From owner-freebsd-questions@FreeBSD.ORG Fri Feb 4 06:01:14 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 031A616A4CE for ; Fri, 4 Feb 2005 06:01:14 +0000 (GMT) Received: from aiolos.otenet.gr (aiolos.otenet.gr [195.170.0.23]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5284443D48 for ; Fri, 4 Feb 2005 06:01:12 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from gothmog.gr (patr530-b169.otenet.gr [212.205.244.177]) j14618QU002307; Fri, 4 Feb 2005 08:01:08 +0200 Received: from gothmog.gr (gothmog [127.0.0.1]) by gothmog.gr (8.13.1/8.13.1) with ESMTP id j14617NY051927; Fri, 4 Feb 2005 08:01:07 +0200 (EET) (envelope-from keramida@ceid.upatras.gr) Received: (from giorgos@localhost) by gothmog.gr (8.13.1/8.13.1/Submit) id j14617k6051926; Fri, 4 Feb 2005 08:01:07 +0200 (EET) (envelope-from keramida@ceid.upatras.gr) Date: Fri, 4 Feb 2005 08:01:07 +0200 From: Giorgos Keramidas To: Gert Cuykens Message-ID: <20050204060106.GB51807@gothmog.gr> References: <4202B512.9080306@cis.strath.ac.uk> <4202BC4E.4090809@cis.strath.ac.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: cc: freebsd-questions@freebsd.org cc: Chris Hodgins Subject: Re: ssh default security risc X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2005 06:01:14 -0000 On 2005-02-04 01:04, Gert Cuykens wrote: > On Fri, 04 Feb 2005 00:05:34 +0000, Chris Hodgins > wrote: > True but the point is without the ssh root enabled there is nothing > you can do about it to stop them if they change your user password What user password? You are using SSH keys, as many have noted in earlier posts of the thread, right? :P Seriously now. What gave you the crazy idea that having local access as an unprivileged user means that automatically you are also root? Effort is *still* needed. Effort that the average Joe Random Cracker is _NOT_ going to spend. You may also want to consider than having SSH enabled for root means there is only ONE step at becoming root from any remote location. Having to SSH as a user first, with the right combination of SSH keys and passwords, and then use su(1) with yet another password is at least one more step. Why is the first, 1-step procedure safer than the second? - Giorgos