https://bugzilla.novell.com/show_bug.cgi?id=671820 https://bugzilla.novell.com/show_bug.cgi?id=671820#c2 --- Comment #2 from Gilles Sabourin 2011-02-14 18:36:18 UTC --- Created an attachment (id=413919) --> (http://bugzilla.novell.com/attachment.cgi?id=413919) ssh server configuration (openSUSE 11.3, openssh 5.4p1) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=671820 https://bugzilla.novell.com/show_bug.cgi?id=671820#c Gilles Sabourin changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #413918|application/octet-stream |text/plain mime type| | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=671820 https://bugzilla.novell.com/show_bug.cgi?id=671820#c wei wang changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wewang@novell.com AssignedTo|bnc-team-screening@forge.pr |pcerny@novell.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=671820 https://bugzilla.novell.com/show_bug.cgi?id=671820#c3 Petr Cerny changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Platform|x86 |All InfoProvider| |gilles.sabourin@free.fr OS/Version|Other |openSUSE 11.4 --- Comment #3 from Petr Cerny 2011-05-12 21:15:32 UTC --- Hello Giles, I'm sorry it took me so long - this bug just disappeared from my radar. For some reason, the helper application ssh-keysign, which regular users need to access the client machine private keys is not setuid anymore. Please try $ chmod 4711 /usr/lib64/ssh/ssh-keysign and let me know, whether this fixes the problem for you. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=671820 https://bugzilla.novell.com/show_bug.cgi?id=671820#c Petr Cerny changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=671820 https://bugzilla.novell.com/show_bug.cgi?id=671820#c6 --- Comment #6 from Gilles Sabourin 2011-05-24 06:47:27 UTC --- This solution works ... until ssh server is restarted : new ecdsa keys are then generated where ecdsa public key is unknown from the peers, and this leads to a worsen situation (offending key ...). So, this is NOT a fix for me : this is unacceptable. Moreover this behavior is inconsistent : your solution is more or less a test that exhibits a security leak for openssh.

From a security point of view, this new behavior is much more secured because it does not allow abuse of HostbasedAuthentication, which should be reserved only to system accounts. The former operation allowed unlimited access between 2 trusted hosts to ANY user account. But computer security has 2 components (human and machine) and can't rely solely on machine : there is no security (no access control) where you're allow everyone to go.

But, this substantial semantic change should have been at least : - documented in openssh changelog or in openssh web site and, - well tested so that this kind of "workaround" should have simply not been possible. Now you should contact an openssh developer to confirm that this is the intended operation for openssh > 5.6 If this is the case, then this bug report can be turned against openssh documentation and you can open a new bug report for the security leak. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=671820 https://bugzilla.novell.com/show_bug.cgi?id=671820#c8 Rolf Krahl changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rolf@rotkraut.de --- Comment #8 from Rolf Krahl 2012-02-05 16:45:59 UTC --- First of all, I can confirm that the bug is still present in openSUSE 12.1. While impatiently waiting for the fix in openssh 5.9 to find its way to the openSUSE end users, i'd like to suggest a work around. Its pretty obvious: since the cause is ssh-keysign not yet supporting ecdsa keys, one may simply fall back to using a rsa host key. Steps for the work around: 1. Disable using ecdsa host key at the server: uncomment the line | HostKey /etc/ssh/ssh_host_rsa_key in /etc/ssh/sshd_config and leave all other HostKey statements commented out. 2. Create the rsa key: $ ssh-keygen -t rsa -b 2048 -f /etc/ssh/ssh_host_rsa_key -N '' 3. Restart the ssh server: $ rcsshd restart 3. Distribute the public key in /etc/ssh/ssh_host_rsa_key.pub to the ssh_known_hosts files at the clients. 4. Enjoy working host based authentication. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.