LWN.net Logo

Fedora intrusion update

Fedora intrusion update

Posted Sep 21, 2008 16:43 UTC (Sun) by gmaxwell (subscriber, #30048)
In reply to: Fedora intrusion update by johill
Parent article: Fedora intrusion update

I am aware of HashKnownHosts, but is anyone actually using it?

As far as I can tell it's not on by default in Fedora 9. It's kind of an annoying feature, if it were on I'd probably turn it off. The increase in security is minimal due to the existence of bash history.

The reason users don't encrypt their ssh key is because they don't want spend their lives typing passwords over and over again. Since in *theory* a users SSH keys should only be on a system they are sitting at (further intermediate hops should be handled via ssh-agent) it may not be unreasonable to use some pam/kernel_keyring integration so that the ssh key is at least encrypted with some derivative of their login password.



(Log in to post comments)

Fedora intrusion update

Posted Sep 25, 2008 1:56 UTC (Thu) by jimparis (subscriber, #38647) [Link]

> I am aware of HashKnownHosts, but is anyone actually using it?

It has been the default in Debian since May 26, 2005.

Copyright © 2012, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds