LWN: Comments on "OpenSSH 6.5 released"

OpenSSH 6.5 released

foom — Sat, 22 Mar 2014 22:47:59 +0000

Having a tty isn't expected to let you break out of a shell...Although I suppose allowing it presents a bigger attack surface than otherwise.

OpenSSH 6.5 released

jhoblitt — Fri, 21 Mar 2014 21:56:52 +0000

I've been waiting for the PermitTTY functionality for years and there have been several tickets begging for this functionality. This is a *big deal* for being able to administratively create role accounts for unpriviledged users that can't break out into a regular shell (yes, you could change the path to the users ssh config dir and play other games but it ends up being rather non-intutive for another admin to figure out what you've done. It was also rather non-orthagonal that some options could only be set in the authorized_keys file).

Thank you, Thank you to the OpenSSH devs!

OpenSSH 6.5 released

rsidd — Sun, 02 Feb 2014 17:21:00 +0000

+1. And therefore thank you OpenBSD. I have never used it (I think I have used all the other BSDs except BSDi) but I use this OpenBSD product every day.

SHA256 | base64

lambda — Sat, 01 Feb 2014 17:04:10 +0000

By the way, my version of the base64 command defaults to encoding, while it looks like the one mentioned above defaults to decoding; and they don't take the same options so you can't write something portable to both (mine doesn't have the -e option).

If we're already using the openssl command, we can work around that difference with:

sha256sum () {
    openssl sha256 -binary "$@" | openssl base64
}

SHA256 | base64

lambda — Sat, 01 Feb 2014 16:53:25 +0000

You can instead use:

sha256sum () {
    openssl sha256 -binary "$@" | base64
}

SHA256 | base64

aquasync — Sat, 01 Feb 2014 05:44:36 +0000

Should be easy enough to interpose an "xxd -r -p" in there.

SHA256 | base64

ploxiln — Sat, 01 Feb 2014 04:18:39 +0000

I see your point, but that won't work because the output of sha256sum is hex, not binary. The best shell-utility-only pipeline would probably involve cutting that hex into pairs with '\x' before each, and then having printf output that. I don't think it would be pretty ;)

SHA256 | base64

mathstuf — Fri, 31 Jan 2014 23:42:19 +0000

Hey, I thought we all preached the UNIX philosophy around here!

> sha256sum () {
> /usr/bin/sha256sum "$@" | base64 -e
> }

Isn't that good enough for you? ;)

SHA256 in base64

vonbrand — Fri, 31 Jan 2014 22:48:28 +0000

Shouldn't be to hard to hack it in...

SHA256 in base64

proski — Fri, 31 Jan 2014 22:31:13 +0000

The SHA256 checksums look funny. It turns out the OpenBSD sha256 utility can output them in base64 encoding, which is nice, as it makes them as short as SHA1 checksums. Perhaps Linux sha256sum could support that mode too.

OpenSSH 6.5 released

NightMonkey — Fri, 31 Jan 2014 20:38:33 +0000

Thank you, OpenSSH, for just working, and working well, offering both great features and simplicity. :)