| Summary: | disable kbdint if host key mismatch | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | Frank Cusack <fcusack> | ||||||
| Component: | ssh | Assignee: | OpenSSH Bugzilla mailing list <openssh-bugs> | ||||||
| Status: | CLOSED FIXED | ||||||||
| Severity: | normal | ||||||||
| Priority: | P2 | ||||||||
| Version: | -current | ||||||||
| Hardware: | All | ||||||||
| OS: | All | ||||||||
| Attachments: |
|
||||||||
|
Description
Frank Cusack
2003-05-30 13:37:27 AEST
Created attachment 314 [details]
disable kbdint on host key mismatch
I had to move the "c/r auth sets kbdint auth" to before the call to
check_host_key(). It might be better in readconf() but this was simpler,
and other options are check post-readconf() as well anyway.
My patch just arbitrarily disables kbdint. An improvement would be to #ifdef PAM around the disable bits, since kbdint is safe without PAM (kbdint is used for internal challenge response methods). Unfortunately, with PAM you can't tell if it's safe to use or not, so to be on the safe side it should be disabled. An option could be added to control this, but I think that's unwise (too many options). Created attachment 315 [details]
disable kbdint on host key mismatch
oops, left in an extra line from my testing. here's an update
similar patch applied, thanks. Mass change of RESOLVED bugs to CLOSED |