Mailing-List: contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT sourceware DOT cygnus DOT com>
List-Archive: <http://sourceware.cygnus.com/ml/cygwin/>
List-Post: <mailto:cygwin AT sourceware DOT cygnus DOT com>
List-Help: <mailto:cygwin-help AT sourceware DOT cygnus DOT com>, <http://sourceware.cygnus.com/ml/#faqs>
Sender: cygwin-owner AT sourceware DOT cygnus DOT com
Delivered-To: mailing list cygwin AT sourceware DOT cygnus DOT com
From: "Prentis Brooks" <prentis AT aol DOT net>
To: "cygwin" <cygwin AT sourceware DOT cygnus DOT com>
Subject: RE: [ANNOUNCEMENT]: patched openSSH-1.2.2 [was Re: No this has a nasty bite]
Date: Sat, 27 May 2000 23:57:51 -0400
Message-ID: <NEBBLEPLMLJEEFHAGMDMEECLCAAA.prentis@aol.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
In-Reply-To: <39303F67.D6C4E256@vinschen.de>
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Importance: Normal

Thanks Corinna,
	I will not be in the office until Tuesday (Memorial Day holiday here in the
US).  At that time I will apply your updated binaries and continue from
there.  Also, I quickly glanced through the diff file but did not see how
you corrected this... or at least you corrected it in a way completely
different from what I was looking to do.  Would you mind telling me how you
solved the problem of unauthorized access to a another account?
(specifically, being able to login to RSA enabled SSHD eventhough your RSA
key is not part of that SSHD's user's authorized_key file.)

-----Original Message-----
From: corinna AT snoopy DOT vinschen DOT de [mailto:corinna AT snoopy DOT vinschen DOT de]On
Behalf Of Corinna Vinschen
Sent: Saturday, May 27, 2000 5:35 PM
To: Prentis Brooks
Cc: Cygwin
Subject: [ANNOUNCEMENT]: patched openSSH-1.2.2 [was Re: No this has a
nasty bite]


Prentis Brooks wrote:
> You have RSA Authentication enabled and running as user foo on port 22.
You
> have another Daemon running SSH with password authentication on port 26.
If
> user bar sets up RSA keys in his/her home directory and then connects to
> port 22, it will authenticate him/her via the keys in bar's home directory
> and then promptly drop them to the shell as foo... this is bad.

Should be solved in my new version. You will find it in

ftp://ftp.franken.de/pub/win32/develop/gnuwin32/cygwin/porters/Vinschen_Cori
nna/V1.1.1

files

	openssh-1.2.2-2.README
	openssh-1.2.2-2.tar.gz
	openssh-1.2.2-2.diff


Have fun,
Corinna

--
Corinna Vinschen
Cygwin Developer
Cygnus Solutions, a Red Hat company


--
Want to unsubscribe from this list?
Send a message to cygwin-unsubscribe AT sourceware DOT cygnus DOT com