by mail.netbsd.org with SMTP; 18 Oct 2000 01:37:25 -0000
	by noc.untraceable.net (8.11.1/8.11.1/bonk!) id e9I1axO20398;
	Tue, 17 Oct 2000 21:36:59 -0400 (EDT)
Date: Tue, 17 Oct 2000 21:36:59 -0400
From: Andrew Brown <atatat@atatdot.net>
To: Curt Sampson <cjs@cynic.net>
Cc: Hubert Feyrer <hubert.feyrer@informatik.fh-regensburg.de>,
   tech-security@netbsd.org
Subject: Re: setuid ssh
Message-ID: <20001017213658.A20383@noc.untraceable.net>
Reply-To: Andrew Brown <atatat@atatdot.net>
References: <Pine.GSO.4.21.0010172342220.29711-100000@rfhpc8320.fh-regensburg.de> <Pine.LNX.4.21.0010171750130.1182-100000@fmh.fw.px.fulton.blink.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <Pine.LNX.4.21.0010171750130.1182-100000@fmh.fw.px.fulton.blink.com>; from cjs@cynic.net on Tue, Oct 17, 2000 at 05:51:10PM -0400
Return-Receipt-To: receipts@daemon.org

>> which ones?
>
>Aside from the usual dangers of buffer overflows and whatnot, it enables
>rhosts. Charles can probably provide better details.

so it needs the privs for obtaining a privileged port...anything else?
rhosts authentication is lame anyway.  rhosts/rsa i've never tried.
any idea that works?

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."