Berkeley CSUA MOTD:Entry 16671
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/25 [General] UID:1000 Activity:popular
5/25    

1999/10/6-8 [Computer/SW/Mail, Computer/SW/Security] UID:16671 Activity:high
10/6    What is the reason for ssh being suid root?
        \_ ssh is setuid root for .shosts authentication.  The client
           connects to the server, proves its identity using its host
           key, and then sends your username to the server.  You can't
           write a fake client that sends someone else's username because
           the client connects from a reserved port (that's why it has
           to be setuid root).  You can't run a fake client as root on
           your own linux box because you don't have the real client's
           host key.
           make a fake client that sends someone else's username because
           the host key is only readable by root.

           If you don't use .shosts authentication, your ssh client does
           not need to be setuid.  --mconst
                \_ The remote server connects back to check or what?  I don't
                   see how your description prevents me from hacking my own
                   client and handing them my own user generated server key.
                        \_ It checks against it's own list of known keys
                           (in the system directory or the user's directory)
                           \_ Huh?  Waitasec... so I hack my own client to
                              return a key I've created which I'm falsely
                              telling the server is a valid key for my host.
                              How does it know I haven't made a hacked client?
                              There's too many pronouns floating around
                              confusing me.  Thanks.
                                \_ The server only trusts hosts it's talked to
                                   before and saves their public keys for
                                   future reference.  The only way to spoof
                                   that is break into the client and find it's
                                   private key (which is only readable by root
                                   on Unix boxes so non-root people can't do
                                   evil shit with it).
                                   \_ Hmmm.. ok.. but what if the only prior
                                      server contact was with my hacked client?
                                        \_ Then the user was a moron if they
                                           added your hacked client's key &
                                           hostname to their .shosts
                        \_ the server /etc/known_hosts file is maintained
                           by the sysadmin.  sshd won't add new hosts to it.
                                \_ Ok, got that.  I still don't see why I can't
                                   hack my own client to feed all bad info to
                                   the remote server from first contact to
                                   potential security violation.  If my client
                                   is the only source of info for the remote
                                   server and I've hacked my client to send
                                   false data, how does the other side know?
                                        \_ it doesn't, but it has no reason
                                           to care either.  You only get to
                                           login if your host in the .shosts
                                           and your key matches what the
                                           server thinks your host key is.
                                           Otherwise you lose.
ERROR, url_link recursive (eces.Colorado.EDU/secure/mindterm2) 2025/05/25 [General] UID:1000 Activity:popular
5/25    

You may also be interested in these entries...
2012/10/15-12/4 [Computer/SW/Mail] UID:54501 Activity:nil
10/15   What's the soda email client these days?
        \_ Don't know.  /usr/bin/mail hasn't been working for a while.
        \_ forward to Gmail.
        \_ mutt works for me
	...
2012/8/29-11/7 [Computer/SW/Security] UID:54467 Activity:nil
8/29    There was once a CSUA web page which runs an SSH client for logging
        on to soda.  Does that page still exist?  Can someone remind me of the
        URL please?  Thx.
        \_ what do you mean? instruction on how to ssh into soda?
           \_ No I think he means the ssh applet, which, iirc, was an applet
              that implemented an ssh v1 client.  I think this page went away
	...
2011/11/14-30 [Computer/SW/Security] UID:54228 Activity:nil
11/14   Social Engineering call centers:
        http://www.itbusiness.ca/it/client/en/home/News.asp?id=64887
	...
2011/2/14-4/20 [Computer/SW/Unix] UID:54039 Activity:nil
2/14    You sure soda isn't running windows in disguise?  It would explain the
        uptimes.
        \_ hardly, My winbox stays up longer.
        \_ Nobody cares about uptime anymore brother, that's what web2.0 has
           taught us.  Everything is "stateless".
           \_ You;d think gamers would care more about uptime.
	...
2011/4/6-20 [Computer/SW/Mail, Computer/SW/Unix, Industry/Startup] UID:54078 Activity:nil
4/6     My company is evaluating version control systems. Our two candidates
        are Perforce and Subversion. Anyone worked with both and have good
        arguments one way or the other? (These are the only two options we
        have.) We're most interested in client performance, ease of use, and
        reasonable branching.
        \_ I'll be 'that guy'. If perforce and subversion are optins, why isn't
	...
2010/8/8-9/7 [Computer/SW/Languages/C_Cplusplus, Computer/SW/Languages/Web] UID:53914 Activity:nil
8/8     Trying to make a list of interesting features languages have
        touted as this whole PL field comes around, trying to see if they
        have basis in the culture of the time: feel free to add some/dispute
        1970 C, "portability"
        1980 C++, classes, oop, iterators, streams, functors, templates
             expert systems
	...
2009/8/3-11 [Computer/HW/Laptop] UID:53235 Activity:low 70%like:53232
8/1     Where is the mac desktop going to go? It seems all the development
        in sw/hw now is for the iphone, imac.  2 finger Gestures won't work
        on the desktop.  What happened to the xserve line?
        \_ Two finger gestures DO work on the desktop.  Have you used a new
           Apple laptop lately...they support up to 5 finger gestures.
           \_ you're making my point even harder, do the 5 finger gestures
	...
2009/7/22-29 [Computer/SW/Mail] UID:53183 Activity:nil
7/22    How many people here use rss/atom, and how many people don't use it
        at all? If you use it, what client do you use? I'll start.
        \_ mix of google reader and safari subscription                 -kchang
        \_ I go to <DEAD>blogger.com<DEAD> and http://livejournal.com
        \_ I use NetNewsWire on mac.
	...
2009/4/26-29 [Computer/Networking] UID:52910 Activity:nil
4/25    I have an Airport Express.  is there some way to let computer
        1 ping computer 2?  both computers are connected to wireless network
        successfully.  I can get to internet on both of them.  I just can't
        ping each other.  weird.  maybe they think that's a feature?
        \_ Sounds like your router is enforcing client isolation. If you can't
           change the setting on the router you're probably SOL.
	...
2012/8/26-11/7 [Computer/SW/Security] UID:54465 Activity:nil
8/26    Poll: how many of you pub/priv key users: 1) use private keys that
        are not password protected 2) password protect your private keys
        but don't use ssh-agent 3) use ssh-agent:
        1) .
        2) ..
        3) ...
	...
2012/9/20-11/7 [Computer/SW/Unix, Finance/Investment] UID:54482 Activity:nil
9/20    How do I change my shell? chsh says "Cannot change ID to root."
        \_ /usr/bin/chsh does not have the SUID permission set. Without
           being set, it does not successfully change a user's shell.
           Typical newbie sys admin (on soda)
           \_ Actually, it does: -rwsr-xr-x 1 root root 37552 Feb 15  2011 /usr/bin/chsh
	...
2012/9/24-11/7 [Computer/SW/Languages, Computer/SW/Unix] UID:54484 Activity:nil
9/24    How come changing my shell using ldapmodify (chsh doesn't work) doesn't
        work either? ldapsearch and getent show the new shell but I still get
        the old shell on login.
        \_ Scratch that, it magically took my new shell now. WTF?
           \_ probably nscd(8)
	...
2012/8/7-10/17 [Computer/SW/Security] UID:54455 Activity:nil
8/6     Amazon and Apple have lame security policies:
        http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all
        "First you call Amazon and tell them you are the account holder, and
         want to add a credit card number to the account. All you need is the
         name on the account, an associated e-mail address, and the billing
         address. "
	...
2012/7/18-8/19 [Health/Men, Computer/SW/Security] UID:54438 Activity:nil
7/18    "Largest penis record holder arouses security suspicions at airport"
        http://www.csua.org/u/x2f (in.news.yahoo.com)
        \_ I often have that same problem.
        \_ I think the headline writer had some fun with that one.
           \_ One time when I glanced over a Yahoo News headline "U.S. busts
              largest-ever identity theft ring" all I saw was "U.S. busts
	...
2012/5/8-6/4 [Computer/SW/Unix] UID:54383 Activity:nil
5/8     Hello everyone!  This is Josh Hawn, CSUA Tech VP for Spring 2012.
        About 2 weeks ago, someone brought to my attention that our script
        to periodically merge /etc/motd.public into /etc/motd wasn't
        running.  When I looked into it, the cron daemon was running, but
        there hadn't been any root activity in the log since April 7th.  I
        looked into it for a while, but got lost in other things I was
	...
2012/4/23-6/1 [Computer/SW/WWW/Browsers] UID:54360 Activity:nil
4/19    My Firefox 3.6.28 pops up a Software Update box that reads "Your
        version of Firefox will soon be vulnerable to online attacks."  Are
        they planning to turn off some security feature in my version of
        Firefox?
        \_ Not as such, no, but they're no longer developing this version,
           so if a 3.6.x-targeted hack shows up, you're not going to get
	...