5 2:23:15 2000 Delivered-To: freebsd-security@freebsd.org Received: from prioris.mini.pw.edu.pl (prioris.mini.pw.edu.pl [148.81.80.7]) by hub.freebsd.org (Postfix) with ESMTP id 7F0F315359 for ; Wed, 5 Jan 2000 02:23:09 -0800 (PST) (envelope-from zaks@prioris.im.pw.edu.pl) Received: from pf126.warszawa.ppp.tpnet.pl ([212.160.57.126]:3332 "EHLO pf126.warszawa.ppp.tpnet.pl") by prioris.mini.pw.edu.pl with ESMTP id ; Wed, 5 Jan 2000 11:22:37 +0100 Received: (from localhost user: 'zaks', uid#1000) by localhost.localnet id ; Wed, 5 Jan 2000 11:20:45 +0100 From: Slawek Zak To: Martti Kuparinen Cc: freebsd-security@freebsd.org Subject: Re: zero checksums in tripwire References: Mail-Copies-To: never Reply-To: zaks@prioris.im.pw.edu.pl Date: 05 Jan 2000 11:20:45 +0100 In-Reply-To: Martti Kuparinen's message of "Sun, 2 Jan 2000 11:23:09 +0200 (EET)" Message-ID: <87hfgsu8ea.fsf@localhost.localnet> Lines: 15 Organization: Ministerstwo smierci na wojnie User-Agent: Gnus/5.0802 (Gnus v5.8.2) XEmacs/21.1 (Bryce Canyon) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Martti Kuparinen writes: > Hi! > > I'm using tripwire-1.2 to check the filesystems for modifications. > Something weird happened today: [...] Tripwire-1.2 is not Y2K compliant. Upgrade to 1.3/2.x -- * Suavek Zak (Systems Administrator) * email: zaks@mini.pw.edu.pl voice: +48 (0) 22 674 66 79 * PGP v2.6: 2048/9A7CBF71, finger://zaks@prioris.mini.pw.edu.pl To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Wed Jan 5 6:46:59 2000 Delivered-To: freebsd-security@freebsd.org Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44]) by hub.freebsd.org (Postfix) with ESMTP id 14B5D153D2 for ; Wed, 5 Jan 2000 06:46:56 -0800 (PST) (envelope-from Cy.Schubert@uumail.gov.bc.ca) Received: (from daemon@localhost) by point.osg.gov.bc.ca (8.8.7/8.8.8) id GAA09501; Wed, 5 Jan 2000 06:46:23 -0800 Received: from passer.osg.gov.bc.ca(142.32.110.29) via SMTP by point.osg.gov.bc.ca, id smtpda09499; Wed Jan 5 06:46:11 2000 Received: (from uucp@localhost) by passer.osg.gov.bc.ca (8.9.3/8.9.1) id GAA40488; Wed, 5 Jan 2000 06:46:11 -0800 (PST) Received: from cwsys9.cwsent.com(10.2.2.1), claiming to be "cwsys.cwsent.com" via SMTP by passer9.cwsent.com, id smtpdd40486; Wed Jan 5 06:45:25 2000 Received: (from uucp@localhost) by cwsys.cwsent.com (8.9.3/8.9.1) id GAA30173; Wed, 5 Jan 2000 06:45:24 -0800 (PST) Message-Id: <200001051445.GAA30173@cwsys.cwsent.com> Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys" via SMTP by localhost.cwsent.com, id smtpdV30164; Wed Jan 5 06:44:46 2000 X-Mailer: exmh version 2.1.1 10/15/1999 Reply-To: Cy Schubert - ITSD Open Systems Group From: Cy Schubert - ITSD Open Systems Group X-OS: FreeBSD 3.4-RELEASE X-Sender: cy To: zaks@prioris.im.pw.edu.pl Cc: Martti Kuparinen , freebsd-security@FreeBSD.ORG Subject: Re: zero checksums in tripwire In-reply-to: Your message of "05 Jan 2000 11:20:45 +0100." <87hfgsu8ea.fsf@localhost.localnet> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Wed, 05 Jan 2000 06:44:46 -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message <87hfgsu8ea.fsf@localhost.localnet>, Slawek Zak writes: > Martti Kuparinen writes: > > > Hi! > > > > I'm using tripwire-1.2 to check the filesystems for modifications. > > Something weird happened today: > > [...] > > Tripwire-1.2 is not Y2K compliant. Upgrade to 1.3/2.x I submitted PR 14515 in October requesting the inclusion of Tripwire-1.3 in the ports collection. A shar archive of the port is in the PR. I've been using the Tripwire 1.3 "port" on FreeBSD for about 1.5 years. Yesterday I submitted PR 15893 (mhash-0.6.1) and 15894 (aide-0.5) requesting the inclusion of AIDE, Advanced Intrusion Detection Environment, a Tripwire clone, in the ports collection. Shar archives of the ports are in the PR's. In my discussions with Tripwire, they mentioned to me that since they do not have any plans to produce a version of their commercial Tripwire 2.0 for FreeBSD that I was free to use the academic Tripwire 1.3 on FreeBSD in a commercial environment. The copyright that comes with Tripwire 1.3 is: Tripwire(tm) Intrusion Detection Software v 1.3 July 15, 1998 COPYRIGHT NOTICE All files in this distribution of Tripwire(tm) are Copyright 1992-1998 by the Purdue Research Foundation of Purdue University and are distributed by Visual Computing Corporation under exclusive license arrangements. All rights reserved. Some individual files in this distribution may be covered by other copyrights, as noted in their embedded comments. This release is for single CPU, single-site, end-use purposes. Duplication is only allowed for the purposed of backup. Any other use of this software requires the prior written consent of Visual Computing Corporation. If this software is to be used on a Web site, the "Tripwire Protected" logo must be used on the site Home page along with appropriate copyright and trademark information. Neither the name of the University nor the names of the authors may be used to endorse or promote products derived from this material without specific prior written permission. THIS SOFTWARE IS PROVIDED AS IS AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR ANY PARTICULAR PURPOSE. I interpret the above copyright to read that you can use it in a any environment as long as you do not include it in a product or directly provide a service with it, e.g. charge for its use. Do I read it correctly? I think I do, however luckily I'm not a lawer. AIDE on the other hand has a GNU license. Regards, Phone: (250)387-8437 Cy Schubert Fax: (250)387-5766 Sun/DEC Team, UNIX Group Internet: Cy.Schubert@uumail.gov.bc.ca ITSD Province of BC "e**(i*pi)+1=0" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Wed Jan 5 7:41:53 2000 Delivered-To: freebsd-security@freebsd.org Received: from eltex.ru (ELTEX-2-SPIIRAS.nw.ru [195.19.204.46]) by hub.freebsd.org (Postfix) with ESMTP id 1E0B815386 for ; Wed, 5 Jan 2000 07:41:46 -0800 (PST) (envelope-from ark@eltex.ru) Received: from yaksha.eltex.ru (root@yaksha.eltex.ru [195.19.198.2]) by eltex.ru (8.9.3/8.9.3) with SMTP id SAA13546; Wed, 5 Jan 2000 18:41:06 +0300 (MSK) Received: by yaksha.eltex.ru (ssmtp TIS-0.5alpha, 19 Oct 1998); Wed, 5 Jan 2000 18:38:00 +0300 Received: from undisclosed-intranet-sender id xma023903; Wed, 5 Jan 00 17:23:36 +0300 Date: Wed, 5 Jan 2000 17:23:25 +0300 Message-Id: <200001051423.RAA06052@paranoid.eltex.spb.ru> In-Reply-To: <20000103090708.A3780@rumpole.bohemians.lexington.ky.us> from "David Rankin " From: ark@eltex.ru Organization: "Klingon Imperial Intelligence Service" Subject: Re: OpenSSH protocol 1.6 proposal To: drankin@bohemians.lexington.ky.us Cc: security@FreeBSD.ORG, openssh-unix-dev@mindrot.org Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- nuqneH, David Rankin said : > > Apart from standards-compliance, what does SSH2 buy you over a cleaned > > up SSH1? > > I know it's been mentioned already, but the #1 is you can do PAM > challenge/response authentication correctly. TISAuthentication option works fine for me. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOHNT26H/mIJW9LeBAQGScQP/b7pDSIl9euhFcNOrGn2koIXvruUwFhO6 kbw+G2EtmqgFSWiCECyrhDerFL51fT67uaGKPQtoQ6fmiZ6zAhbDiVGI3ASPoPnO tDP4rgsiRNiAy3YTmooaBMbL+XmWTg+WYRlTUDeGLVnUQbOWVUNn3kL83P0K2ScP iBMUOtLr8wc= =VDHV -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Wed Jan 5 16:39:10 2000 Delivered-To: freebsd-security@freebsd.org Received: from algieba.leonis.supercluster.net (algieba.leonis.supercluster.net [212.68.66.81]) by hub.freebsd.org (Postfix) with ESMTP id 79DED15578 for ; Wed, 5 Jan 2000 16:38:53 -0800 (PST) (envelope-from S.Brandenburg@tu-bs.de) Received: from tu-bs.de (localhost.leonis.supercluster.net [127.0.0.1]) by algieba.leonis.supercluster.net (8.9.3/8.8.5) with ESMTP id RAA00368 for ; Wed, 5 Jan 2000 17:34:56 GMT Message-ID: <387380C0.41E4AE34@tu-bs.de> Date: Wed, 05 Jan 2000 17:34:56 +0000 From: Sven Brandenburg X-Mailer: Mozilla 4.5 [en] (X11; I; FreeBSD 3.4-STABLE i386) X-Accept-Language: en MIME-Version: 1.0 To: freebsd-security@FreeBSD.ORG Subject: kerberos and Y2K ? Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hello, sorry if this is the wrong place for this question, but has anybody seen any Y2k problems with kerberos (eBones) ? Yesterday I tried to create a new kerberos database. All went smoothly the way it`s documented in the handbook. Except for one thing: $ kinit sven eBones International (algieba.leonis.supercluster.net) Kerberos Initialization for "sven" Password: kinit: Principal expired (kerberos) The database was created setting all expiry dates to 2001-01-01 instead of the default 2000-01-01. Once the system clock is switched back to 1999 kinit is able to obtain a valid ticket. Any comments? Sven --snip-- fortune of the day: Justice, n.: A decision in your favor. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Wed Jan 5 19:19:19 2000 Delivered-To: freebsd-security@freebsd.org Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193]) by hub.freebsd.org (Postfix) with ESMTP id 43A9F14CEB for ; Wed, 5 Jan 2000 19:19:14 -0800 (PST) (envelope-from wollman@khavrinen.lcs.mit.edu) Received: (from wollman@localhost) by khavrinen.lcs.mit.edu (8.9.3/8.9.3) id WAA33907; Wed, 5 Jan 2000 22:02:02 -0500 (EST) (envelope-from wollman) Date: Wed, 5 Jan 2000 22:02:02 -0500 (EST) From: Garrett Wollman Message-Id: <200001060302.WAA33907@khavrinen.lcs.mit.edu> To: Sven Brandenburg Cc: freebsd-security@FreeBSD.ORG Subject: kerberos and Y2K ? In-Reply-To: <387380C0.41E4AE34@tu-bs.de> References: <387380C0.41E4AE34@tu-bs.de> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org < said: > sorry if this is the wrong place for this question, > but has anybody seen any Y2k problems with kerberos (eBones) ? There was a well-known Y2K bug in MIT Kerberos that the principal expiration date defaulted to 1999-12-31. -GAWollman -- Garrett A. Wollman | O Siem / We are all family / O Siem / We're all the same wollman@lcs.mit.edu | O Siem / The fires of freedom Opinions not those of| Dance in the burning flame MIT, LCS, CRS, or NSA| - Susan Aglukark and Chad Irschick To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 2:12:41 2000 Delivered-To: freebsd-security@freebsd.org Received: from bg.sics.se (bg.sics.se [193.10.66.124]) by hub.freebsd.org (Postfix) with ESMTP id 88AEC15078 for ; Thu, 6 Jan 2000 02:12:37 -0800 (PST) (envelope-from bg@bg.sics.se) Received: (from bg@localhost) by bg.sics.se (8.9.3/8.9.3) id LAA03511; Thu, 6 Jan 2000 11:12:21 +0100 (CET) (envelope-from bg) To: Sven Brandenburg Cc: freebsd-security@FreeBSD.ORG Subject: Re: kerberos and Y2K ? References: <387380C0.41E4AE34@tu-bs.de> From: Bjoern Groenvall Date: 06 Jan 2000 11:12:20 +0100 In-Reply-To: Sven Brandenburg's message of Wed, 05 Jan 2000 17:34:56 +0000 Message-ID: Lines: 48 X-Mailer: Red Gnus v0.52/Emacs 19.34 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Sven Brandenburg writes: > Hello, > > sorry if this is the wrong place for this question, > but has anybody seen any Y2k problems with kerberos (eBones) ? > > Yesterday I tried to create a new kerberos database. > All went smoothly the way it`s documented in the handbook. > Except for one thing: > > $ kinit sven > eBones International (algieba.leonis.supercluster.net) > Kerberos Initialization for "sven" > Password: > kinit: Principal expired (kerberos) > > The database was created setting all expiry dates to 2001-01-01 > instead of the default 2000-01-01. > Once the system clock is switched back to 1999 kinit is able > to obtain a valid ticket. > > Any comments? There used to be a real stupid default value for the expiration date in kdb_init.c that was not fixed until 19980609. I don't know exactly what your sources look like but here is a possible fix: - principal.exp_date = 946702799; /* Happy new century */ - strncpy(principal.exp_date_txt, "12/31/99", DATE_SZ); principal.mod_date = time(0); + *principal.mod_date_txt = '\0'; + principal.exp_date = principal.mod_date + 5 * 365 * 24 * 60 * 60; + *principal.exp_date_txt = '\0'; You may also use more recent sources from ftp.pdc.kth.se:pub/krb/src. Cheers, Björn -- _ _ ,_______________. Bjorn Gronvall (Björn Grönvall) /_______________/| Swedish Institute of Computer Science | || PO Box 1263, S-164 29 Kista, Sweden | Schroedingers || Email: bg@sics.se, Phone +46 -8 633 15 25 | Cat |/ Cellular +46 -70 768 06 35, Fax +46 -8 751 72 30 `---------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 5:50:53 2000 Delivered-To: freebsd-security@freebsd.org Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31]) by hub.freebsd.org (Postfix) with ESMTP id 40C28157E9; Thu, 6 Jan 2000 05:50:45 -0800 (PST) (envelope-from des@flood.ping.uio.no) Received: (from des@localhost) by flood.ping.uio.no (8.9.3/8.9.3) id OAA43226; Thu, 6 Jan 2000 14:50:40 +0100 (CET) (envelope-from des@flood.ping.uio.no) To: Brian Fundakowski Feldman Cc: security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal References: From: Dag-Erling Smorgrav Date: 06 Jan 2000 14:50:39 +0100 In-Reply-To: Brian Fundakowski Feldman's message of "Sat, 1 Jan 2000 13:49:22 -0500 (EST)" Message-ID: Lines: 53 User-Agent: Gnus/5.0802 (Gnus v5.8.2) Emacs/20.4 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Brian Fundakowski Feldman writes: > I've been thinking what the best way to make OpenSSH more secure would be, > and now it seems to be a change in the protocol. What change? Well, > SSH version 1.5 and below (all versions so far) have been vulnerable to > attacks based upon properties of the highly insecure CRC32 hash used. Which part of "ssh 1.2.25 fixes the problem" did you not understand? From the advisory: Fix Information: ~~~~~~~~~~~~~~~~ Upgrade to the upcoming SSH protocol version 2. Commercial F-Secure SSH users contact Data Fellows Inc. for information on how to upgrade to F-Secure 2.0 Notice that version 2 of the SSH protocol is not compatible with the previous version, thus you will need to upgrade all the SSH clients as well. In the meantime, upgrade to version 1.2.25 of SSH, which fixes the problem. The SSH 1.2.25 distribution can be obtained from: F-Secure SSH version 1.3.5 fixes this security problem. If you are using the commercial Data Fellows SSH package and you have a support contract, you can obtain the 1.3.5 from your local retailer. Users without a support contract can obtain a patch which fixes this problem from: . A patch for the free SSH 1.2.23 distribution and the complete SSH 1.2.23 package, with the patch applied, can be obtained at: Below are the MD5 hashes for the provided files MD5 (ssh-1.2.23.patch) = 6bdb63d57f893907191986c5ced557ab MD5 (ssh-1.2.23-core.tar.Z) = fffb52122aae26c1f212c051a305a310 MD5 (ssh-1.2.23-core.tar.gz) = f9509ba0f0715637805c6b116adc0869 DES -- Dag-Erling Smorgrav - des@flood.ping.uio.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 8:37: 0 2000 Delivered-To: freebsd-security@freebsd.org Received: from overcee.netplex.com.au (overcee.netplex.com.au [202.12.86.7]) by hub.freebsd.org (Postfix) with ESMTP id CCEB71571C; Thu, 6 Jan 2000 08:35:34 -0800 (PST) (envelope-from peter@netplex.com.au) Received: from netplex.com.au (localhost [127.0.0.1]) by overcee.netplex.com.au (Postfix) with ESMTP id 1A79D1CA0; Fri, 7 Jan 2000 00:35:31 +0800 (WST) (envelope-from peter@netplex.com.au) X-Mailer: exmh version 2.1.1 10/15/1999 To: Dag-Erling Smorgrav Cc: Brian Fundakowski Feldman , security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal In-Reply-To: Message from Dag-Erling Smorgrav of "06 Jan 2000 14:50:39 +0100." Date: Fri, 07 Jan 2000 00:35:31 +0800 From: Peter Wemm Message-Id: <20000106163531.1A79D1CA0@overcee.netplex.com.au> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Dag-Erling Smorgrav wrote: > Brian Fundakowski Feldman writes: > > I've been thinking what the best way to make OpenSSH more secure would be, > > and now it seems to be a change in the protocol. What change? Well, > > SSH version 1.5 and below (all versions so far) have been vulnerable to > > attacks based upon properties of the highly insecure CRC32 hash used. > > Which part of "ssh 1.2.25 fixes the problem" did you not understand? Well, the 'crc compensation attack detection' is an *attempt* to detect likely insertion attacks. It would be far better to not have to try and detect hints of this this and to *know* if it was valid or not without a doubt. Cheers, -Peter To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 15:38:59 2000 Delivered-To: freebsd-security@freebsd.org Received: from algieba.leonis.supercluster.net (algieba.leonis.supercluster.net [212.68.66.81]) by hub.freebsd.org (Postfix) with ESMTP id AF9E415771 for ; Thu, 6 Jan 2000 15:38:13 -0800 (PST) (envelope-from S.Brandenburg@tu-bs.de) Received: from tu-bs.de (localhost.leonis.supercluster.net [127.0.0.1]) by algieba.leonis.supercluster.net (8.9.3/8.8.5) with ESMTP id XAA02971; Thu, 6 Jan 2000 23:36:17 GMT Message-ID: <387526F0.6060620F@tu-bs.de> Date: Thu, 06 Jan 2000 23:36:16 +0000 From: Sven Brandenburg X-Mailer: Mozilla 4.5 [en] (X11; I; FreeBSD 3.4-STABLE i386) X-Accept-Language: en MIME-Version: 1.0 To: Bjoern Groenvall Cc: freebsd-security@FreeBSD.ORG Subject: Re: kerberos and Y2K ? References: <387380C0.41E4AE34@tu-bs.de> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Bjoern Groenvall wrote: [..] > You may also use more recent sources from ftp.pdc.kth.se:pub/krb/src. Thank you. I`ll take a look on that :-) [..] > There used to be a real stupid default value for the expiration date > in kdb_init.c that was not fixed until 19980609. I don't know exactly > what your sources look like but here is a possible fix: > > - principal.exp_date = 946702799; /* Happy new century */ > - strncpy(principal.exp_date_txt, "12/31/99", DATE_SZ); > principal.mod_date = time(0); > + *principal.mod_date_txt = '\0'; > + principal.exp_date = principal.mod_date + 5 * 365 * 24 * 60 * 60; > + *principal.exp_date_txt = '\0'; That`s it. But I wonder why this is still in the source tree. I fetched the crypto stuff from cvsup.internat.FreeBSD.org 2 days ago and made world (3.4-STABLE) *before* I tried to use kerberos. I believe this is the same with cvsup-master.freebsd.org. A quick look into the -current tree reveals: the patch above has been applied there but not to -stable. I wanted to switch to -current within the next few days anyway... ;-) Thanks for the quick help, Sven ----snip---- I will not trust you, I, Nor longer stay in your company. Your hands than mine are quicker for a fray: My legs are longer though, to run away. William Shakespeare, A Midsummer Night`s Dream, 1596 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 20:31:51 2000 Delivered-To: freebsd-security@freebsd.org Received: from povray.org (netplex.aussie.org [204.213.191.226]) by hub.freebsd.org (Postfix) with ESMTP id 8B2E414E65 for ; Thu, 6 Jan 2000 20:31:47 -0800 (PST) (envelope-from casonc@netplex.aussie.org) Received: from frankenputer (dubsat-23 [210.8.162.23]) by povray.org (8.9.3/8.9.3) with SMTP id XAA55246 for ; Thu, 6 Jan 2000 23:10:11 -0500 (EST) (envelope-from casonc@netplex.aussie.org) Message-ID: <002e01bf58c5$18cd90f0$cc0010ac@melbbureau.central.dubsat.com.au> From: "Chris Cason [work]" To: Subject: Port scans and site theft from IP inside mr.net Date: Fri, 7 Jan 2000 15:10:08 +1100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.5600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.5600 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org This is just a heads-up about some activity I've just seen, and also I guess a query as to whether or not you guys have seen this happen before. I'm the server admin of a graphics site that is reasonably popular (www.irtc.org). Recently, we had a person write to us complaining that we were port- scanning him and could we please explain why ? He included some logs that showed that the port scans were coming from 137.192.77.10. Now, this is nothing whatsoever like our IP address, so we were kind of scratching our heads wondering why he wrote to -US- to complain, until we noticed that, if we made a HTTP connection to 137.192.77.10, you got an exact duplicate of our site. To make sure it wasn't a mirage, we changed a page on our site, hit the above one, and sure enough the unchanged version was present. Whoever is operating the site has evidently gone to the trouble of copying a large chunk of our site (I suspect using a reverse-proxy) for some unknown reason. I assume it's a reverse proxy since, now that I have ipfw'd his system off from ours, I still see it hitting my HTTP ports from time to time. I've also seen him pinging us since. He has now configured his system to deny IP from my server, though I can still ping him from elsewhere. Finally, the web server that was running at 137.192.77.10 port 80 is now either not there at all, or he's configured it not to accept connections from any of the networks that we were previously using to look at what he was doing. I believe it is still there as I am still getting attempted connections from his server to mine on port 80. Given that he was port-scanning I can only guess that he wanted people to complain to us instead of him, but that doesn't seem to make a lot of sense either (it's kind of a weak cover). I'm curious to see if anyone else here is able to see his web server anymore, and if so, if they could take a screen-shot including the browser's address bar (as I didn't do so while I had the chance) Also, if anyone has seen anything like this in the past and can shed any more light on it I'd appreciate knowing. FWIW, we have complained twice to mr.net (the hosts of this ip) over the past week, and apart from their automated response, have been greeted with nothing but thunderous silence. It appears to me that they have little concern about this sort of activity. In fact I don't even know myself if it's actually illegal (though it's certainly unethical if it's not). thanks, -- Chris To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 21:32: 1 2000 Delivered-To: freebsd-security@freebsd.org Received: from bsdie.rwsystems.net (bsdie.rwsystems.net [209.197.223.2]) by hub.freebsd.org (Postfix) with ESMTP id 17479154A5 for ; Thu, 6 Jan 2000 21:32:00 -0800 (PST) (envelope-from jwyatt@rwsystems.net) Received: from bsdie.rwsystems.net([209.197.223.2]) (927 bytes) by bsdie.rwsystems.net via sendmail with P:esmtp/R:bind_hosts/T:inet_zone_bind_smtp (sender: ) id for ; Thu, 6 Jan 2000 23:23:03 -0600 (CST) (Smail-3.2.0.106 1999-Mar-31 #1 built 1999-Aug-7) Date: Thu, 6 Jan 2000 23:23:02 -0600 (CST) From: James Wyatt To: freebsd-security@freebsd.org Subject: Ensuring packet defragmentation in FreeBSD? Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I've been looking at sevral programs to help test client setups and learning how they work. I noticed in the nmap manpage, it states: "...this method won't get by packet filters and firewalls that queue all IP fragments (like the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel),..." Does FreeBSD queue packet fragments and/or reassemble them in a way I can detect this probing by fragmented packets? Which files should I look in? Thanks - Jy@ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 21:52: 4 2000 Delivered-To: freebsd-security@freebsd.org Received: from netbox.com (home.netbox.com [206.24.105.130]) by hub.freebsd.org (Postfix) with ESMTP id E3EFC14BDC for ; Thu, 6 Jan 2000 21:51:57 -0800 (PST) (envelope-from jwgray@netbox.com) Received: from localhost (jwgray@localhost) by netbox.com (8.8.8/8.8.7) with ESMTP id VAA02090; Thu, 6 Jan 2000 21:49:47 -0800 (PST) (envelope-from jwgray@netbox.com) Date: Thu, 6 Jan 2000 21:49:47 -0800 (PST) From: Jeff Gray To: "Chris Cason [work]" Cc: freebsd-security@FreeBSD.ORG Subject: Re: Port scans and site theft from IP inside mr.net In-Reply-To: <002e01bf58c5$18cd90f0$cc0010ac@melbbureau.central.dubsat.com.au> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Chris, I cannot reach the IP address via http Pingable, tracerouteable. No information from dig -x Using lynx I get the message 'no startfile' Seems to have taken it down as a web server. Jeff On Fri, 7 Jan 2000, Chris Cason [work] wrote: > This is just a heads-up about some activity I've just seen, and > also I guess a query as to whether or not you guys have seen this > happen before. > > I'm the server admin of a graphics site that is reasonably popular > (www.irtc.org). > > Recently, we had a person write to us complaining that we were port- > scanning him and could we please explain why ? He included some logs > that showed that the port scans were coming from 137.192.77.10. > > Now, this is nothing whatsoever like our IP address, so we were kind > of scratching our heads wondering why he wrote to -US- to complain, > until we noticed that, if we made a HTTP connection to 137.192.77.10, > you got an exact duplicate of our site. To make sure it wasn't a > mirage, we changed a page on our site, hit the above one, and sure > enough the unchanged version was present. > > Whoever is operating the site has evidently gone to the trouble of > copying a large chunk of our site (I suspect using a reverse-proxy) > for some unknown reason. I assume it's a reverse proxy since, now > that I have ipfw'd his system off from ours, I still see it hitting > my HTTP ports from time to time. I've also seen him pinging us since. > > He has now configured his system to deny IP from my server, though > I can still ping him from elsewhere. Finally, the web server that > was running at 137.192.77.10 port 80 is now either not there at all, > or he's configured it not to accept connections from any of the > networks that we were previously using to look at what he was doing. > I believe it is still there as I am still getting attempted connections > from his server to mine on port 80. > > Given that he was port-scanning I can only guess that he wanted people > to complain to us instead of him, but that doesn't seem to make a lot > of sense either (it's kind of a weak cover). > > I'm curious to see if anyone else here is able to see his web server > anymore, and if so, if they could take a screen-shot including the > browser's address bar (as I didn't do so while I had the chance) > > Also, if anyone has seen anything like this in the past and can shed > any more light on it I'd appreciate knowing. > > FWIW, we have complained twice to mr.net (the hosts of this ip) over > the past week, and apart from their automated response, have been > greeted with nothing but thunderous silence. It appears to me that > they have little concern about this sort of activity. In fact I don't > even know myself if it's actually illegal (though it's certainly > unethical if it's not). > > thanks, > > -- Chris > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Thu Jan 6 22:11:51 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.greatbasin.net (mail.greatbasin.net [207.228.35.39]) by hub.freebsd.org (Postfix) with ESMTP id 3F4C215605 for ; Thu, 6 Jan 2000 22:11:44 -0800 (PST) (envelope-from dan@jgl.reno.nv.us) Received: from jgl.reno.nv.us (rno-max3-02.gbis.net [207.228.60.194]) by mail.greatbasin.net (8.9.3/8.9.3) with ESMTP id WAA12475; Thu, 6 Jan 2000 22:11:40 -0800 (PST) Received: from danco (danco.home [10.0.0.2]) by jgl.reno.nv.us (8.9.3/8.9.3) with SMTP id WAA06910; Thu, 6 Jan 2000 22:11:36 -0800 (PST) (envelope-from dan@jgl.reno.nv.us) Message-ID: <062801bf58d6$0f376f00$0200000a@danco.home> From: "Dan O'Connor" To: "Chris Cason [work]" , Subject: Re: Port scans and site theft from IP inside mr.net Date: Thu, 6 Jan 2000 22:10:14 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.3155.0 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3155.0 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >I can still ping him from elsewhere. Finally, the web server that >was running at 137.192.77.10 port 80 is now either not there at all, >or he's configured it not to accept connections from any of the 10:00pm PST: I got no response. When pinging, about 50%-75% of the packets get dropped... >In fact I don't >even know myself if it's actually illegal (though it's certainly >unethical if it's not). Well, running an unathorized mirror site surely violates Copyright laws... --Dan ** The thing I like most about Windows 98 is... ** You can download FreeBSD with it! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 3:26:29 2000 Delivered-To: freebsd-security@freebsd.org Received: from frmug.org (frmug-gw.frmug.org [193.56.58.252]) by hub.freebsd.org (Postfix) with ESMTP id E3AA815477 for ; Fri, 7 Jan 2000 03:26:23 -0800 (PST) (envelope-from roberto@keltia.freenix.fr) Received: (from uucp@localhost) by frmug.org (8.9.3/frmug-2.5/nospam) with UUCP id MAA09749 for freebsd-security@FreeBSD.ORG; Fri, 7 Jan 2000 12:26:17 +0100 (CET) (envelope-from roberto@keltia.freenix.fr) Received: by keltia.freenix.fr (Postfix, from userid 101) id 7F7848863; Fri, 7 Jan 2000 12:05:38 +0100 (CET) Date: Fri, 7 Jan 2000 12:05:38 +0100 From: Ollivier Robert To: freebsd-security@FreeBSD.ORG Subject: Re: Port scans and site theft from IP inside mr.net Message-ID: <20000107120538.A82539@keltia.freenix.fr> Mail-Followup-To: freebsd-security@FreeBSD.ORG References: <002e01bf58c5$18cd90f0$cc0010ac@melbbureau.central.dubsat.com.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <002e01bf58c5$18cd90f0$cc0010ac@melbbureau.central.dubsat.com.au>; from casonc@netplex.aussie.org on Fri, Jan 07, 2000 at 03:10:08PM +1100 X-Operating-System: FreeBSD 4.0-CURRENT/ELF AMD-K6/200 & 2x PPro/200 SMP Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org According to Chris Cason [work]: > FWIW, we have complained twice to mr.net (the hosts of this ip) over > the past week, and apart from their automated response, have been > greeted with nothing but thunderous silence. It appears to me that Go for the upstream provider and ask them to cut him down. -- Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- roberto@keltia.freenix.fr FreeBSD keltia.freenix.fr 4.0-CURRENT #77: Thu Dec 30 12:49:51 CET 1999 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 6:11: 9 2000 Delivered-To: freebsd-security@freebsd.org Received: from federation.addy.com (federation.addy.com [208.11.142.20]) by hub.freebsd.org (Postfix) with ESMTP id 8338215758 for ; Fri, 7 Jan 2000 06:11:00 -0800 (PST) (envelope-from jim@federation.addy.com) Received: from localhost (jim@localhost) by federation.addy.com (8.9.3/8.9.3) with ESMTP id JAA11155 for ; Fri, 7 Jan 2000 09:10:51 -0500 (EST) (envelope-from jim@federation.addy.com) Date: Fri, 7 Jan 2000 09:10:51 -0500 (EST) From: Jim Sander Cc: freebsd-security@FreeBSD.ORG Subject: Re: Port scans and site theft from IP inside mr.net In-Reply-To: <062801bf58d6$0f376f00$0200000a@danco.home> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I can ping, but not http- 9ish EST. > Well, running an unathorized mirror site surely violates Copyright laws... Well, there's no evidence of anyone doing that. Here's what I think is an equally likely explanation: joe blow at mr.net really likes this graphics site, so he set up a mirror/proxy to share it with his buddies in the office or whatever. He probably forgot all about it and then decided to try a little port scanning, foolishly believing he'd never be detected. -=Jim=- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 6:20:17 2000 Delivered-To: freebsd-security@freebsd.org Received: from povray.org (netplex.aussie.org [204.213.191.226]) by hub.freebsd.org (Postfix) with ESMTP id 412B115758 for ; Fri, 7 Jan 2000 06:20:13 -0800 (PST) (envelope-from casonc@netplex.aussie.org) Received: from frankenputer (frankenputer [203.29.75.73]) by povray.org (8.9.3/8.9.3) with SMTP id JAA75362 for ; Fri, 7 Jan 2000 09:20:08 -0500 (EST) (envelope-from casonc@netplex.aussie.org) Message-Id: <200001071420.JAA75362@povray.org> From: "Chris Cason [work]" To: "freebsd-security@FreeBSD.ORG" Date: Sat, 08 Jan 2000 01:19:17 +1100 Reply-To: "Chris Cason [work]" X-Mailer: PMMail 98 Standard (2.01.1600) For Windows NT (4.0.1381;4) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: Re: Port scans and site theft from IP inside mr.net Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Thanks all for your assistance. We've been able to confirm that the telnet prompt that the box gives is from Netware (I never expected to see someone port-scanning and site-sucking from a netware box). And no-one can see the HTTP server anymore, so I presume he's taken that down. Oh, and apologies for posting earlier on using a winblows character set ; I was at work at the time and I'm a bit unfamiliar with Outlook Express :( -- Chris To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 7:40:43 2000 Delivered-To: freebsd-security@freebsd.org Received: from folly.informatik.uni-erlangen.de (nbgdi3-145-253-131-129.arcor-ip.net [145.253.131.129]) by hub.freebsd.org (Postfix) with ESMTP id 2A4E615057 for ; Fri, 7 Jan 2000 07:40:38 -0800 (PST) (envelope-from markus.friedl@informatik.uni-erlangen.de) Received: by folly.informatik.uni-erlangen.de (Postfix, from userid 31451) id 85687B7F; Fri, 7 Jan 2000 16:40:31 +0100 (CET) Date: Fri, 7 Jan 2000 16:40:31 +0100 From: Markus Friedl To: Dag-Erling Smorgrav Cc: security@FreeBSD.ORG, Markus Friedl Subject: Re: OpenSSH protocol 1.6 proposal Message-ID: <20000107164031.A9346@folly.informatik.uni-erlangen.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.7i In-Reply-To: Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org 1.2.25 et al do not fix the problem, they just make attacks a little bit harder. On Thu, Jan 06, 2000 at 02:50:39PM +0100, Dag-Erling Smorgrav wrote: > Brian Fundakowski Feldman writes: > > I've been thinking what the best way to make OpenSSH more secure would be, > > and now it seems to be a change in the protocol. What change? Well, > > SSH version 1.5 and below (all versions so far) have been vulnerable to > > attacks based upon properties of the highly insecure CRC32 hash used. > > Which part of "ssh 1.2.25 fixes the problem" did you not understand? > > From the advisory: > > Fix Information: > ~~~~~~~~~~~~~~~~ > > Upgrade to the upcoming SSH protocol version 2. > > Commercial F-Secure SSH users contact Data Fellows Inc. for > information on how to upgrade to F-Secure 2.0 > > Notice that version 2 of the SSH protocol is not > compatible with the previous version, thus you > will need to upgrade all the SSH clients as well. > > In the meantime, upgrade to version 1.2.25 of SSH, which > fixes the problem. The SSH 1.2.25 distribution can be > obtained from: > > > > F-Secure SSH version 1.3.5 fixes this security problem. > If you are using the commercial Data Fellows SSH package and you > have a support contract, you can obtain the 1.3.5 from your local > retailer. > > Users without a support contract can obtain a patch which fixes > this problem from: > > . > > A patch for the free SSH 1.2.23 distribution and the complete > SSH 1.2.23 package, with the patch applied, can be obtained at: > > > > Below are the MD5 hashes for the provided files > > MD5 (ssh-1.2.23.patch) = 6bdb63d57f893907191986c5ced557ab > MD5 (ssh-1.2.23-core.tar.Z) = fffb52122aae26c1f212c051a305a310 > MD5 (ssh-1.2.23-core.tar.gz) = f9509ba0f0715637805c6b116adc0869 > > > DES > -- > Dag-Erling Smorgrav - des@flood.ping.uio.no > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 7:41: 4 2000 Delivered-To: freebsd-security@freebsd.org Received: from proxy4.ba.best.com (proxy4.ba.best.com [206.184.139.15]) by hub.freebsd.org (Postfix) with ESMTP id 641721522B for ; Fri, 7 Jan 2000 07:41:01 -0800 (PST) (envelope-from GregoryC@stcinc.com) Received: from stcinc.com (gw-covad768k-cognitivetech.ncal.verio.com [207.20.238.29] (may be forged)) by proxy4.ba.best.com (8.9.3/8.9.2/best.out) with ESMTP id HAA24385 for ; Fri, 7 Jan 2000 07:39:31 -0800 (PST) Message-ID: <38760B2F.1044E20D@stcinc.com> Date: Fri, 07 Jan 2000 07:50:07 -0800 From: Gregory Carvalho Reply-To: GregoryC@stcinc.com Organization: Simplified Technology Company X-Mailer: Mozilla 4.51 [en] (X11; I; FreeBSD 3.2-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: FreeBSD-Security@freebsd.org Subject: Configuration Validation Request Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I have a scenario which requires IPSec, but the packets must transgress a Microsoft Windows NT 4.0 Server running PPTP. I would like to use the Kame IPSec package on FreeBSD 3.3R as in the diagram below. I envision the sequence being Farside's PoPToP establishing a connection with OutOfMyHands's PPTP, then IPSec riding that tunnel and cruising right past OutOfMyHands to ServerSide's IPSec. Please comment on the validity of this configuration. ------------------- /\ ------------------- | FreeBSD 3.3R | / \ | WinNT4S | | Name: FarSide | / \ | Name: OutOfMyHands| | IPSec (Kame) | \Inet/ | MS Proxy | | PoPToP |____\__/____| PPTP |__ ------------------- \/ ------------------- | | | ------------------- | | FreeBSD 3.3R | | | Name: ServerSide | | | | | | IPSec |__| ------------------- -- Cordially, Gregory Carvalho GregoryC@stcinc.com Simplified Technology Company http://www.stcinc.com In God I Trust! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 8:39:37 2000 Delivered-To: freebsd-security@freebsd.org Received: from news-ma.rhein-neckar.de (news-ma.rhein-neckar.de [193.197.90.3]) by hub.freebsd.org (Postfix) with ESMTP id 41E15157E2 for ; Fri, 7 Jan 2000 08:39:34 -0800 (PST) (envelope-from daemon@bigeye.rhein-neckar.de) Received: from bigeye.rhein-neckar.de (uucp@localhost) by news-ma.rhein-neckar.de (8.8.8/8.8.8) with bsmtp id RAA08053 for freebsd-security@freebsd.org; Fri, 7 Jan 2000 17:39:31 +0100 (CET) (envelope-from daemon@bigeye.rhein-neckar.de) Received: (from daemon@localhost) by bigeye.rhein-neckar.de (8.9.3/8.9.3) id QAA49654 for freebsd-security@freebsd.org; Fri, 7 Jan 2000 16:04:27 +0100 (CET) (envelope-from daemon) From: naddy@mips.rhein-neckar.de (Christian Weisgerber) Subject: dump over ssh Date: 7 Jan 2000 16:04:26 +0100 Message-ID: <854v9q$1gf9$1@bigeye.rhein-neckar.de> To: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org So far I have received *zero* reactions to my proposal in PR #15830. I suggest to add to dump/restore the capability to access remote tapes over arbitrary rsh(1)-like commands, which would in particular allow to run dump over ssh, say # dump -0aP ssh -f host:/dev/nrsa0 / (The PR includes a proof of concept patch to implement this.) No interest? -- Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 9:29:49 2000 Delivered-To: freebsd-security@freebsd.org Received: from ns.mt.sri.com (ns.mt.sri.com [206.127.79.91]) by hub.freebsd.org (Postfix) with ESMTP id 248D914E98 for ; Fri, 7 Jan 2000 09:29:46 -0800 (PST) (envelope-from nate@mt.sri.com) Received: from mt.sri.com (rocky.mt.sri.com [206.127.76.100]) by ns.mt.sri.com (8.9.3/8.9.3) with SMTP id KAA19895; Fri, 7 Jan 2000 10:29:45 -0700 (MST) (envelope-from nate@rocky.mt.sri.com) Received: by mt.sri.com (SMI-8.6/SMI-SVR4) id KAA05487; Fri, 7 Jan 2000 10:29:44 -0700 Date: Fri, 7 Jan 2000 10:29:44 -0700 Message-Id: <200001071729.KAA05487@mt.sri.com> From: Nate Williams MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit To: naddy@mips.rhein-neckar.de (Christian Weisgerber) Cc: freebsd-security@FreeBSD.ORG Subject: Re: dump over ssh In-Reply-To: <854v9q$1gf9$1@bigeye.rhein-neckar.de> References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> X-Mailer: VM 6.34 under 19.16 "Lille" XEmacs Lucid Reply-To: nate@mt.sri.com (Nate Williams) Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > So far I have received *zero* reactions to my proposal in PR #15830. > > I suggest to add to dump/restore the capability to access remote > tapes over arbitrary rsh(1)-like commands, which would in particular > allow to run dump over ssh, say > > # dump -0aP ssh -f host:/dev/nrsa0 / > > (The PR includes a proof of concept patch to implement this.) > > No interest? Not really, when you can do it already with the 'unix way'. dump -0af - / | ssh host dd of=/dev/nrsao bs=10k Nate To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 10:21:50 2000 Delivered-To: freebsd-security@freebsd.org Received: from erouter0.it-datacntr.louisville.edu (erouter0.it-datacntr.louisville.edu [136.165.1.36]) by hub.freebsd.org (Postfix) with ESMTP id E0B4D158CC for ; Fri, 7 Jan 2000 10:21:36 -0800 (PST) (envelope-from k.stevenson@louisville.edu) Received: from osaka.louisville.edu (osaka.louisville.edu [136.165.1.114]) by erouter0.it-datacntr.louisville.edu (Postfix) with ESMTP id E5E4B24D0E; Fri, 7 Jan 2000 13:21:22 -0500 (EST) Received: by osaka.louisville.edu (Postfix, from userid 15) id 19D9718605; Fri, 7 Jan 2000 13:21:21 -0500 (EST) Date: Fri, 7 Jan 2000 13:21:21 -0500 From: Keith Stevenson To: Nate Williams Cc: Christian Weisgerber , freebsd-security@FreeBSD.ORG Subject: Re: dump over ssh Message-ID: <20000107132121.B39071@osaka.louisville.edu> References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> <200001071729.KAA05487@mt.sri.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0pre3i In-Reply-To: <200001071729.KAA05487@mt.sri.com> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, Jan 07, 2000 at 10:29:44AM -0700, Nate Williams wrote: > > So far I have received *zero* reactions to my proposal in PR #15830. > > > > I suggest to add to dump/restore the capability to access remote > > tapes over arbitrary rsh(1)-like commands, which would in particular > > allow to run dump over ssh, say > > > > # dump -0aP ssh -f host:/dev/nrsa0 / > > > > (The PR includes a proof of concept patch to implement this.) > > > > No interest? > > Not really, when you can do it already with the 'unix way'. > > dump -0af - / | ssh host dd of=/dev/nrsao bs=10k True, you can do it that way, but I prefer the integrated solution in PR #15830. Sorry I didn't speak up sooner. Regards, --Keith Stevenson-- -- Keith Stevenson System Programmer - Data Center Services - University of Louisville k.stevenson@louisville.edu PGP key fingerprint = 4B 29 A8 95 A8 82 EA A2 29 CE 68 DE FC EE B6 A0 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 11:39:53 2000 Delivered-To: freebsd-security@freebsd.org Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2]) by hub.freebsd.org (Postfix) with ESMTP id 55F82157AA for ; Fri, 7 Jan 2000 11:39:51 -0800 (PST) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.3/8.9.1) id LAA88746; Fri, 7 Jan 2000 11:39:47 -0800 (PST) (envelope-from dillon) Date: Fri, 7 Jan 2000 11:39:47 -0800 (PST) From: Matthew Dillon Message-Id: <200001071939.LAA88746@apollo.backplane.com> To: naddy@mips.rhein-neckar.de (Christian Weisgerber) Cc: freebsd-security@FreeBSD.ORG Subject: Re: dump over ssh References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org :So far I have received *zero* reactions to my proposal in PR #15830. : :I suggest to add to dump/restore the capability to access remote :tapes over arbitrary rsh(1)-like commands, which would in particular :allow to run dump over ssh, say : :# dump -0aP ssh -f host:/dev/nrsa0 / : :(The PR includes a proof of concept patch to implement this.) : :No interest? :-- :Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de You can do this already. ssh remotehost "dump 0auf -" > dumpfile. ssh remotehost "restore tvf -" < dumpfile Am I missing something here? -Matt Matthew Dillon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 12:10:26 2000 Delivered-To: freebsd-security@freebsd.org Received: from proxy2.ba.best.com (proxy2.ba.best.com [206.184.139.14]) by hub.freebsd.org (Postfix) with ESMTP id 3BDBF1591F for ; Fri, 7 Jan 2000 12:09:23 -0800 (PST) (envelope-from GregoryC@stcinc.com) Received: from stcinc.com (gw-covad768k-cognitivetech.ncal.verio.com [207.20.238.29] (may be forged)) by proxy2.ba.best.com (8.9.3/8.9.2/best.out) with ESMTP id MAA11731 for ; Fri, 7 Jan 2000 12:07:18 -0800 (PST) Message-ID: <387649F1.1B977740@stcinc.com> Date: Fri, 07 Jan 2000 12:17:53 -0800 From: Gregory Carvalho Reply-To: GregoryC@stcinc.com Organization: Simplified Technology Company X-Mailer: Mozilla 4.51 [en] (X11; I; FreeBSD 3.2-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: FreeBSD-Security@FreeBSD.ORG Subject: Re: Configuration Validation Request References: <38760B2F.1044E20D@stcinc.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Gregory Carvalho wrote: > > I have a scenario which requires IPSec, but the packets must transgress > a Microsoft Windows NT 4.0 Server running PPTP. I would like to use the > Kame IPSec package on FreeBSD 3.3R as in the diagram below. I envision > the sequence being Farside's PoPToP establishing a connection with > OutOfMyHands's PPTP, then IPSec riding that tunnel and cruising right > past OutOfMyHands to ServerSide's IPSec. Please comment on the validity > of this configuration. Clarification: Hosts connected to Farside (which is acting as firewall/gateway) attempt to talk to hosts connected to ServerSide (which is acting as firewall/gateway), so I desire for all traffic between FarSide and ServerSide to be ESP with authentication. OutOfMyHands does not contain IPSec. > > ------------------- /\ ------------------- > | FreeBSD 3.3R | / \ | WinNT4S | > | Name: FarSide | / \ | Name: OutOfMyHands| > | IPSec (Kame) | \Inet/ | MS Proxy | > | PoPToP |____\__/____| PPTP |__ > ------------------- \/ ------------------- | > | > | > ------------------- | > | FreeBSD 3.3R | | > | Name: ServerSide | | > | | | > | IPSec |__| > ------------------- > Cordially, Gregory Carvalho GregoryC@stcinc.com Simplified Technology Company http://www.stcinc.com In God I Trust! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 12:31:10 2000 Delivered-To: freebsd-security@freebsd.org Received: from news-ma.rhein-neckar.de (news-ma.rhein-neckar.de [193.197.90.3]) by hub.freebsd.org (Postfix) with ESMTP id 43D5B14DB2 for ; Fri, 7 Jan 2000 12:31:05 -0800 (PST) (envelope-from daemon@bigeye.rhein-neckar.de) Received: from bigeye.rhein-neckar.de (uucp@localhost) by news-ma.rhein-neckar.de (8.8.8/8.8.8) with bsmtp id VAA13018 for freebsd-security@freebsd.org; Fri, 7 Jan 2000 21:31:03 +0100 (CET) (envelope-from daemon@bigeye.rhein-neckar.de) Received: (from daemon@localhost) by bigeye.rhein-neckar.de (8.9.3/8.9.3) id VAA64310 for freebsd-security@freebsd.org; Fri, 7 Jan 2000 21:28:49 +0100 (CET) (envelope-from daemon) From: naddy@mips.rhein-neckar.de (Christian Weisgerber) Subject: Re: dump over ssh Date: 7 Jan 2000 21:28:48 +0100 Message-ID: <855ia0$1up8$1@bigeye.rhein-neckar.de> References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> <200001071729.KAA05487@mt.sri.com> To: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Nate Williams wrote: > Not really, when you can do it already with the 'unix way'. > dump -0af - / | ssh host dd of=/dev/nrsa0 bs=10k This doesn't handle end-of-tape recognition, i.e. you can't do multi-volume dumps. -- Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 12:53:22 2000 Delivered-To: freebsd-security@freebsd.org Received: from bg.sics.se (bg.sics.se [193.10.66.124]) by hub.freebsd.org (Postfix) with ESMTP id 96F6914DE1; Fri, 7 Jan 2000 12:53:18 -0800 (PST) (envelope-from bg@bg.sics.se) Received: (from bg@localhost) by bg.sics.se (8.9.3/8.9.3) id VAA05066; Fri, 7 Jan 2000 21:53:10 +0100 (CET) (envelope-from bg) To: Dag-Erling Smorgrav , Brian Fundakowski Feldman Cc: Markus Friedl , security@FreeBSD.ORG Subject: Re: OpenSSH protocol 1.6 proposal References: From: Bjoern Groenvall Date: 07 Jan 2000 21:53:09 +0100 In-Reply-To: Dag-Erling Smorgrav's message of 06 Jan 2000 14:50:39 +0100 Message-ID: Lines: 39 X-Mailer: Red Gnus v0.52/Emacs 19.34 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Dag-Erling Smorgrav writes: > Brian Fundakowski Feldman writes: > > I've been thinking what the best way to make OpenSSH more secure would be, > > and now it seems to be a change in the protocol. What change? Well, > > SSH version 1.5 and below (all versions so far) have been vulnerable to > > attacks based upon properties of the highly insecure CRC32 hash used. > > Which part of "ssh 1.2.25 fixes the problem" did you not understand? Markus Friedl writes: > 1.2.25 et al do not fix the problem, they just make > attacks a little bit harder. Also remember that the SSH_3DES scheme resists the attack described by Futoranski et.al. The attack is effective against IDEA_CFB, DES_CBC or in general any block cipher that uses CBC or CFB. Currently there is no known attack that is effective when the somewhat weird feedback mode of SSH_3DES is used. So if you are looking for a temporary solution to the SSHv1 problem, disable all ciphers but SSH_3DES. Unlike the attack detector in 1.2.25++, this solution will always resist the Futoranski attack. This does not imply that the SSH_3DES mode is secure, only that there currently has been no published method of attack. In the long run we still need a new packet format. Cheers, Björn -- _ _ ,_______________. Bjorn Gronvall (Björn Grönvall) /_______________/| Swedish Institute of Computer Science | || PO Box 1263, S-164 29 Kista, Sweden | Schroedingers || Email: bg@sics.se, Phone +46 -8 633 15 25 | Cat |/ Cellular +46 -70 768 06 35, Fax +46 -8 751 72 30 `---------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 13:28:20 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.xnet.com (quake.xnet.com [198.147.221.67]) by hub.freebsd.org (Postfix) with ESMTP id 793DB157C0 for ; Fri, 7 Jan 2000 13:28:17 -0800 (PST) (envelope-from drwho@xnet.com) Received: from typhoon.xnet.com (typhoon.xnet.com [198.147.221.66]) by mail.xnet.com (8.9.3+Sun/XNet-3.0R) with ESMTP id PAA16468 for ; Fri, 7 Jan 2000 15:28:16 -0600 (CST) Received: by typhoon.xnet.com (Postfix, from userid 5500) id BEC783B01A; Fri, 7 Jan 2000 15:28:15 -0600 (CST) Date: Fri, 7 Jan 2000 15:28:15 -0600 From: Michael Maxwell To: freebsd-security@freebsd.org Subject: Sudden crashing? Message-ID: <20000107152815.A11225@typhoon.xnet.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.4i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org So far, one of my servers, a BSD 3.2-R machine, has mysteriously crashed twice this week. This machine functions as a gateway and firewall to our internet connection, so it's the most visible host here. I use ipfw to block pretty much all the low ports except those we really need, such as ssh, ntp, smtp, etc... I don't see anything in the logs indicating what might have happened. Not only that, but ipfw *refuses* to log to syslog on this box!?! My /etc/syslog.conf is an exact copy of the same file on another machine which DOES correctly log ipfw. Any ideas? -- Fight email spam: http://www.cauce.org/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 13:33: 8 2000 Delivered-To: freebsd-security@freebsd.org Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2]) by hub.freebsd.org (Postfix) with ESMTP id 8E3DB14E98 for ; Fri, 7 Jan 2000 13:33:01 -0800 (PST) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.3/8.9.1) id NAA97841; Fri, 7 Jan 2000 13:32:54 -0800 (PST) (envelope-from dillon) Date: Fri, 7 Jan 2000 13:32:54 -0800 (PST) From: Matthew Dillon Message-Id: <200001072132.NAA97841@apollo.backplane.com> To: Michael Maxwell Cc: freebsd-security@FreeBSD.ORG Subject: Re: Sudden crashing? References: <20000107152815.A11225@typhoon.xnet.com> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org :So far, one of my servers, a BSD 3.2-R machine, has mysteriously crashed :twice this week. This machine functions as a gateway and firewall to our :internet connection, so it's the most visible host here. I use ipfw to :block pretty much all the low ports except those we really need, such as :ssh, ntp, smtp, etc... : :I don't see anything in the logs indicating what might have happened. : :Not only that, but ipfw *refuses* to log to syslog on this box!?! My :/etc/syslog.conf is an exact copy of the same file on another machine :which DOES correctly log ipfw. : :Any ideas? The very first thing I would do is upgrade the machine to 3.4-R. -Matt Matthew Dillon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 13:33:56 2000 Delivered-To: freebsd-security@freebsd.org Received: from vinyl.sentex.ca (vinyl.sentex.ca [209.112.4.14]) by hub.freebsd.org (Postfix) with ESMTP id 94ABA15877 for ; Fri, 7 Jan 2000 13:33:49 -0800 (PST) (envelope-from mike@sentex.net) Received: from simoeon (simeon.sentex.ca [209.112.4.47]) by vinyl.sentex.ca (8.9.3/8.9.3) with SMTP id QAA28355; Fri, 7 Jan 2000 16:33:10 -0500 (EST) (envelope-from mike@sentex.net) Message-Id: <3.0.5.32.20000107163017.00be7e80@staff.sentex.ca> X-Sender: mdtpop@staff.sentex.ca X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.5 (32) Date: Fri, 07 Jan 2000 16:30:17 -0500 To: Michael Maxwell , freebsd-security@FreeBSD.ORG From: Mike Tancsa Subject: Re: Sudden crashing? In-Reply-To: <20000107152815.A11225@typhoon.xnet.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 03:28 PM 1/7/00 -0600, Michael Maxwell wrote: >So far, one of my servers, a BSD 3.2-R machine, has mysteriously crashed >twice this week. This machine functions as a gateway and firewall to our >internet connection, so it's the most visible host here. I use ipfw to >block pretty much all the low ports except those we really need, such as >ssh, ntp, smtp, etc... > >I don't see anything in the logs indicating what might have happened. > >Not only that, but ipfw *refuses* to log to syslog on this box!?! My >/etc/syslog.conf is an exact copy of the same file on another machine >which DOES correctly log ipfw. its been a while, but the logging on ipfw had changed at one point. Do you have kern.* /var/log/kernel or something similar in your /etc/syslog.conf file ? ---Mike ------------------------------------------------------------------------ Mike Tancsa, tel +1 519 651 3400 Network Administrator, mike@sentex.net Sentex Communications www.sentex.net Cambridge, Ontario Canada To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 14: 8:46 2000 Delivered-To: freebsd-security@freebsd.org Received: from vtopus.cs.vt.edu (vtopus.cs.vt.edu [128.173.40.24]) by hub.freebsd.org (Postfix) with ESMTP id A2FCE158BA; Fri, 7 Jan 2000 14:08:38 -0800 (PST) (envelope-from dhagan@cs.vt.edu) Received: from localhost (dhagan@localhost) by vtopus.cs.vt.edu (8.9.1a/8.9.1) with SMTP id RAA20539; Fri, 7 Jan 2000 17:08:22 -0500 (EST) Date: Fri, 7 Jan 2000 17:08:22 -0500 (EST) From: Daniel Hagan To: Christian Weisgerber Cc: freebsd-security@freebsd.org, bugs@freebsd.org Subject: bin/15830 - Re: dump over ssh In-Reply-To: <855ia0$1up8$1@bigeye.rhein-neckar.de> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On 7 Jan 2000, Christian Weisgerber wrote: > This doesn't handle end-of-tape recognition, i.e. you can't do > multi-volume dumps. While I don't need this functionality at work anymore, it would be nice to have in general. If you can send me your patches (the web PR version is munged), I'll test them here (I've got access to FreeBSD & Tru64 UNIX aka OSF/1). Daniel -- Daniel Hagan Computer Science CSE dhagan@cs.vt.edu http://www.cs.vt.edu/~dhagan/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 14:58:49 2000 Delivered-To: freebsd-security@freebsd.org Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2]) by hub.freebsd.org (Postfix) with ESMTP id D961014C22 for ; Fri, 7 Jan 2000 14:58:45 -0800 (PST) (envelope-from brett@lariat.org) Received: from workhorse (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2]) by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id PAA02302; Fri, 7 Jan 2000 15:58:22 -0700 (MST) Message-Id: <4.2.2.20000107155733.01d32b40@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Fri, 07 Jan 2000 15:58:22 -0700 To: Matthew Dillon , naddy@mips.rhein-neckar.de (Christian Weisgerber) From: Brett Glass Subject: Re: dump over ssh Cc: freebsd-security@FreeBSD.ORG In-Reply-To: <200001071939.LAA88746@apollo.backplane.com> References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Can you do any or all of these things from a script? As I recall, ssh requires "live" entry of the password from the keyboard (though I haven't tried it lately). --Brett At 12:39 PM 1/7/2000 , Matthew Dillon wrote: >:So far I have received *zero* reactions to my proposal in PR #15830. >: >:I suggest to add to dump/restore the capability to access remote >:tapes over arbitrary rsh(1)-like commands, which would in particular >:allow to run dump over ssh, say >: >:# dump -0aP ssh -f host:/dev/nrsa0 / >: >:(The PR includes a proof of concept patch to implement this.) >: >:No interest? >:-- >:Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de > > You can do this already. > > ssh remotehost "dump 0auf -" > dumpfile. > ssh remotehost "restore tvf -" < dumpfile > > Am I missing something here? > > -Matt > Matthew Dillon > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 15: 2:44 2000 Delivered-To: freebsd-security@freebsd.org Received: from ns.mt.sri.com (ns.mt.sri.com [206.127.79.91]) by hub.freebsd.org (Postfix) with ESMTP id 504F11588E for ; Fri, 7 Jan 2000 15:02:41 -0800 (PST) (envelope-from nate@mt.sri.com) Received: from mt.sri.com (rocky.mt.sri.com [206.127.76.100]) by ns.mt.sri.com (8.9.3/8.9.3) with SMTP id QAA23349; Fri, 7 Jan 2000 16:02:30 -0700 (MST) (envelope-from nate@rocky.mt.sri.com) Received: by mt.sri.com (SMI-8.6/SMI-SVR4) id QAA08054; Fri, 7 Jan 2000 16:02:29 -0700 Date: Fri, 7 Jan 2000 16:02:29 -0700 Message-Id: <200001072302.QAA08054@mt.sri.com> From: Nate Williams MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit To: Brett Glass Cc: Matthew Dillon , naddy@mips.rhein-neckar.de (Christian Weisgerber), freebsd-security@FreeBSD.ORG Subject: Re: dump over ssh In-Reply-To: <4.2.2.20000107155733.01d32b40@localhost> References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> <200001071939.LAA88746@apollo.backplane.com> <4.2.2.20000107155733.01d32b40@localhost> X-Mailer: VM 6.34 under 19.16 "Lille" XEmacs Lucid Reply-To: nate@mt.sri.com (Nate Williams) Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > Can you do any or all of these things from a script? As I recall, > ssh requires "live" entry of the password from the keyboard (though > I haven't tried it lately). Only if you require a password to access your keypair. Otherwise, it doesn't require it. Nate To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 15:10:49 2000 Delivered-To: freebsd-security@freebsd.org Received: from naiad.eclipse.net.uk (naiad.eclipse.net.uk [195.188.32.29]) by hub.freebsd.org (Postfix) with ESMTP id 7327214BDA for ; Fri, 7 Jan 2000 15:10:47 -0800 (PST) (envelope-from sh@eclipse.net.uk) Received: by naiad.eclipse.net.uk (Postfix, from userid 65534) id DC2931393D; Fri, 07 Jan 2000 23:10:43 +0000 (GMT) From: Stuart Henderson To: Brett Glass Reply-To: Stuart Henderson Cc: Matthew Dillon , Christian Weisgerber , freebsd-security@FreeBSD.ORG References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> <4.2.2.20000107155733.01d32b40@localhost> In-Reply-To: <4.2.2.20000107155733.01d32b40@localhost> MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit User-Agent: IMP 2.0.10-cvs X-Complaints-To: abuse@eclipse.net.uk X-Trace: webmail.octarine.org/212.104.138.174 Subject: Re: dump over ssh Message-Id: <20000107231043.DC2931393D@naiad.eclipse.net.uk> Date: Fri, 07 Jan 2000 23:10:43 +0000 (GMT) Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Quoting Brett Glass : > Can you do any or all of these things from a script? As I recall, > ssh requires "live" entry of the password from the keyboard (though > I haven't tried it lately). There is an rhosts-like mechanism in ssh (shosts), alternatively you can leave the passphrase blank when you run ssh-keygen and then use authorized_keys files, or you can use an authentication server. More information in ssh(1). To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 15:23:15 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.xnet.com (quake.xnet.com [198.147.221.67]) by hub.freebsd.org (Postfix) with ESMTP id 15A5614A1D for ; Fri, 7 Jan 2000 15:23:13 -0800 (PST) (envelope-from drwho@xnet.com) Received: from typhoon.xnet.com (typhoon.xnet.com [198.147.221.66]) by mail.xnet.com (8.9.3+Sun/XNet-3.0R) with ESMTP id RAA20245; Fri, 7 Jan 2000 17:23:10 -0600 (CST) Received: by typhoon.xnet.com (Postfix, from userid 5500) id A123D3B01A; Fri, 7 Jan 2000 17:23:10 -0600 (CST) Date: Fri, 7 Jan 2000 17:23:10 -0600 From: Michael Maxwell To: Matthew Dillon Cc: freebsd-security@freebsd.org Subject: Re: Sudden crashing? Message-ID: <20000107172310.A28349@typhoon.xnet.com> References: <20000107152815.A11225@typhoon.xnet.com> <200001072132.NAA97841@apollo.backplane.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.4i In-Reply-To: <200001072132.NAA97841@apollo.backplane.com>; from Matthew Dillon on Fri, Jan 07, 2000 at 01:32:54PM -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, Jan 07, 2000 at 01:32:54PM -0800, Matthew Dillon wrote: > The very first thing I would do is upgrade the machine to 3.4-R. Unfortunately, even though that was my first assumption, disk space on this box is at a premium, and halfway through the cvsup, I had to stop. I would never survive a buildworld. Worse: the box doesn't have a cdrom on it... -- Fight email spam: http://www.cauce.org/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 15:31: 9 2000 Delivered-To: freebsd-security@freebsd.org Received: from testbed.baileylink.net (testbed.baileylink.net [63.71.213.24]) by hub.freebsd.org (Postfix) with ESMTP id 8186015858 for ; Fri, 7 Jan 2000 15:31:07 -0800 (PST) (envelope-from brad@testbed.baileylink.net) Received: (from brad@localhost) by testbed.baileylink.net (8.9.3/8.9.3) id RAA26089 for freebsd-security@freebsd.org; Fri, 7 Jan 2000 17:31:23 -0600 (CST) (envelope-from brad) Date: Fri, 7 Jan 2000 17:31:23 -0600 From: Brad Guillory To: freebsd-security@freebsd.org Subject: Re: Sudden crashing? Message-ID: <20000107173123.G92560@baileylink.net> References: <20000107152815.A11225@typhoon.xnet.com> <200001072132.NAA97841@apollo.backplane.com> <20000107172310.A28349@typhoon.xnet.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <20000107172310.A28349@typhoon.xnet.com>; from drwho@xnet.com on Fri, Jan 07, 2000 at 05:23:10PM -0600 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org You can do sysinstall to do an upgrade via ftp. On Fri, Jan 07, 2000 at 05:23:10PM -0600, Michael Maxwell wrote: > On Fri, Jan 07, 2000 at 01:32:54PM -0800, Matthew Dillon wrote: > > The very first thing I would do is upgrade the machine to 3.4-R. > > Unfortunately, even though that was my first assumption, disk space on > this box is at a premium, and halfway through the cvsup, I had to stop. > I would never survive a buildworld. Worse: the box doesn't have a > cdrom on it... > > -- > Fight email spam: http://www.cauce.org/ > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 15:31:41 2000 Delivered-To: freebsd-security@freebsd.org Received: from gndrsh.dnsmgr.net (GndRsh.dnsmgr.net [198.145.92.4]) by hub.freebsd.org (Postfix) with ESMTP id DFF4D150CF for ; Fri, 7 Jan 2000 15:31:31 -0800 (PST) (envelope-from freebsd@gndrsh.dnsmgr.net) Received: (from freebsd@localhost) by gndrsh.dnsmgr.net (8.9.3/8.9.3) id PAA13465; Fri, 7 Jan 2000 15:30:53 -0800 (PST) (envelope-from freebsd) From: "Rodney W. Grimes" Message-Id: <200001072330.PAA13465@gndrsh.dnsmgr.net> Subject: Re: dump over ssh In-Reply-To: <4.2.2.20000107155733.01d32b40@localhost> from Brett Glass at "Jan 7, 2000 03:58:22 pm" To: brett@lariat.org (Brett Glass) Date: Fri, 7 Jan 2000 15:30:53 -0800 (PST) Cc: dillon@apollo.backplane.com (Matthew Dillon), naddy@mips.rhein-neckar.de (Christian Weisgerber), freebsd-security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL54 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > Can you do any or all of these things from a script? As I recall, > ssh requires "live" entry of the password from the keyboard (though > I haven't tried it lately). Not if you have things setup correctly: gndrsh:rgrimes {170}% ssh freefall.freebsd.org ls Mail cvswork rgrimes.0.gz rgrimes.1.gz gndrsh:rgrimes {171}% > > --Brett > > At 12:39 PM 1/7/2000 , Matthew Dillon wrote: > > >:So far I have received *zero* reactions to my proposal in PR #15830. > >: > >:I suggest to add to dump/restore the capability to access remote > >:tapes over arbitrary rsh(1)-like commands, which would in particular > >:allow to run dump over ssh, say > >: > >:# dump -0aP ssh -f host:/dev/nrsa0 / > >: > >:(The PR includes a proof of concept patch to implement this.) > >: > >:No interest? > >:-- > >:Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de > > > > You can do this already. > > > > ssh remotehost "dump 0auf -" > dumpfile. > > ssh remotehost "restore tvf -" < dumpfile > > > > Am I missing something here? > > > > -Matt > > Matthew Dillon > > > > > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org > >with "unsubscribe freebsd-security" in the body of the message > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > -- Rod Grimes - KD7CAX @ CN85sl - (RWG25) rgrimes@gndrsh.dnsmgr.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 16:35:46 2000 Delivered-To: freebsd-security@freebsd.org Received: from mls.gtonet.net (mls.gtonet.net [216.112.90.195]) by hub.freebsd.org (Postfix) with ESMTP id 4A7A514BF3 for ; Fri, 7 Jan 2000 16:35:44 -0800 (PST) (envelope-from freebsd@gtonet.net) Received: from pld (holeyman@pld.gtonet.net [216.112.90.200]) by mls.gtonet.net (8.9.3/8.9.3) with SMTP id QAA64174 for ; Fri, 7 Jan 2000 16:35:44 -0800 (PST) (envelope-from freebsd@gtonet.net) From: "FreeBSD" To: Subject: RE: Sudden crashing? Date: Fri, 7 Jan 2000 16:36:05 -0800 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <20000107172310.A28349@typhoon.xnet.com> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > -----Original Message----- > From: owner-freebsd-security@FreeBSD.ORG > [mailto:owner-freebsd-security@FreeBSD.ORG]On Behalf Of Michael Maxwell > Sent: Friday, January 07, 2000 3:23 PM > To: Matthew Dillon > Cc: freebsd-security@FreeBSD.ORG > Subject: Re: Sudden crashing? > > > On Fri, Jan 07, 2000 at 01:32:54PM -0800, Matthew Dillon wrote: > > The very first thing I would do is upgrade the machine to 3.4-R. > > Unfortunately, even though that was my first assumption, disk space on > this box is at a premium, and halfway through the cvsup, I had to stop. > I would never survive a buildworld. Worse: the box doesn't have a > cdrom on it... Have you considered BUYING a hard drive and a cdrom drive. You could have both for just a little money or you could format and start over. Lord knows, we've all had to do that before. After 2 -releases it's hard to say what could be broken after your various upgrades and tweaks. At the very least, more info would be needed. In short, I agree with Matthew, you should probably upgrade and eat the expense/downtime. Sorry. > > -- > Fight email spam: http://www.cauce.org/ FreeBSD freebsd@gtonet.net "LinSUX is only free if your time is worthless" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 16:43:10 2000 Delivered-To: freebsd-security@freebsd.org Received: from news-ma.rhein-neckar.de (news-ma.rhein-neckar.de [193.197.90.3]) by hub.freebsd.org (Postfix) with ESMTP id 3B1EB15965 for ; Fri, 7 Jan 2000 16:42:52 -0800 (PST) (envelope-from daemon@bigeye.rhein-neckar.de) Received: from bigeye.rhein-neckar.de (uucp@localhost) by news-ma.rhein-neckar.de (8.8.8/8.8.8) with bsmtp id BAA24562 for freebsd-security@freebsd.org; Sat, 8 Jan 2000 01:42:51 +0100 (CET) (envelope-from daemon@bigeye.rhein-neckar.de) Received: (from daemon@localhost) by bigeye.rhein-neckar.de (8.9.3/8.9.3) id BAA72627 for freebsd-security@freebsd.org; Sat, 8 Jan 2000 01:24:56 +0100 (CET) (envelope-from daemon) From: naddy@mips.rhein-neckar.de (Christian Weisgerber) Subject: Re: bin/15830 - Re: dump over ssh Date: 8 Jan 2000 01:24:55 +0100 Message-ID: <85604n$26t8$1@bigeye.rhein-neckar.de> References: <855ia0$1up8$1@bigeye.rhein-neckar.de> To: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Daniel Hagan wrote: > While I don't need this functionality at work anymore, it would be nice to > have in general. If you can send me your patches (the web PR version is > munged), I'll test them here I have put up a cosmetically revised version of the patch at: http://home.pages.de/~naddy/unix/freebsd/dump.patch While porting it over to OpenBSD, I noticed that OpenBSD conveniently has rcmdsh(3) in its libc, which is basically just the function I snarfed from rdist. I think adding this to our libc would be a very good idea. In anticipation of this, I copied OpenBSD's rcmdsh.c wholesale for the new patch. Alas, this still leaves unresolved the SIGINT issue I mentioned in the original PR. For the time being, I added "setpgid(0, getpid())" to rcmdsh.c. If we import rcmdsh() into libc (or if I want to use it on OpenBSD) I can't modify it, though. Either that change needs to go into the external version of rcmdsh(), or I need to work around the problem somehow. -- Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 16:43: 9 2000 Delivered-To: freebsd-security@freebsd.org Received: from news-ma.rhein-neckar.de (news-ma.rhein-neckar.de [193.197.90.3]) by hub.freebsd.org (Postfix) with ESMTP id F20F21593D for ; Fri, 7 Jan 2000 16:42:41 -0800 (PST) (envelope-from daemon@bigeye.rhein-neckar.de) Received: from bigeye.rhein-neckar.de (uucp@localhost) by news-ma.rhein-neckar.de (8.8.8/8.8.8) with bsmtp id BAA24560 for freebsd-security@freebsd.org; Sat, 8 Jan 2000 01:42:40 +0100 (CET) (envelope-from daemon@bigeye.rhein-neckar.de) Received: (from daemon@localhost) by bigeye.rhein-neckar.de (8.9.3/8.9.3) id AAA71568 for freebsd-security@freebsd.org; Sat, 8 Jan 2000 00:46:08 +0100 (CET) (envelope-from daemon) From: naddy@mips.rhein-neckar.de (Christian Weisgerber) Subject: Re: dump over ssh Date: 8 Jan 2000 00:46:08 +0100 Message-ID: <855ts0$25s2$1@bigeye.rhein-neckar.de> References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> <4.2.2.20000107155733.01d32b40@localhost> To: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Brett Glass wrote: > Can you do any or all of these things from a script? Of course. Note that the idea (and the main part of the implementation) for "dump -P" is reused from rdist. > As I recall, ssh requires "live" entry of the password from the > keyboard (though I haven't tried it lately). ssh supports several types of authentication. For scripts, you'd probably set up either rhosts-RSA authentication (my personal favorite) or RSA authentication with a keypair without passphrase. -- Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 18:30:14 2000 Delivered-To: freebsd-security@freebsd.org Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2]) by hub.freebsd.org (Postfix) with ESMTP id 4A82C152A1 for ; Fri, 7 Jan 2000 18:30:12 -0800 (PST) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.3/8.9.1) id SAA02972; Fri, 7 Jan 2000 18:30:09 -0800 (PST) (envelope-from dillon) Date: Fri, 7 Jan 2000 18:30:09 -0800 (PST) From: Matthew Dillon Message-Id: <200001080230.SAA02972@apollo.backplane.com> To: Nate Williams Cc: Brett Glass , naddy@mips.rhein-neckar.de (Christian Weisgerber), freebsd-security@FreeBSD.ORG Subject: Re: dump over ssh References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> <200001071939.LAA88746@apollo.backplane.com> <4.2.2.20000107155733.01d32b40@localhost> <200001072302.QAA08054@mt.sri.com> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org :> Can you do any or all of these things from a script? As I recall, :> ssh requires "live" entry of the password from the keyboard (though :> I haven't tried it lately). : :Only if you require a password to access your keypair. Otherwise, it :doesn't require it. : : :Nate Right. I give my backup machine a keypair to the 'operator' account on my other machines through which it runs the dumps. I bought a cheap high capacity IDE drive for the backup machine big enough to hold the dumps to avoid having to direct them to the tape in real time, which saves a lot on tape drive wear. -Matt Matthew Dillon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Fri Jan 7 18:31:29 2000 Delivered-To: freebsd-security@freebsd.org Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2]) by hub.freebsd.org (Postfix) with ESMTP id A6016150E3 for ; Fri, 7 Jan 2000 18:31:27 -0800 (PST) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.3/8.9.1) id SAA03000; Fri, 7 Jan 2000 18:31:26 -0800 (PST) (envelope-from dillon) Date: Fri, 7 Jan 2000 18:31:26 -0800 (PST) From: Matthew Dillon Message-Id: <200001080231.SAA03000@apollo.backplane.com> To: Michael Maxwell Cc: freebsd-security@freebsd.org Subject: Re: Sudden crashing? References: <20000107152815.A11225@typhoon.xnet.com> <200001072132.NAA97841@apollo.backplane.com> <20000107172310.A28349@typhoon.xnet.com> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org : :On Fri, Jan 07, 2000 at 01:32:54PM -0800, Matthew Dillon wrote: :> The very first thing I would do is upgrade the machine to 3.4-R. : :Unfortunately, even though that was my first assumption, disk space on :this box is at a premium, and halfway through the cvsup, I had to stop. :I would never survive a buildworld. Worse: the box doesn't have a :cdrom on it... : :-- :Fight email spam: http://www.cauce.org/ Find another box you can unpack the CVS tree on and export /usr/src to this machine over the network. If you do not have enough space on the local machine for /usr/obj, then make space on some other machine and export that to the local machine for /usr/obj. Then you can buildworld and installworld on the local machine. -Matt Matthew Dillon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 8 14:58:27 2000 Delivered-To: freebsd-security@freebsd.org Received: from mta2.snfc21.pbi.net (mta2.snfc21.pbi.net [206.13.28.123]) by hub.freebsd.org (Postfix) with ESMTP id 086B714E77 for ; Sat, 8 Jan 2000 14:58:24 -0800 (PST) (envelope-from madscientist@thegrid.net) Received: from remus ([63.193.246.169]) by mta2.snfc21.pbi.net (Sun Internet Mail Server sims.3.5.1999.09.16.21.57.p8) with SMTP id <0FO100KU9H4NXQ@mta2.snfc21.pbi.net> for freebsd-security@freebsd.org; Sat, 8 Jan 2000 14:58:00 -0800 (PST) Date: Sat, 08 Jan 2000 14:55:49 -0800 From: The Mad Scientist Subject: Re: Sudden crashing? In-reply-to: <200001080231.SAA03000@apollo.backplane.com> X-Sender: i289861@mail.thegrid.net To: freebsd-security@freebsd.org Message-id: <4.1.20000108144923.00955e80@mail.thegrid.net> MIME-version: 1.0 X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 Content-type: text/plain; charset="us-ascii" References: <20000107152815.A11225@typhoon.xnet.com> <200001072132.NAA97841@apollo.backplane.com> <20000107172310.A28349@typhoon.xnet.com> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 06:31 PM 1/7/00 -0800, you wrote: > >: >:On Fri, Jan 07, 2000 at 01:32:54PM -0800, Matthew Dillon wrote: >:> The very first thing I would do is upgrade the machine to 3.4-R. >: >:Unfortunately, even though that was my first assumption, disk space on >:this box is at a premium, and halfway through the cvsup, I had to stop. >:I would never survive a buildworld. Worse: the box doesn't have a >:cdrom on it... >: >:-- >:Fight email spam: http://www.cauce.org/ > > Find another box you can unpack the CVS tree on and export /usr/src > to this machine over the network. If you do not have enough space > on the local machine for /usr/obj, then make space on some other machine > and export that to the local machine for /usr/obj. > > Then you can buildworld and installworld on the local machine. > > -Matt > Matthew Dillon > This is a convienent way to upgrade from the sources. I have one fast machine that I cvsup and make buildworld from. Then I export /usr/src and /usr/obj to my slower machines and make installworld. This is documented in the freebsd handbook (http://www.freebsd.org/handbook/index.html) somehwere. You can even make installworld in multi-user, but it's not recommended. At any rate, we're getting off mailing list topic here. -Dean To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 8 17:46:30 2000 Delivered-To: freebsd-security@freebsd.org Received: from news-ma.rhein-neckar.de (news-ma.rhein-neckar.de [193.197.90.3]) by hub.freebsd.org (Postfix) with ESMTP id AB3F614FA5 for ; Sat, 8 Jan 2000 17:46:27 -0800 (PST) (envelope-from daemon@bigeye.rhein-neckar.de) Received: from bigeye.rhein-neckar.de (uucp@localhost) by news-ma.rhein-neckar.de (8.8.8/8.8.8) with bsmtp id CAA12250 for freebsd-security@freebsd.org; Sun, 9 Jan 2000 02:46:26 +0100 (CET) (envelope-from daemon@bigeye.rhein-neckar.de) Received: (from daemon@localhost) by bigeye.rhein-neckar.de (8.9.3/8.9.3) id CAA23500 for freebsd-security@freebsd.org; Sun, 9 Jan 2000 02:44:20 +0100 (CET) (envelope-from daemon) From: naddy@mips.rhein-neckar.de (Christian Weisgerber) Subject: Re: dump over ssh Date: 9 Jan 2000 02:44:19 +0100 Message-ID: <858p5j$mu3$1@bigeye.rhein-neckar.de> References: <854v9q$1gf9$1@bigeye.rhein-neckar.de> To: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Christian Weisgerber wrote: > # dump -0aP ssh -f host:/dev/nrsa0 / BTW, I just noticed that the Linux port of dump contains equivalent functionality. No additional flag there, but the environment variable RSH is checked. Opinions on which approach is preferable? -- Christian "naddy" Weisgerber naddy@mips.rhein-neckar.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 8 18:31:29 2000 Delivered-To: freebsd-security@freebsd.org Received: from mls.gtonet.net (mls.gtonet.net [216.112.90.195]) by hub.freebsd.org (Postfix) with ESMTP id E6F9515003; Sat, 8 Jan 2000 18:31:20 -0800 (PST) (envelope-from freebsd@gtonet.net) Received: from pld (holeyman@pld.gtonet.net [216.112.90.200]) by mls.gtonet.net (8.9.3/8.9.3) with SMTP id SAA70561; Sat, 8 Jan 2000 18:31:19 -0800 (PST) (envelope-from freebsd@gtonet.net) From: "FreeBSD" To: , Cc: "freebsd-security@FreeBSD. ORG" Subject: RE: load spike strangeness Date: Sat, 8 Jan 2000 18:31:19 -0800 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <200001090206.DAA75669@dorifer.heim3.tu-clausthal.de> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > -----Original Message----- > From: owner-freebsd-current@FreeBSD.ORG > [mailto:owner-freebsd-current@FreeBSD.ORG]On Behalf Of Oliver Fromme > Sent: Saturday, January 08, 2000 6:06 PM > To: freebsd-stable@FreeBSD.ORG; freebsd-current@FreeBSD.ORG > Subject: Re: load spike strangeness > > > FreeBSD wrote in list.freebsd-stable: > > Overclocking is *NEVER* recommended > > Neither is posting anonymously (without a realname). > Since when does an E-mail address require a "realname"? Only a imbecile (IMHO) would use their real name on an e-mail that goes out to a public list. I don't want people to know my real name or SSN or any other personal info for that matter, NOR is it required, as far as I know. If it were to become required, I'd prefer to "unsubscribe" than to give that info out, as would any other intelligent person. I suggest you check your e-mail security information again before babbling nonsense. My e-mail addy is a REAL addy not one that goes through an anonymous re-mailer and I use it so IF I start getting Spam I can easily rmuser it and create another to resubscribe. Do you also use you real full name on IRC? To quote "Mr. T": "I pity da f00!" FreeBSD freebsd@gtonet.net "LinSUX is only free if your time is worthless" P.S. To kill 2 birds with one stone... David Bushong: The info about overclocking was mentioned by Jordan, himself, on IRC in #FreeBSD (I'm not sure which network though) If you'd like, I can dig through IRC logs and try to find it but I'd prefer to take this to private e-mail instead. Let me know. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 8 18:41: 3 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.heim6.tu-clausthal.de (elch.heim4.tu-clausthal.de [139.174.244.250]) by hub.freebsd.org (Postfix) with ESMTP id 39DDF15003 for ; Sat, 8 Jan 2000 18:41:00 -0800 (PST) (envelope-from stefan.muehling@tu-clausthal.de) Received: (nice.heim6.tu-clausthal.de [139.174.246.136]) by mail.heim6.tu-clausthal.de (8.9.3/8.9.3) with SMTP id DAA27212 for ; Sun, 9 Jan 2000 03:40:58 +0100 (MET) Message-ID: <003e01bf5a4b$1ab834b0$88f6ae8b@heim6.tuclausthal.de> From: =?iso-8859-1?Q?Stefan_M=FChling?= To: References: <855m0c$2atg$1@atlantis.rz.tu-clausthal.de> Subject: Re: Sudden crashing? Date: Sun, 9 Jan 2000 03:42:00 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi! > So far, one of my servers, a BSD 3.2-R machine, has mysteriously crashed > twice this week. This machine functions as a gateway and firewall to our > internet connection, so it's the most visible host here. I use ipfw to > block pretty much all the low ports except those we really need, such as > ssh, ntp, smtp, etc... Do you have two network cards installed in this machine? I experienced such a problem using bridging with two cards in my server. Someone showed me logs in which both Mac-Adresses of my cards were logged on one IP. The time in the logs and my hangtime are the same. Now i'm running without bridging (using a hub) and it works pretty fine now. I'm am running a FreeBSD 3.3-SNAPSHOT. Perhaps that helps. I'm a newby and can not really help you. So sorry, if a said something wrong. > > I don't see anything in the logs indicating what might have happened. > > Not only that, but ipfw *refuses* to log to syslog on this box!?! My > /etc/syslog.conf is an exact copy of the same file on another machine > which DOES correctly log ipfw. Bye! Stefan To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 8 18:41:51 2000 Delivered-To: freebsd-security@freebsd.org Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2]) by hub.freebsd.org (Postfix) with ESMTP id 721BE14EB3; Sat, 8 Jan 2000 18:41:41 -0800 (PST) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.3/8.9.1) id SAA14565; Sat, 8 Jan 2000 18:41:30 -0800 (PST) (envelope-from dillon) Date: Sat, 8 Jan 2000 18:41:30 -0800 (PST) From: Matthew Dillon Message-Id: <200001090241.SAA14565@apollo.backplane.com> To: "FreeBSD" Cc: , , "freebsd-security@FreeBSD. ORG" Subject: Re: RE: load spike strangeness References: Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org :> : :Since when does an E-mail address require a "realname"? Only a imbecile :(IMHO) would use their real name on an e-mail that goes out to a public :list. I don't want people to know my real name or SSN or any other personal :info for that matter, NOR is it required, as far as I know. If it were to :become required, I'd prefer to "unsubscribe" than to give that info out, as :would any other intelligent person. I suggest you check your e-mail security :information again before babbling nonsense. My e-mail addy is a REAL addy :not one that goes through an anonymous re-mailer and I use it so IF I start :getting Spam I can easily rmuser it and create another to resubscribe. Do :you also use you real full name on IRC? To quote "Mr. T": "I pity da f00!" : :FreeBSD :freebsd@gtonet.net : :"LinSUX is only free if your time is worthless" It depends on whether you want people to take you seriously or not. Frankly, not using your real name puts you at a disadvantage right off the bat. Personally speaking, I use my real name to add to the glory of all the Matt Dillon's out there in the world, so people will remember the name after I die, and be refering to me, myself, and I! I don't plan on going out as a red-shirt. :-) -Matt Matthew Dillon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message From owner-freebsd-security Sat Jan 8 19:12:16 2000 Delivered-To: freebsd-security@freebsd.org Received: from dccserver.com (lax-29-a-114.lax.dsl.cerfnet.com [206.18.16.114]) by hub.freebsd.org (Postfix) with ESMTP id 8BA7814E13; Sat, 8 Jan 2000 19:11:24 -0800 (PST) (envelope-from admin@dccserver.com) Received: from dccserver.att.com [206.18.16.114] by dccserver.com (SMTPD32-5.08 EVAL) id ABF6DA02D0; Sat, 08 Jan 2000 19:09:42 -0800 MIME-Version: 1.0 From: admin@dccserver.com Reply-To: admin@dccserver.com To: admin@dccserver.com Subject: Discount Capital For Commercial Equipment Mime-Version: 1.0 Content-Type: text/html; charset="us-ascii" Message-Id: <200001081910649.SM00184@dccserver.att.com> Date: Sat, 8 Jan 2000 19:10:10 -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org em general doc

Discount Capital

For

Equipment Leasing & Financing

 

We provide financing for Commercial Equipment, Upgrading or Expansion & High-Tech Equipment Leasing.

 

100% Financing on New & Used Equipment.

 

Sale Lease backs, Debt Consolidations,

 

Deferred Payment plans, lets you generate revenue with your new investment before you have to pay for it.

 

Financing programs for ALL credit profiles.

 

Use our Asset Location Division to help find the equipment you need.

Discount Capital Corp.

10101 Slater Ave. Suite 123-A

Fountain Valley, CA 92708

Phone: (877)346-MONY(6669) Fax: (714)593-0326

Don't Respond To This Address As It Is Not Monitored

E-Mail us @ info@discountcapital.net or visit out web site http://www.discountcapital.net/

To Stop Receiving Our Mail, Click On The Remove Link And Type

"Remove" In The Subject Line.           remove@discountcapital.net

To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message