SSH tty allocation

From: JoeFSO (JoeFSO_at_hotmail.com)
Date: 04/29/04 

Date: 29 Apr 2004 07:11:53 -0700

Hi,

If you use chrsh to allow users shell access and use SSH, please be
aware that some versions of the SSH server can permit the remote user
to bypass their local shell setting ("ssh -l username -t hostname
/bin/sh") and still get access to a shell that is NOT chrooted. This
problem does NOT affect all users of SSH. Additionally, keep in mind
that SSH may also permit the user to use IP forwarding, enabling the
user to act as if he/she were connecting FROM the server where SSH
resides, or even operate IP services that get forwarded to the user's
computer.

How do I disable this function in ssh? Would it have any side affects?

Joe.

Relevant Pages

  • Re: SFTP is not working
    ... When I try to use sftp or scp2, I get a message like this: ... sftp and scp2 both actually work by running ssh in a subprocess, ... The reason the shell startup files are relevant at all, ...
    (comp.security.ssh)
  • Re: Did you hack into my UNIX server Bible Bob?
    ... But that's not a shell question. ... >> OSX users, should I be using ssh instead of telnet for security? ... OSX as a built in firewall tab. ...
    (comp.unix.shell)
  • Re: using ssh to run remote commands? [ssh -T, scp/ssh flags]
    ... I use SSH to forward connections between an intranet server at home and my ... To do this, the user on the remote machine need not have a shell, either ... start a shell on the remote host, ... you can have ssh run a command instead of an interactive shell by ...
    (FreeBSD-Security)
  • Re: UK Shell Provider
    ... http://templarshells.mine.nu Services include access to linux programs, ... "Access to the Templar Server is via Ssh (Secure Shell). ...
    (uk.telecom.broadband)
  • Re: [fw-wiz] Best-of-breed Proxies (was Re: Proxy Firewalls ...)
    ... >> It used a chrooted sshd with private passwd/shadow files in the ... >> chroot jail. ... The login shell for the users in that private passwd ... >> config file to get a destination host, and execed an ssh client to ...
    (Firewall-Wizards)