Date: Wed, 10 Jul 2002 03:26:02 +0400 From: "Andrey A. Chernov" <ache@nagual.pp.ru> To: Dag-Erling Smorgrav <des@ofug.org> Cc: current@freebsd.org Subject: Re: OPIE auth broken too (was Re: PasswordAuthentication not works in sshd) Message-ID: <20020709232559.GA23499@nagual.pp.ru> In-Reply-To: <xzpr8icinnb.fsf@flood.ping.uio.no> References: <20020702114530.GB837@nagual.pp.ru> <xzpn0tacp9c.fsf@flood.ping.uio.no> <20020709124943.GA15259@nagual.pp.ru> <xzphej9jb3i.fsf@flood.ping.uio.no> <20020709133611.GA17322@nagual.pp.ru> <xzpd6txj93r.fsf@flood.ping.uio.no> <20020709164108.GA19075@nagual.pp.ru> <xzpr8icinnb.fsf@flood.ping.uio.no>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jul 09, 2002 at 23:42:32 +0200, Dag-Erling Smorgrav wrote: > Seriously, can you please turn down the hysteria a couple of notches > and give me a proper bug report? On Tue, Jul 09, 2002 at 23:42:32 +0200, Dag-Erling Smorgrav wrote: > Seriously, can you please turn down the hysteria a couple of notches > and give me a proper bug report? This is not the hysteria, just short way to say things. I can try, at least, to reword my reports more verbose. Consider following setup: OPIE is active and allow Unix plaintext passwords for local users only (i.e. common way of using OPIE). Then lets disable all sshd auth methods excepting "PasswordAuthentication yes" in sshd_config. All other sshd and PAM things are in the default state. For remote ssh logins we have two bugs in that scenario, one is questionable and another one is true. 1st bug is questionable: violating documented ssh way of turning OPIE on. I'll return here later and now will mention only one thing: you say that we have an enhancement here, but this enhancement is not working, because of -- 2nd bug is true: no OTP prompt in the scenario above. I.e. even if user want to enter OPIE password, he can't do that because he can't calculate it because he not see something like otp-md5 9960 pa4106 ext ache@xxx.xx password: but see only: ache@xxx.xx password: (no OTP prompt). Now lets return to 1st bug. 1) It is client-related, so even if you'll fix sshd to print OTP prompt, many ssh clients (f.e. Windows ones) not understand this new prompt, i.e. not display it at all or even produce fault. 2) One of the main purposes of OTP is to avoid sending cleartext password over net, but ssh already not does that. When user calls ssh from secure end point, using OTP gains nothing unlike for other programs, only slow entering process down (calculating response). This two reasons means that it will be better to not turn OPIE on for sshd by default. -- Andrey A. Chernov http://ache.pp.ru/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020709232559.GA23499>