Date: Sun, 27 Feb 2000 01:05:20 -0800 (PST) From: Doug White <dwhite@resnet.uoregon.edu> To: Kris Kennaway <kris@FreeBSD.ORG> Cc: Bjoern Groenvall <bg@sics.se>, "Jordan K. Hubbard" <jkh@zippy.cdrom.com>, current@FreeBSD.ORG, markm@FreeBSD.ORG Subject: Re: OpenSSH /etc patch Message-ID: <Pine.BSF.4.21.0002270102300.63350-100000@resnet.uoregon.edu> In-Reply-To: <Pine.BSF.4.21.0002261535380.98970-100000@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 26 Feb 2000, Kris Kennaway wrote: > On 26 Feb 2000, Bjoern Groenvall wrote: > > > Right, the code does not lie (if ssh is setuid root). But, if the host > > key has not yet been created, then no host can have the public key and > > thus rsa-rhosts authentication won't work anyways. It is not required > > to run ssh-keygen to make ssh work, Sshd still requires the host key > > to operate. > > I don't follow you - if no host key is generated, then you can't ever use > the RSA-rhosts authentication mechanism to log into another server until > you do. Thus part of ssh's functionality is broken until you generate that > key, so we do it for you the first time you boot. I was under the impression that host keys are exchanged before the authentication type is selected, so a) the identity of the remote is compared to known_hosts and reacted to accordingly, and b) the remainder of the session is encrypted no matter what auth type (so, i.e., the password is encrypted if RSA keys are not used). I'm thinking of the old/stock sshd, not OpenSSH, but I'm not aware of that big a change. If I'm wrong please beat me over the head with a large metal object and carry on like nothing happened. :) Doug White | FreeBSD: The Power to Serve dwhite@resnet.uoregon.edu | www.FreeBSD.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0002270102300.63350-100000>