From owner-freebsd-questions  Thu Jun 27 14:14:55 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from smtp.infracaninophile.co.uk (happy-idiot-talk.infracaninophile.co.uk [81.2.69.218])
	by hub.freebsd.org (Postfix) with ESMTP id 2BEF937B400
	for <freebsd-questions@FreeBSD.ORG>; Thu, 27 Jun 2002 14:14:47 -0700 (PDT)
Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1])
	by smtp.infracaninophile.co.uk (8.12.4/8.12.4) with ESMTP id g5RLEktD006301;
	Thu, 27 Jun 2002 22:14:46 +0100 (BST)
	(envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk)
Received: (from matthew@localhost)
	by happy-idiot-talk.infracaninophile.co.uk (8.12.4/8.12.4/Submit) id g5RLEeDh006300;
	Thu, 27 Jun 2002 22:14:40 +0100 (BST)
Date: Thu, 27 Jun 2002 22:14:40 +0100
From: Matthew Seaman <m.seaman@infracaninophile.co.uk>
To: Steven Lake <raiden@shell.core.com>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: sshd_config question
Message-ID: <20020627211440.GB5504@happy-idiot-talk.infracaninophi>
References: <Pine.GSO.4.44L0.0206271550130.26498-100000@shell.core.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.GSO.4.44L0.0206271550130.26498-100000@shell.core.com>
User-Agent: Mutt/1.5.1i
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

On Thu, Jun 27, 2002 at 03:53:38PM -0500, Steven Lake wrote:

> 	HI all.  Quick question.  After doing some reading I noticed
> something about the openssh vulnerability and I had a question.  Here's my
> sshd_config file, does it have everything set correctly to be clear of the
> vulnerability?  Just curious.  Thanks.

Looks like you're using OpenSSH-2.9 as supplied with 4-STABLE.
According to CERT (http://www.cert.org/advisories/CA-2002-18.html),
all that is necessary for that version is:

   ChallengeResponseAuthentication no

You're fine.

Later versions (2.9.9 - 3.4p1) should also have:

   PAMAuthenticationViaKbdInt no
   UsePrivilegeSeparation yes

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
Tel: +44 1628 476614                                  Marlow
Fax: +44 0870 0522645                                 Bucks., SL7 1TH UK

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message