[gentoo-dev] OpenSSH 3.7 compatibility problems

[Andrea Barisani]

It also seems that there are some compatibility problems between openssh and
other ssh clients.

Old version of putty and other UNIX ssh clients doesn't work with 'UsePAM yes' 
and 'PasswordAuthentication no'.

Any suggestions/reports about that?

Bye


On Wed, Sep 17, 2003 at 02:43:40AM -0400, Mike Frysinger wrote:
Content-Description: signed data
> the new 3.7.x series has updated the default settings/values/etc... of the
> sshd_config file.  this is just a heads up to make sure that in your rush to
> update all your ssh servers, you didn't miss a step and accidentally open up
> your server to previously unauthorized access.
>
> (1) default PAM setting has been changed to YES
> (1a) the keyword for toggling PAM auth has been changed from
> 'PAMAuthenticationViaKbdInt' to 'UsePAM'
>
> (2) if you disabled (set it to no) the PasswordAuthentication feature before
> so as to prevent users from logging in with a password (say you only wanted
> them to utilize keys), then you must explicitly set UsePAM to no, otherwise
> the PasswordAuthentication step will be bypassed by PAM
>
> (3) if you use PasswordAuthentication and PAM (the default config file does
> this), then users may now be authenticated via either option.  you may notice
> this when you attempt to log in, fail password checking 3 times, and suddenly
> get a different prompt.  this is because the first check (via PAM) failed and
> ssh is now falling back to password authentication.
> PAM authentication gives you this prompt:
> Password:
> PasswordAuthentication gives you this prompt:
> UserBah@rux0r's password:
>
> i think that about covers it ... for some people you may be annoyed by this
> e-mail, others may thank Gentoo devs for it ... just remember:
> (1) we all love security (more security, less rooting == better world)
> (2) knowledge is half the battle !
>
> -mike


--
------------------------------------------------------------
INFIS Network Administrator & Security Officer         .*. 
Department of Physics       - University of Trieste    /V\
lcars@××××××××××××××××××.it - PGP Key 0x8E21FE82      (/ \)
----------------------------------------------------  (   )
"How would you know I'm mad?" said Alice.             ^^-^^
"You must be,'said the Cat,'or you wouldn't have come here."
------------------------------------------------------------

--
gentoo-dev@g.o mailing list