Re: How to use SSH and password aging together on AIX 5.1?
From: Jan-Frode Myklebust (janfrode@parallab.uib.no)Date: 06/06/02
- Next message: Ian Gregory: "Re: How safe am I?"
- Previous message: : "SSH2 Upgrade Problem"
- In reply to: those who know me have no need of my name: "Re: How to use SSH and password aging together on AIX 5.1?"
- Next in thread: Kevin Steves: "Re: How to use SSH and password aging together on AIX 5.1?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Jan-Frode Myklebust <janfrode@parallab.uib.no> Date: 6 Jun 2002 07:34:32 GMT
On 05 Jun 2002 14:41:15 GMT, those who know me have no need of my name <not-a-real-address@usa.net> wrote:
> in comp.security.ssh i read:
>
>>I am installing an IBM AIX 5.1 multi-user server at the moment. In the light
>>of security we want to:
>> 1 restrict access to the system to a safe protocol such as SSH
>> 2 use AIX built-in facilities to force users to change their
>>passwords after they have expired or been set by root.
>
> sorry, but i passed right over what you wanted to do in trying to eliminate
> the error message.
>
> ssh is not the tool you want. why? because it presumes to know how to
> authenticate users, i.e., it *intends* to replace your login program
> entirely.
Rubish. sshd tries to use as much as it can to set up the same login environment
as other login programs. That it doesn't check for expired password can be seen
as a bug, as it does seem to check the expiry field on other systems (either via PAM
or manually).
I don't think it should be too hard to add this feature to ssh, as most of it
already seems t obe there. You just need the AIX specific parts.. On the other hand,
AIX 5.2 is supposed to come with PAM _and_ PAM libraries, so that might be a better
solution than hacking up special routines for AIX.
>
> i suggest you look into moving to an ssl environment, e.g., daemons of this
> kind can usually be configured to reject non-ssl sessions (which prevents
> clear-text transfer of client credentials), or to a kerberized environment
> (which aix natively supports). another alternative may be ipsec or ipv6,
> though i'm not sure how well it's supported by aix.
>
ssl-tunneling can be a solution, but it's hard to set up for the users and it's
very limited compared to ssh.
-jf
- Next message: Ian Gregory: "Re: How safe am I?"
- Previous message: : "SSH2 Upgrade Problem"
- In reply to: those who know me have no need of my name: "Re: How to use SSH and password aging together on AIX 5.1?"
- Next in thread: Kevin Steves: "Re: How to use SSH and password aging together on AIX 5.1?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
