7:35 a.m.
Updated Packages:
ash-0.3.8-19
------------
* Mon Jun 07 2004 Lon Hohberger <lhh(a)redhat.com> 0.3.8-19
- Remove alpha-specific hacks; no longer necessary + cause
builds to break.
cyrus-sasl-2.1.18-4
-------------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 2.1.18-4
- enable sql auxprop support in a subpackage
- include LDAP_SASLAUTHD documentation file (#124830)
* Fri Jun 04 2004 Nalin Dahyabhai <nalin(a)redhat.com>
- turn on ntlm
devlabel-0.48.03-1
------------------
dietlibc-0.25-2
---------------
* Mon Jun 07 2004 Jeremy Katz <katzj(a)redhat.com> - 0.25-2
- use old qsort implementation, it was faster for our purposes
* Wed May 26 2004 Jeremy Katz <katzj(a)redhat.com> - 0.25-1
- update to 0.25
krb5-1.3.3-8
------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 1.3.3-8
- rebuild
* Fri Jun 04 2004 Nalin Dahyabhai <nalin(a)redhat.com> 1.3.3-7
- rebuild
* Fri Jun 04 2004 Nalin Dahyabhai <nalin(a)redhat.com> 1.3.3-6
- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
nss_ldap-220-1
--------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 220-1
- update to 220, pam_ldap 169
* Thu Apr 15 2004 Nalin Dahyabhai <nalin(a)redhat.com>
- fail at build-time if the modules produced can't be loaded
- fix missing module in pam_ldap build
openssh-3.8.1p1-1
-----------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
- request gssapi-with-mic by default but not delegation (flag day for anyone
who used previous gssapi patches)
- no longer request x11 forwarding by default
openssl-0.9.7a-37
-----------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 0.9.7a-37
- build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)
rpmdb-fedora-2-0.20040608
-------------------------
selinux-policy-strict-1.13.4-2
------------------------------
* Mon Jun 07 2004 Dan Walsh <dwalsh(a)redhat.com> 1.13.4-2
- Add most of Russell's mods
* Mon Jun 07 2004 Dan Walsh <dwalsh(a)redhat.com> 1.13.4-1
- Handle newrole changes for new design
- Update to latest from NSA
selinux-policy-targeted-1.13.4-2
--------------------------------
* Mon Jun 07 2004 Dan Walsh <dwalsh(a)redhat.com> 1.13.4-2
- Apply allot of Russell's mods
* Mon Jun 07 2004 Dan Walsh <dwalsh(a)redhat.com> 1.13.4-1
- Handle newrole changes for new design
- Update to latest from NSA
subversion-1.0.4-1
------------------
* Sat May 22 2004 Joe Orton <jorton(a)redhat.com> 1.0.4-1
- update to 1.0.4
* Fri May 21 2004 Joe Orton <jorton(a)redhat.com> 1.0.3-2
- build /usr/bin/* as PIEs
- add fix for libsvn_client symbol namespace violation (r9608)
* Wed May 19 2004 Joe Orton <jorton(a)redhat.com> 1.0.3-1
- update to 1.0.3
7:45 a.m.
openssh-3.8.1p1-1
-----------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
- request gssapi-with-mic by default but not delegation (flag day for
anyone who used previous gssapi patches)
- no longer request x11 forwarding by default
Why no X11 forwarding by default ?
thanks
Aurélien
--
http://gauret.free.fr ~~~~ Jabber : gauret(a)amessage.info
"Les hommes perdent la santé pour gagner de l'argent et, après, dépensent
cet argent pour récupérer la santé. Ils vivent comme s'ils n'allaient
jamais mourir et meurent comme s'ils n'avaient jamais vécu." -- Dalaï Lama
7:59 a.m.
On Tue, Jun 08, 2004 at 02:45:23PM +0200, Aurelien Bompard wrote:
> openssh-3.8.1p1-1
> -----------------
> * Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
>
> - request gssapi-with-mic by default but not delegation (flag day for
> anyone who used previous gssapi patches)
> - no longer request x11 forwarding by default
Why no X11 forwarding by default ?
It's not the default upstream, for good reasons, and people have always
been able to override the default either in ~/.ssh/config or by passing
the -X (and now, also -Y) flag on the ssh command line.
HTH,
Nalin
9:35 a.m.
On Tue, 2004-06-08 at 08:59 -0400, Nalin Dahyabhai wrote:
On Tue, Jun 08, 2004 at 02:45:23PM +0200, Aurelien Bompard wrote:
> > openssh-3.8.1p1-1
> > -----------------
> > * Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
> >
> > - request gssapi-with-mic by default but not delegation (flag day for
> > anyone who used previous gssapi patches)
> > - no longer request x11 forwarding by default
>
> Why no X11 forwarding by default ?
It's not the default upstream, for good reasons, and people have always
been able to override the default either in ~/.ssh/config or by passing
the -X (and now, also -Y) flag on the ssh command line.
HTH,
Nalin
Ouch. Please make sure if you errata that change for RHEL that a
*BIG*FAT*WARNING* appears somewhere in the errata announcement. I can
hear the howls of protest already.
--
Chris Kloiber
9:39 a.m.
Once upon a time Wednesday 09 June 2004 12:35 am, Chris Kloiber wrote:
On Tue, 2004-06-08 at 08:59 -0400, Nalin Dahyabhai wrote:
> On Tue, Jun 08, 2004 at 02:45:23PM +0200, Aurelien Bompard wrote:
> > > openssh-3.8.1p1-1
> > > -----------------
> > > * Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
> > >
> > > - request gssapi-with-mic by default but not delegation (flag day for
> > > anyone who used previous gssapi patches)
> > > - no longer request x11 forwarding by default
> >
> > Why no X11 forwarding by default ?
>
> It's not the default upstream, for good reasons, and people have always
> been able to override the default either in ~/.ssh/config or by passing
> the -X (and now, also -Y) flag on the ssh command line.
>
> HTH,
>
> Nalin
Ouch. Please make sure if you errata that change for RHEL that a
*BIG*FAT*WARNING* appears somewhere in the errata announcement. I can
hear the howls of protest already.
--
Chris Kloiber
Considering Red Hats policy of recomending for RHEL that you use the gui
tools for configuration i dont think it should be turned off perhaps made
safer somehow but im guessing alot of enterprise admins wont be happy.
Dennis
10:16 a.m.
On Tue, 2004-06-08 at 08:39, Dennis Gilmore wrote:
Once upon a time Wednesday 09 June 2004 12:35 am, Chris Kloiber
wrote:
> On Tue, 2004-06-08 at 08:59 -0400, Nalin Dahyabhai wrote:
> > On Tue, Jun 08, 2004 at 02:45:23PM +0200, Aurelien Bompard wrote:
> > > > openssh-3.8.1p1-1
> > > > -----------------
> > > > * Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
> > > >
> > > > - request gssapi-with-mic by default but not delegation (flag day
for
> > > > anyone who used previous gssapi patches)
> > > > - no longer request x11 forwarding by default
> > >
> > > Why no X11 forwarding by default ?
> >
> > It's not the default upstream, for good reasons, and people have always
> > been able to override the default either in ~/.ssh/config or by passing
> > the -X (and now, also -Y) flag on the ssh command line.
> >
> > HTH,
> >
> > Nalin
>
> Ouch. Please make sure if you errata that change for RHEL that a
> *BIG*FAT*WARNING* appears somewhere in the errata announcement. I can
> hear the howls of protest already.
>
> --
> Chris Kloiber
Considering Red Hats policy of recomending for RHEL that you use the gui
tools for configuration i dont think it should be turned off perhaps made
safer somehow but im guessing alot of enterprise admins wont be happy.
Hopefully by the time it gets rolled into RHEL 3U3 or RHEL4 it will have
the Xsecurity items that Alan mentioned working in a clean fashion.
--
Stephen John Smoogen smoogen(a)lanl.gov
Los Alamos National Lab CCN-5 Sched 5/40 PH: 4-0645
Ta-03 SM-1498 MailStop B255 DP 10S Los Alamos, NM 87545
-- Please, I have had too much of the stupid today. Please wait until
-- tomorrow to say these things so my tolerance has refreshed.
8:05 a.m.
On Tue, Jun 08, 2004 at 02:45:23PM +0200, Aurelien Bompard wrote:
Why no X11 forwarding by default ?
Suppose the machine you log into has been trojanned in some way. X forwarding
allows an app on the trojanned machine not just to display on your system
but to fake events, to capture screen data live and so on.
I'd rather it used XSecurity extensions by default instead of no X11, but
the no-X11 default is more secure than X11 by default
10:21 a.m.
New subject: OpenSSH Re: rawhide report: 20040608 changes
On Tue, 2004-06-08 at 06:35, Build System wrote:
openssh-3.8.1p1-1
-----------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
- request gssapi-with-mic by default but not delegation (flag day for anyone
who used previous gssapi patches)
That will be us. Nalin, are you putting in the
'backwards-compatible-patch' that Simon posted? I am at the other end of
a 28.8 modem today so I cant look at the source easily :(.
Also do you know what is left out from Simons original patches to the
new ones? I am needing to know this for a larger deployment when this
gets rolled into RHEL where we have been distributing 3.6 with older
patches. I know that the OpenSSH 3.8 series contains some parts of the
patches but not all until there is enough requests or someone pays Simon
to do the rest :).
- no longer request x11 forwarding by default
Will the Xsecurity extensions be looked at in the future.
Thanks Nalin.
openssl-0.9.7a-37
-----------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 0.9.7a-37
--
Stephen John Smoogen smoogen(a)lanl.gov
Los Alamos National Lab CCN-5 Sched 5/40 PH: 4-0645
Ta-03 SM-1498 MailStop B255 DP 10S Los Alamos, NM 87545
-- Please, I have had too much of the stupid today. Please wait until
-- tomorrow to say these things so my tolerance has refreshed.
12:34 p.m.
New subject: OpenSSH Re: rawhide report: 20040608 changes
On Tue, Jun 08, 2004 at 09:21:38AM -0600, Stephen Smoogen wrote:
On Tue, 2004-06-08 at 06:35, Build System wrote:
> openssh-3.8.1p1-1
> -----------------
> * Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
>
> - request gssapi-with-mic by default but not delegation (flag day for anyone
> who used previous gssapi patches)
That will be us. Nalin, are you putting in the
'backwards-compatible-patch' that Simon posted? I am at the other end of
a 28.8 modem today so I cant look at the source easily :(.
It's in the .src.rpm, but not applied (see line 221 in the spec file).
Once applied, you'll need to set "GssapiEnableMitmAttack yes" (no, I'm
not making that up) in the sshd_config to enable it at run-time.
I thought about applying it in general, but reasoned that not applying a
backwards-compatibility patch for a patch which we didn't originally
apply was more consistent -- that way the code most users run is as
affected (or not) by it as they were before. That's not set in stone,
though.
Also do you know what is left out from Simons original patches to
the
new ones? I am needing to know this for a larger deployment when this
gets rolled into RHEL where we have been distributing 3.6 with older
patches. I know that the OpenSSH 3.8 series contains some parts of the
patches but not all until there is enough requests or someone pays Simon
to do the rest :).
The gssapi-with-mic support is authentication only AFAIK. So no gssapi
key exchange, which you may miss if you had gotten used to not having to
accept (or even create) ssh host public keys. The credential forwarding
works well.
> - no longer request x11 forwarding by default
Will the Xsecurity extensions be looked at in the future.
I couldn't say. I hope so.
HTH,
Nalin
3:44 p.m.
New subject: OpenSSH Re: rawhide report: 20040608 changes
On Tue, 2004-06-08 at 11:34, Nalin Dahyabhai wrote:
On Tue, Jun 08, 2004 at 09:21:38AM -0600, Stephen Smoogen wrote:
> On Tue, 2004-06-08 at 06:35, Build System wrote:
> > openssh-3.8.1p1-1
> > -----------------
> > * Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
> >
> > - request gssapi-with-mic by default but not delegation (flag day for anyone
> > who used previous gssapi patches)
>
> That will be us. Nalin, are you putting in the
> 'backwards-compatible-patch' that Simon posted? I am at the other end of
> a 28.8 modem today so I cant look at the source easily :(.
It's in the .src.rpm, but not applied (see line 221 in the spec file).
Once applied, you'll need to set "GssapiEnableMitmAttack yes" (no, I'm
not making that up) in the sshd_config to enable it at run-time.
I thought about applying it in general, but reasoned that not applying a
backwards-compatibility patch for a patch which we didn't originally
apply was more consistent -- that way the code most users run is as
affected (or not) by it as they were before. That's not set in stone,
though.
I agree.. I do know that several of the labs we work with use the GSSAPI
patch in one shape or another.. so just having it there is good enough
for most of us as we are making our own rebuilds but have to show that
it is from 'upstream'
> Also do you know what is left out from Simons original patches to the
> new ones? I am needing to know this for a larger deployment when this
> gets rolled into RHEL where we have been distributing 3.6 with older
> patches. I know that the OpenSSH 3.8 series contains some parts of the
> patches but not all until there is enough requests or someone pays Simon
> to do the rest :).
The gssapi-with-mic support is authentication only AFAIK. So no gssapi
key exchange, which you may miss if you had gotten used to not having to
accept (or even create) ssh host public keys. The credential forwarding
works well.
ah ok. that is where I was fuzzy on where gssapi key exchange came into
play. It is where the kerberos server authenticates the client to the
server and server to client?
Getting the credential forwarding is actually the big issue for most of
the scientists.
> > - no longer request x11 forwarding by default
>
> Will the Xsecurity extensions be looked at in the future.
I couldn't say. I hope so.
HTH,
Nalin
--
Stephen John Smoogen smoogen(a)lanl.gov
Los Alamos National Lab CCN-5 Sched 5/40 PH: 4-0645
Ta-03 SM-1498 MailStop B255 DP 10S Los Alamos, NM 87545
-- Please, I have had too much of the stupid today. Please wait until
-- tomorrow to say these things so my tolerance has refreshed.
4:27 p.m.
New subject: OpenSSH Re: rawhide report: 20040608 changes
On Tue, Jun 08, 2004 at 02:44:43PM -0600, Stephen Smoogen wrote:
On Tue, 2004-06-08 at 11:34, Nalin Dahyabhai wrote:
> The gssapi-with-mic support is authentication only AFAIK. So no gssapi
> key exchange, which you may miss if you had gotten used to not having to
> accept (or even create) ssh host public keys. The credential forwarding
> works well.
ah ok. that is where I was fuzzy on where gssapi key exchange came into
play. It is where the kerberos server authenticates the client to the
server and server to client?
I think you're referring to mutual authentication, which is requested by
the client, so you can breathe easy.
To perform gssapi authentication, your servers need host keys in their
keytabs (for the benefit of others, keys for "host/fqdn@REALM" in
/etc/krb5.keytab), but the initial key exchange is still performed using
the host's public/private key pairs, so you'll still need those.
Getting the credential forwarding is actually the big issue for most
of
the scientists.
You'll need to turn on GSSAPIDelegateCredentials for a given host,
otherwise it seems to work quite well.
Nalin
8:48 a.m.
New subject: Xsecurity [was Re: OpenSSH Re: rawhide report: 20040608 changes]
On Tue, 2004-06-08 at 11:21, Stephen Smoogen wrote:
Will the Xsecurity extensions be looked at in the future.
Rather than the old XSECURITY extension we're looking at an
SELinux-style approach that the NSA guys are working on, essentially
changes all the hardcoded XSECURITY checks in the server into callouts
to a configurable policy.
I think this technology has a way to go; the security checks are
frequently at the wrong level of granularity (e.g. a clipboard paste
translates into a whole series of X protocol requests - and the security
checks are at the level of each individual request, with no context to
figure out that we have a paste from app A to app B in format XYZ)
It's like security-checking a stack of documents by chopping it into
quarter-inch squares and trying to pick which ones can go through ;-)
Nonetheless we're thinking about it, and there are some low-hanging
fruit things that can be secured.
Havoc
9:10 a.m.
New subject: Xsecurity [was Re: OpenSSH Re: rawhide report: 20040608 changes]
Once upon a time, Havoc Pennington <hp(a)redhat.com> said:
Rather than the old XSECURITY extension we're looking at an
SELinux-style approach that the NSA guys are working on, essentially
changes all the hardcoded XSECURITY checks in the server into callouts
to a configurable policy.
This sounds like a Linux (or Linux with SELinux enabled) specific thing.
Will it integrate okay with non-Linux OpenSSH?
--
Chris Adams <cmadams(a)hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.
9:36 a.m.
New subject: Xsecurity [was Re: OpenSSH Re: rawhide report: 20040608 changes]
On Wed, Jun 09, 2004 at 09:10:15AM -0500, Chris Adams wrote:
Once upon a time, Havoc Pennington <hp(a)redhat.com> said:
> Rather than the old XSECURITY extension we're looking at an
> SELinux-style approach that the NSA guys are working on, essentially
> changes all the hardcoded XSECURITY checks in the server into callouts
> to a configurable policy.
This sounds like a Linux (or Linux with SELinux enabled) specific thing.
Will it integrate okay with non-Linux OpenSSH?
non Linux X will be XSECURITY based for X11R6.x systems. You can also
do the same trick by making ssh create an Xnest session when you get
a forward.
2:56 p.m.
New subject: Xsecurity [was Re: OpenSSH Re: rawhide report: 20040608 changes]
On Wed, Jun 09, 2004 at 09:48:37AM -0400, Havoc Pennington wrote:
On Tue, 2004-06-08 at 11:21, Stephen Smoogen wrote:
> Will the Xsecurity extensions be looked at in the future.
Rather than the old XSECURITY extension we're looking at an
SELinux-style approach that the NSA guys are working on, essentially
changes all the hardcoded XSECURITY checks in the server into callouts
to a configurable policy.
[snip]
Does this mean it's too early to be reporting things like bug 125590?
(Basically, ssh -X instead of -Y messes up xclock.)
-Barry K. Nathan <barryn(a)pobox.com>
8:32 p.m.
New subject: Xsecurity [was Re: OpenSSH Re: rawhide report: 20040608 changes]
On Wed, 2004-06-09 at 15:56, Barry K. Nathan wrote:
Does this mean it's too early to be reporting things like bug 125590?
(Basically, ssh -X instead of -Y messes up xclock.)
Not sure I understand that bug fully, but yes I doubt we'll do any
fixing of apps to work with XSECURITY in the short term. I imagine
xclock is the very tiniest tip of the iceberg. ;-)
Havoc
5:53 a.m.
New subject: Xsecurity [was Re: OpenSSH Re: rawhide report: 20040608 changes]
On Wed, Jun 09, 2004 at 09:32:09PM -0400, Havoc Pennington wrote:
Not sure I understand that bug fully, but yes I doubt we'll do
any
fixing of apps to work with XSECURITY in the short term. I imagine
xclock is the very tiniest tip of the iceberg. ;-)
XSECURITY blocks shape extension. Its one of the cases where reading your
pixmap would allow you to snoop on things as well as allow you to play
tricks (eg stealing keypresses with a giant invisible window)
8:24 a.m.
New subject: OpenSSH - configuring x11 forwarding (was Re: rawhide report: 20040608 changes)
Build System wrote:
Updated Packages:
openssh-3.8.1p1-1
-----------------
* Mon Jun 07 2004 Nalin Dahyabhai <nalin(a)redhat.com> 3.8.1p1-1
- no longer request x11 forwarding by default
Perhaps not a bug, but in order to restore cut&paste between local and
remote sessions
it is now apparently necessary to enable ForwardX11Trusted in addition
to ForwardX11
It might help if the default of:
# ForwardX11Trusted no
was added to /etc/ssh/ssh_config and some mention of its effect on
cut&paste added to ssh_config(5)
John
7298
days inactive
7300
days old
17 comments
11 participants
participants (11)
-
Alan Cox -
Aurelien Bompard -
Barry K. Nathan -
Build System -
Chris Adams -
Chris Kloiber -
Dennis Gilmore -
Havoc Pennington -
John Ellson -
Nalin Dahyabhai -
Stephen Smoogen