similar to: random openssh todo notes

The way things are now, input_userauth_request() calls the authmethod, and then does a bunch of checks, like the special case for root. If an authmethod requires a challenge-response conversation, these checks are skipped, unless they are duplicated by the authmethod. For example, in auth2-chall.c, some of the code is duplicated (logging, sending the reply), but the root special case is skipped.

This is to announce the availability of SRP (Secure Remote Password) support for OpenSSH. A tarball is available on Tripod: http://members.tripod.com/professor_tom/archives/ http://members.tripod.com/professor_tom/archives/openssh-2.5.2p2-srp5.tar.gz (Note: Tripod requires you to LEFT click on links to download files.) To install, unpack, configure --with-srp, and make install, then create an

I noticed that (perhaps because ':' is invalid in a username) you can say ssh -l user:style host, where the "user:style" is sent by the client, and the server strips the ":style" part off and makes it available as part of the authentication context. It's currently unused. What are the plans for this, if any? I was experimenting with the idea of using it with SRP

On Sun, 29 Apr 2001, RJ Atkinson wrote: > At 06:26 27/04/01, Tom Wu wrote: > >For those of you who were following the discussion about the new draft > >and implementation of SRP-based password authentication in OpenSSH, I > >promised to have Stanford issue the IETF an official, explicit, > >statement reiterating the unencumbered royalty-free licensing terms. > >The

Hello - got a small wishlist item here: The currently available LogLevel settings (according to the man page) are: QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG. Using "INFO" causes messages about RSA key re-generation to appear in the auth logs. However using the next-lower LogLevel of "ERROR" causes client IP and port to not be reported in the auth logs. I was hoping for

In message <Pine.LNX.4.30.0104031615270.8678-100000 at holly.crl.go.jp>, Tom Holro yd writes: >SRP has different requirements from Diffie-Hellman. In particular, >for SRP the generator must be primitive. It turns out that the "primes" >file contains only safe primes with primitive generators, and is thus >ideal for SRP, but so far in OpenSSH it has only been used for

Recently we made somemajor changes to do_child() in OpenSSH -current. Those changes included splitting it up into smaller chunks to help with readability and also to extract out IRIX and AIX specific code to reduce the number of lines in our diffs against the OpenSSH tree. I need people to do some testing on different platforms to ensure that all the right #ifdef/#endif bits got put back in

Does anybody use openbsd-compat/vis.c? Not at the moment I think: % find . -name '*.[ch]' -exec grep -l "vis *(" {} \; ./openbsd-compat/vis.c ./openbsd-compat/vis.h % find . -name '*.[ch]' -exec grep -l VIS_ {} \; ./includes.h ./openbsd-compat/vis.c ./openbsd-compat/vis.h The reason I ask is, AT&T's graphviz package includes a vis.h, and when I try to compile

The latest snapshot (20020324) fails to compile here. Linux 2.4.18-rc1 Alpha The first messages are: monitor_wrap.c: In function `mm_request_receive': monitor_wrap.c:91: warning: int format, different type arg (arg 3) monitor_wrap.c:100: warning: int format, different type arg (arg 3) which have to do with fatal() calls and int not being the same as ssize_t... But the next one is the

Correct me if I'm wrong, but init_rng() in entropy.c doesn't call seed_rng(), and in fact seed_rng() isn't called from _anywhere_ (in openssh-2.5.1p2). So calls to BN_rand() only pick up the tiny/non-existent amount of entropy added by BN_rand() itself from the system clock (time in seconds). Shouldn't seed_rng() be called from init_rng()? It should be called from _somewhere_,

This is a Linux/Alpha system, with AT&T's graphviz suite installed. gcc -O2 -Wall -I. -I. -I/usr/local/ssl/include -DETCDIR=\"/usr/local/etc\" -D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\" -DHAVE_CONFIG_H -c atomicio.c In file included

This is the 2nd beta release of SRP for OpenSSH. The patch attached to this message is relative to the current (20010411) CVS sources of OpenSSH-portable (2.5.4p1). A tarball is also available: http://members.tripod.com/professor_tom/archives/ http://members.tripod.com/professor_tom/archives/openssh-2.5.4p1-srp6.tar.gz (Note: Tripod requires you to LEFT click on links to download files, and

I have uploaded a new release of the OpenSSH (portable) SRP patch. This version is vs. the 20010625 openssh_cvs; there are no other changes. You can find it here: http://members.tripod.com/professor_tom/archives/ http://members.tripod.com/professor_tom/archives/OpenSSH-srp9.tar.bz2 http://members.tripod.com/professor_tom/archives/OpenSSH-srp9.patch.bz2 The tarball is the whole thing with the

Hi, I'm playing around using Opus in a 'chunked' streaming context, where chunks of media are served in separate HTTP responses. I am trying to hunt down the source of some clicks-and-pops during playback, and while it is very likely that these glitches are due to the low quality of my code, I wanted to ask if the admonition in the API docs[1] that "encoder state *must*

I was having a discussion with a MS person about the performance of NT. I got this reply: ---------- Forwarded message ---------- By the way, I looked into that claim that Linux could outperform NT server, and my source claimed that the test was done on different hardware (i.e. it was rigged) and that Linux still loses to NT on equivalent HW, although "it has gotten closer." Do you

What is autom4te.cache/ and why is it in the snapshot?

Hi, I would like to know what register scavenging is, but reading RegisterScavenging.h [1] and googling don't help too much. Could someone explain it a little bit (what it is and when we need it), or point me to some nice link, I will be very appreciated. :-) [1] http://llvm.org/docs/doxygen/html/RegisterScavenging_8h_source.html Regards, chenwj -- Wei-Ren Chen (陳韋任) Homepage:

could someone please review this change? http://131.188.30.102/~msfriedl/openssh/SSHD_AUTH_PATCH is a diff against openbsd's cvs and will commited ASAP. the patch tries to unify various challenge/response methods in ssh1 and ssh2. faking s/key is dropped, since i am not sure what do do for faking cryptocard and other challenge/response methods. -markus

hints? -------------- next part -------------- An embedded message was scrubbed... From: Markus Friedl <msfriedl at cip.informatik.uni-erlangen.de> Subject: Why we can't login ? Date: Thu, 19 Apr 2001 09:18:02 +0200 (MET DST) Size: 4357 Url: http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20010419/b433827e/attachment.mht

I'm running Linux 2.1.130 on an AXP, with Samba 2.0 beta 2. I have smbfs enabled in the kernel with Win 95 bug fixes enabled but I'm not running smbd. The server containing the share is an HP running Samba 1.9.16p11. I mount the share with smbmount //hpname/share -c 'mount /home/me/mydir' All is well for a while (~1 hour), but then I get kernel: smb_get_length: recv error = 5