[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20171105051329.GB22636@takahe.colorado.edu>
Date: Sat, 4 Nov 2017 23:13:29 -0600
From: Leonid Isaev <leonid.isaev@...a.colorado.edu>
To: oss-security@...ts.openwall.com
Subject: Re: Security risk of server side text editing in
general and vim.tiny specifically
On Fri, Nov 03, 2017 at 03:39:00PM +0100, Solar Designer wrote:
> ... reuse sshd(8).
>
> And this last possibility brings us to what we can (and I sometimes do)
> use already - setting up temporary SSH keys with forced "cat < ..." or
> "cat > ..." commands, and using SSH for safely exchanging files by users
> of the same host, or of different hosts for this matter. It's just
> manual setup each time, and we could want to provide convenient tools to
> automate that.
Ah, great :) I've been using sshd and ssh as a sudo replacement on all
machines, inspired by your old article about insecurities of the latter (with
locked root password, so su also doesn't work). Of course, sshd is in general
listens on localhost:22. As for the keys, the keypair to access root, as well
as root's authorized_keys file, are generated at each boot and stored in tmpfs.
Thanks for the idea,
--
Leonid Isaev
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
