Re: Where to find the configuration documentation??
Brought to you by:
xystrus
From: Derek M. <co...@pi...> - 2003-08-07 16:56:19
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thu, Aug 07, 2003 at 09:18:46AM -0700, Melissa Young wrote: > Good news. Rssh is working without using chroot. Good. Then you know the chroot environment is missing something. Here, you're on your own. I have no access to a solaris machine, so I can't even guess what you'll need. > So, may I assume that this means rssh is working, and > rssh is complied without any problem, right? (or not) Not exactly. If you allow scp, you could be in for trouble. The buffer allocated for the log message in log.c should be large enough to hold the log message for any sftp connection. However, if you allow scp, and the user uses a large command line (lots of files), the buffer will /not/ be big enough, but the code is broken with vsnprintf missing, so it will probably crash the chroot helper. If your users are savvy, they'll realize this is a possible root exploit waiting to happen. Of course, there's also nothing to stop them from running a command like "ssh server sftp-server <long command line arguments>" which would accomplish the same root exploit. So, even sftp isn't safe. You may get it to work, but I guarantee that it is NOT safe. Whether or not this risk is acceptable to you is well, up to you. I've told you what can happen, and I absolutely advise against doing it. But it's your choice. - -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0xDFBEAD02 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE/MoLXdjdlQoHP510RAmkOAJ908eEgnFrkHWAseuYVg4Wdw746KwCgr0yZ x7A47bPsZ3IQWZBF2mTJkG0= =WgLs -----END PGP SIGNATURE----- |