by mail.netbsd.org with SMTP; 18 Oct 2000 14:26:48 -0000
	by noc.untraceable.net (8.11.1/8.11.1/bonk!) id e9IEQf700347;
	Wed, 18 Oct 2000 10:26:41 -0400 (EDT)
Date: Wed, 18 Oct 2000 10:26:40 -0400
From: Andrew Brown <atatat@atatdot.net>
To: Bill Sommerfeld <sommerfeld@orchard.arlington.ma.us>
Cc: Atsushi Onoe <onoe@sm.sony.co.jp>, cjs@cynic.net, tech-security@netbsd.org
Subject: Re: setuid ssh
Message-ID: <20001018102640.A293@noc.untraceable.net>
Reply-To: Andrew Brown <atatat@atatdot.net>
References: <atatat@atatdot.net> <20001018142031.6072B2A2A@orchard.arlington.ma.us>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20001018142031.6072B2A2A@orchard.arlington.ma.us>; from sommerfeld@orchard.arlington.ma.us on Wed, Oct 18, 2000 at 10:20:25AM -0400
Return-Receipt-To: receipts@daemon.org

>> a mini-certificate?  it could just be a time_t, yes?  appended to the
>> key before hashing for signing, and then kept with it.  or am i again
>> simply restating what you said?
>
>Yes.
>
>In general terms, a certificate is a signed statement by a certifying
>authority saying that some set of attributes are attached to a key.
>
>In this case, the certifying authority is the entity in control of the
>long-term key, and the "attributes" include the expiration time (and
>probably also the user identity);
>
>X.509 defines one kind of certificate; SPKI defines another; dnssec
>signatures are another kind; pgp has its own certificate structure...

and this would be yet another, albeit smaller, with only one value,
name implied.

but to digress further, what would be better, imho, would be if
something "similar" to rhosts existed, but allowed me to specify an
rsa key (for rsa authenticaion) along with the host, and perhaps even
whether or not a remote command is required/refused/optional.  i had a
case where some people should be allowed to remote execute things, but
certainly not to log in.  that one was fun.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."