| |||||||||||||
|
| |||||||||||||
Fedora intrusion updateFedora intrusion updatePosted Sep 21, 2008 16:09 UTC (Sun) by johill (subscriber, #25196)In reply to: Fedora intrusion update by tialaramex Parent article: Fedora intrusion update
As far as I know, ssh hasn't stored the known hosts in plaintext for a long time, they are hashed now so you can match host -> entry but not do entry -> host.
(Log in to post comments)
Fedora intrusion update Posted Sep 21, 2008 16:11 UTC (Sun) by johill (subscriber, #25196) [Link]
Oh, sorry, you had mentioned the hashing and I just read too fast, but it is indeed enabled by default on many distros now and I don't see a good way to crack it. .bash_history might be a better venue.
Fedora intrusion update Posted Sep 21, 2008 16:43 UTC (Sun) by gmaxwell (subscriber, #30048) [Link]
I am aware of HashKnownHosts, but is anyone actually using it?
As far as I can tell it's not on by default in Fedora 9. It's kind of an annoying feature, if it were on I'd probably turn it off. The increase in security is minimal due to the existence of bash history.
The reason users don't encrypt their ssh key is because they don't want spend their lives typing passwords over and over again. Since in *theory* a users SSH keys should only be on a system they are sitting at (further intermediate hops should be handled via ssh-agent) it may not be unreasonable to use some pam/kernel_keyring integration so that the ssh key is at least encrypted with some derivative of their login password.
Fedora intrusion update Posted Sep 25, 2008 1:56 UTC (Thu) by jimparis (subscriber, #38647) [Link]
> I am aware of HashKnownHosts, but is anyone actually using it?
It has been the default in Debian since May 26, 2005.
|
|
||||||||||||