Re: AuthorizedKeyCommand ldap

2017-12-12 Thread Dan Becker
On Mon, Dec 11, 2017 at 7:13 PM, Paulm wrote: > On Mon, Dec 11, 2017 at 03:49:24PM -0700, Dan Becker wrote: > > I am reading a blog proposing to use the AuthorizedKeyCommand to hook > into > > another authentication mechanism by calling a shell script > > > > https://blog.heckel.xyz/2015/05/04/o

Re: AuthorizedKeyCommand ldap

2017-12-12 Thread Stefan Johnson
On Tue, Dec 12, 2017 at 10:35 AM, Dan Becker wrote: > On Mon, Dec 11, 2017 at 7:13 PM, Paulm wrote: > > > My main concern comes from the fact this process is being ran as root and > injecting the username as an arg "$1" > > Example : > > What happens if someone runs ssh '"&rm -rf /'@host, is the

Re: .Va errno

2017-12-12 Thread Ingo Schwarze
Hi, Jeremie Courreges-Anglas wrote on Wed, Dec 06, 2017 at 06:55:22PM +0100: > On Tue, Dec 05 2017, Jan Stary wrote: >> All annotated occurences of "errno" in intro(2) are .Va, >> except this one which is .Dv - is that intended? >> >> The others talk about the "varible" errno, this one is >> an

Re: AuthorizedKeyCommand ldap

2017-12-12 Thread Paulm
On Tue, Dec 12, 2017 at 09:35:27AM -0700, Dan Becker wrote: > On Mon, Dec 11, 2017 at 7:13 PM, Paulm wrote: > > > On Mon, Dec 11, 2017 at 03:49:24PM -0700, Dan Becker wrote: > > > I am reading a blog proposing to use the AuthorizedKeyCommand to hook > > into > > > another authentication mechanism

Re: AuthorizedKeyCommand ldap

2017-12-12 Thread Paulm
On Tue, Dec 12, 2017 at 09:35:27AM -0700, Dan Becker wrote: > On Mon, Dec 11, 2017 at 7:13 PM, Paulm wrote: > > > On Mon, Dec 11, 2017 at 03:49:24PM -0700, Dan Becker wrote: > > > I am reading a blog proposing to use the AuthorizedKeyCommand to hook > > into > > > another authentication mechanism

Re: AuthorizedKeyCommand ldap

2017-12-12 Thread Edgar Pettijohn
On Tue, Dec 12, 2017 at 05:25:27PM -0800, Paulm wrote: > On Tue, Dec 12, 2017 at 09:35:27AM -0700, Dan Becker wrote: > > On Mon, Dec 11, 2017 at 7:13 PM, Paulm wrote: > > > > > On Mon, Dec 11, 2017 at 03:49:24PM -0700, Dan Becker wrote: > > > > I am reading a blog proposing to use the AuthorizedK