https://bugzilla.novell.com/show_bug.cgi?id=393186
User meissner@novell.com added comment
https://bugzilla.novell.com/show_bug.cgi?id=393186#c8
--- Comment #8 from Marcus Meissner
Thanks for the "bug" reference. FWIW, the shell script in this comment is vulnerable itself, in more than one way:
http://bugs.gentoo.org/show_bug.cgi?id=221759#c9
For example, it lets a user have any other user's or root's authorized_keys removed, by replacing .ssh with a symlink to someone else's .ssh directory.
Do you mean the race condition between finding and removing the key? Otherwise, I cannot see how to have someone else's removed.
I assume whichever version has the acceptance of the OpenSSH upstream is what most of us would be willing to go with. Did you discuss either blacklist format with them already?
Yes, very briefly. They don't intend to implement key blacklisting.
That's not too helpful for our case. Do you have a patch to propose, implementing your idea? There has been approval of your idea inside Gentoo's hardened team. Robert [-- Ende der signierten Daten --] -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.