Re: time to fix silly ssh bug

2012-06-22 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/21/2012 03:49 AM, Richard W.M. Jones wrote: > On Tue, Jun 19, 2012 at 10:10:43AM -0400, Neal Becker wrote: >> Adam Jackson wrote: >> >>> On 6/19/12 9:01 AM, Neal Becker wrote: >>> This is rediculous. I liked the idea of 775 when it was in

Re: time to fix silly ssh bug

2012-06-21 Thread Richard W.M. Jones
On Tue, Jun 19, 2012 at 10:10:43AM -0400, Neal Becker wrote: > Adam Jackson wrote: > > > On 6/19/12 9:01 AM, Neal Becker wrote: > > > >> This is rediculous. I liked the idea of 775 when it was introduced, since > >> it > >> did solve an annoyance with the old unix groups. But then we should ma

Re: time to fix silly ssh bug

2012-06-20 Thread Adam Williamson
On Thu, 2012-06-21 at 00:25 -0500, Dennis Gilmore wrote: > El Wed, 20 Jun 2012 22:13:06 -0700 > Adam Williamson escribió: > > On Wed, 2012-06-20 at 18:16 -0600, Dariusz J. Garbowski wrote: > > > On 20/06/12 02:47 PM, Charles Zeitler wrote: > > > > On Tue, Jun 19, 2012 at 11:17 PM, Adam Williamson

Re: time to fix silly ssh bug

2012-06-20 Thread Dennis Gilmore
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 El Wed, 20 Jun 2012 22:13:06 -0700 Adam Williamson escribió: > On Wed, 2012-06-20 at 18:16 -0600, Dariusz J. Garbowski wrote: > > On 20/06/12 02:47 PM, Charles Zeitler wrote: > > > On Tue, Jun 19, 2012 at 11:17 PM, Adam Williamson > > > wrote > > >>>

Re: time to fix silly ssh bug

2012-06-20 Thread Adam Williamson
On Wed, 2012-06-20 at 20:09 -0600, Dariusz J. Garbowski wrote: > On 20/06/12 07:31 PM, Jesse Keating wrote: > > On 06/20/2012 05:16 PM, Dariusz J. Garbowski wrote: > >> On 20/06/12 02:47 PM, Charles Zeitler wrote: > >>> On Tue, Jun 19, 2012 at 11:17 PM, Adam Williamson > >>> wrote > > > I

Re: time to fix silly ssh bug

2012-06-20 Thread Adam Williamson
On Wed, 2012-06-20 at 18:16 -0600, Dariusz J. Garbowski wrote: > On 20/06/12 02:47 PM, Charles Zeitler wrote: > > On Tue, Jun 19, 2012 at 11:17 PM, Adam Williamson > > wrote > >>> > >> I just tested a fresh install from F17 desktop live; the /home/user > >> directory created after firstboot is 70

Re: time to fix silly ssh bug

2012-06-20 Thread Dariusz J. Garbowski
On 20/06/12 07:31 PM, Jesse Keating wrote: On 06/20/2012 05:16 PM, Dariusz J. Garbowski wrote: On 20/06/12 02:47 PM, Charles Zeitler wrote: On Tue, Jun 19, 2012 at 11:17 PM, Adam Williamson wrote I just tested a fresh install from F17 desktop live; the /home/user directory created after fir

Re: time to fix silly ssh bug

2012-06-20 Thread Dariusz J. Garbowski
On 20/06/12 02:47 PM, Charles Zeitler wrote: On Tue, Jun 19, 2012 at 11:17 PM, Adam Williamson wrote I just tested a fresh install from F17 desktop live; the /home/user directory created after firstboot is 700. /home/user created by s-c-u is 700. /home/user created by useradd is 700. /home/us

Re: time to fix silly ssh bug

2012-06-20 Thread Charles Zeitler
On Tue, Jun 19, 2012 at 11:17 PM, Adam Williamson wrote >> > I just tested a fresh install from F17 desktop live; the /home/user > directory created after firstboot is 700. /home/user created by s-c-u is > 700. /home/user created by useradd is 700. /home/user created by GNOME > account tool is 700

Re: time to fix silly ssh bug

2012-06-19 Thread Adam Williamson
On Tue, 2012-06-19 at 18:36 -0600, Dariusz J. Garbowski wrote: > On 19/06/12 04:01 PM, Jan Kratochvil wrote: > > On Tue, 19 Jun 2012 23:37:43 +0200, Daniel J Walsh wrote: > >> Yes allowing any user to list/read any content in your home dir would be a > >> bad > >> default. > > And yet my latest F

Re: time to fix silly ssh bug

2012-06-19 Thread Dariusz J. Garbowski
On 19/06/12 04:01 PM, Jan Kratochvil wrote: On Tue, 19 Jun 2012 23:37:43 +0200, Daniel J Walsh wrote: Yes allowing any user to list/read any content in your home dir would be a bad default. And yet my latest F17 installation ended up with 755 for my home dir, even though umask in /etc/login.d

Re: time to fix silly ssh bug

2012-06-19 Thread Jan Kratochvil
On Tue, 19 Jun 2012 23:37:43 +0200, Daniel J Walsh wrote: > Yes allowing any user to list/read any content in your home dir would be a bad > default. Why? It would be different default, it would be the default that always has been that way on UNIces. It is useful to learn how other users have co

Re: time to fix silly ssh bug

2012-06-19 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/19/2012 01:02 PM, Tomas Mraz wrote: > On Tue, 2012-06-19 at 09:01 -0400, Neal Becker wrote: >> It's been true for a long time that fedora sets up home dir as 775. But >> ssh, with default settings, won't allow public keys to work when home dir >>

Re: time to fix silly ssh bug

2012-06-19 Thread Tomas Mraz
On Tue, 2012-06-19 at 09:01 -0400, Neal Becker wrote: > It's been true for a long time that fedora sets up home dir as 775. > But ssh, with default settings, won't allow public keys to work when > home dir has mode 775. Creating the home dirs with 775 mode is actually a bug or misconfiguration on

Re: time to fix silly ssh bug

2012-06-19 Thread Michael Cronenworth
Neal Becker wrote: > It's been true for a long time that fedora sets up home dir as 775. No, it is not true. $ grep UMASK /etc/login.defs UMASK 077 This setting has been in effect as far back as Fedora 6 and possibly much farther. -- devel mailing list devel@lists.fedoraproject.org ht

Re: time to fix silly ssh bug

2012-06-19 Thread Bryn M. Reeves
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/19/2012 02:47 PM, Neal Becker wrote: > Bryn M. Reeves wrote: On 06/19/2012 02:01 PM, Neal Becker wrote: This is rediculous. I liked the idea of 775 when it was introduced, since it did solve an annoyance with the old unix groups.

Re: time to fix silly ssh bug

2012-06-19 Thread Bryn M. Reeves
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/19/2012 04:02 PM, Kevin Kofler wrote: > Neal Becker wrote: >> Jun 19 09:44:41 nbecker5 sshd[25418]: Authentication refused: >> bad ownership or modes for directory /home/nbecker > > Looks like a new change in OpenSSH then, which is IMHO a > regr

Re: time to fix silly ssh bug

2012-06-19 Thread Adam Jackson
On 6/19/12 11:02 AM, Kevin Kofler wrote: Neal Becker wrote: Jun 19 09:44:41 nbecker5 sshd[25418]: Authentication refused: bad ownership or modes for directory /home/nbecker Looks like a new change in OpenSSH then, which is IMHO a regression, unless there's a clear security vulnerability being

Re: time to fix silly ssh bug

2012-06-19 Thread Jayson Vaughn
On Jun 19, 2012 10:07 AM, "Jayson Vaughn" wrote: > > > On Jun 19, 2012 8:46 AM, "Neal Becker" wrote: > > > > Jayson Vaughn wrote: > > > > > I'm confused. As long as ~/.ssh is 700 it works for me. > > > On Jun 19, 2012 8:02 AM, "Neal Becker" wrote: > > > > > >> It's been true for a long time tha

Re: time to fix silly ssh bug

2012-06-19 Thread Jayson Vaughn
On Jun 19, 2012 8:46 AM, "Neal Becker" wrote: > > Jayson Vaughn wrote: > > > I'm confused. As long as ~/.ssh is 700 it works for me. > > On Jun 19, 2012 8:02 AM, "Neal Becker" wrote: > > > >> It's been true for a long time that fedora sets up home dir as 775. > >> But ssh, with default settings,

Re: time to fix silly ssh bug

2012-06-19 Thread Kevin Kofler
Neal Becker wrote: > Jun 19 09:44:41 nbecker5 sshd[25418]: Authentication refused: bad > ownership or modes for directory /home/nbecker Looks like a new change in OpenSSH then, which is IMHO a regression, unless there's a clear security vulnerability being addressed there. Kevin Kofler

Re: time to fix silly ssh bug

2012-06-19 Thread Neal Becker
Adam Jackson wrote: > On 6/19/12 9:01 AM, Neal Becker wrote: > >> This is rediculous. I liked the idea of 775 when it was introduced, since it >> did solve an annoyance with the old unix groups. But then we should make the >> default fedora install work by setting the sshd config to allow it to

Re: time to fix silly ssh bug

2012-06-19 Thread Adam Jackson
On 6/19/12 9:01 AM, Neal Becker wrote: This is rediculous. I liked the idea of 775 when it was introduced, since it did solve an annoyance with the old unix groups. But then we should make the default fedora install work by setting the sshd config to allow it to accept this setup. Perhaps a

Re: time to fix silly ssh bug

2012-06-19 Thread Neal Becker
Bryn M. Reeves wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On 06/19/2012 02:01 PM, Neal Becker wrote: >> This is rediculous. I liked the idea of 775 when it was >> introduced, since it did solve an annoyance with the old unix >> groups. But then we should make the default fedor

Re: time to fix silly ssh bug

2012-06-19 Thread Neal Becker
Jayson Vaughn wrote: > I'm confused. As long as ~/.ssh is 700 it works for me. > On Jun 19, 2012 8:02 AM, "Neal Becker" wrote: > >> It's been true for a long time that fedora sets up home dir as 775. >> But ssh, with default settings, won't allow public keys to work when >> home dir has mode 77

Re: time to fix silly ssh bug

2012-06-19 Thread Bryn M. Reeves
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/19/2012 02:01 PM, Neal Becker wrote: > This is rediculous. I liked the idea of 775 when it was > introduced, since it did solve an annoyance with the old unix > groups. But then we should make the default fedora install work by > setting the ss

Re: time to fix silly ssh bug

2012-06-19 Thread Jayson Vaughn
I'm confused. As long as ~/.ssh is 700 it works for me. On Jun 19, 2012 8:02 AM, "Neal Becker" wrote: > It's been true for a long time that fedora sets up home dir as 775. > But ssh, with default settings, won't allow public keys to work when > home dir has mode 775. > > Not only, but the poor n

time to fix silly ssh bug

2012-06-19 Thread Neal Becker
It's been true for a long time that fedora sets up home dir as 775. But ssh, with default settings, won't allow public keys to work when home dir has mode 775. Not only, but the poor new fedora user, who tries to ssh into his fedora box, won't see any message indicating what is wrong. Only if he/