oss-sec mailing list archives
Re: OpenSSH key blacklisting
From: The Fungi <fungi () yuggoth org>
Date: Wed, 4 Jun 2008 18:18:26 +0000
On Wed, Jun 04, 2008 at 11:14:12AM -0400, Nathanael Hoyle wrote: [...]
However, the reason debian got into the mess they did in the first place with this was specifically because they were trying to remove responsibility from the can't-be-bothered users for configuration. At one point, nearly all ssh key generation systems required the user the type keys 'at random' on the keyboard, and/or to move the mouse to generate an entropy pool for a seed value for key generation. Because debian performs key-generation on first boot in most cases, that early in the startup there might not be sufficient entropy in the network traffic for utility. I guess they found that users were either incapable of or disinclined to participate in the key generation process.
[...] Not to be argumentative, but have you installed OpenBSD lately (effectively the reference platform for OpenSSH development)? For years, its base install has run sshd by default, generated host keys at first boot, and not prompted at the console for human interaction to augment entropy for this process. I find it hard to blame this *particular* behavior on Debian (unless you're suggesting that they strong-armed OpenSSH upstream to integrate these changes on their behalf?). -- { IRL(Jeremy_Stanley); PGP(9E8DFF2E4F5995F8FEADDC5829ABF7441FB84657); SMTP(fungi () yuggoth org); IRC(fungi () irc yuggoth org#ccl); ICQ(114362511); AIM(dreadazathoth); YAHOO(crawlingchaoslabs); FINGER(fungi () yuggoth org); MUD(fungi () katarsis mudpy org:6669); WWW(http://fungi.yuggoth.org/); }
Current thread:
- Re: OpenSSH key blacklisting, (continued)
- Re: OpenSSH key blacklisting Kees Cook (May 19)
- Re: OpenSSH key blacklisting Kees Cook (May 18)
- Re: OpenSSH key blacklisting Matthias Andree (May 20)
- Re: OpenSSH key blacklisting Solar Designer (May 27)
- Re: OpenSSH key blacklisting Dmitry V. Levin (May 27)
- Re: OpenSSH key blacklisting Tim Brown (May 28)
- Re: OpenSSH key blacklisting Sebastian Krahmer (May 28)
- Re: OpenSSH key blacklisting Tim Brown (Jun 02)
- Re: OpenSSH key blacklisting Sebastian Krahmer (Jun 02)
- Re: OpenSSH key blacklisting Nathanael Hoyle (Jun 04)
- Re: OpenSSH key blacklisting The Fungi (Jun 04)
- Re: OpenSSH key blacklisting Nathanael Hoyle (Jun 04)
- Re: OpenSSH key blacklisting Jonathan Smith (Jun 04)
- Re: OpenSSH key blacklisting Nathanael Hoyle (May 28)
- Re: OpenSSH key blacklisting Florian Weimer (May 28)
- Re: OpenSSH key blacklisting Mike Frysinger (May 31)
- Re: OpenSSH key blacklisting Solar Designer (May 16)
- Re: OpenSSH key blacklisting Gustavo De Nardin (spuk) (May 16)