Re: SUID program removal

From: Jason Day (jasonday@mediaone.net)
Date: 10/19/01 

Date: Fri, 19 Oct 2001 11:47:44 -0400
From: Jason Day <jasonday@mediaone.net>
To: "Johannes B. Ullrich" <jullrich@euclidian.com>
Subject: Re: SUID program removal
Message-ID: <20011019114744.A1335@spiderman.cherlon.com>

On Wed, Oct 17, 2001 at 09:40:08PM -0400, Johannes B. Ullrich wrote:
[snip]
> ssh should stay suid...
> /usr/bin/ssh

Only if you need to use rhosts-based authentication, which you also
recommend against (so would I ;). You can (and should, IMHO) safely remove
the suid bit on ssh, as long as you tell ssh to not use a privileged port,
either by using the -P option, or by setting "UsePrivilegedPort no" in the
ssh config file.

[rest snipped] 

-- 
Jason Day                                       jasonday at
http://jasonday.home.att.net                    mediaone dot net
 
"Of course I'm paranoid, everyone is trying to kill me."
    -- Weyoun-6, Star Trek: Deep Space 9

Relevant Pages

  • Re: SUID program removal
    ... > Only if you need to use rhosts-based authentication, ... requires the suid bit and is secure. ... > You can safely remove the suid bit on ssh, as long as ... > you tell ssh to not use a privileged port, either by using the -P option, ...
    (Focus-Linux)
  • Re: OpenSSH (all versions between 2.0 and 3.0.2) local root exploit
    ... >> ssh is suid. ... Or do you leave your host private key publically ... >authentication, which is usually completely nutso and unnecessary to allow. ...
    (comp.security.ssh)
  • Re: OpenSSH (all versions between 2.0 and 3.0.2) local root exploit
    ... Neil> unless ssh is suid. ... but it does not have to be suid *root*. ... your hostkeys to a different account foo, ...
    (comp.security.ssh)
  • Re: Making an image of my HDD
    ... Unless you need to encrypt, I recommend that you just use netcat ... instead of ssh, ... I also recommend a larger block size. ...
    (Debian-User)
  • ssh: setld conflict when updating
    ... I am currently running ssh 3.2.0 including patches ... (Security Related Patches) ... I would now like to update to ssh 3.2.3, as available from the HP website. ... The installation instructions included with the kit recommend to remove all ...
    (Tru64-UNIX-Managers)