Re: ssh update or upgrade required? which is it? [now restricting ssh]

2002-06-24 Thread Marc Wilson 
On Mon, Jun 24, 2002 at 07:32:45PM -0700, justin cunningham wrote:
> If I wanted to restrict ssh to only listen for my office's ip until it
> gets patched how do I do this?  I tried editing sshd_config and putting
> my office ip as the listenaddress but it didn't work.  What did I do
> incorrectly?

Debian's sshd knows about libwrap, so you can block people out like so:

/etc/hosts.deny:
sshd: ALL

/etc/hosts.allow:
sshd: hosts_that_you_want_to_be_able_to_connect

Now, whether this stops the exploit that Theo's bragging about, who knows?
No one knows the particulars of it yet. :(

It's probably a good idea to always be restricting who can connect to those
you WANT to be connecting, in any case.

You could also do it with ipchains/iptables, and only let the IP's through
that you wanted through.

-- 
Marc Wilson
[EMAIL PROTECTED]


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: ssh update or upgrade required? which is it? [now restricting ssh]

2002-06-24 Thread Chris Kenrick 
On Mon, Jun 24, 2002 at 07:32:45PM -0700, justin cunningham wrote:
> If I wanted to restrict ssh to only listen for my office's ip until it
> gets patched how do I do this?  I tried editing sshd_config and putting
> my office ip as the listenaddress but it didn't work.  What did I do
> incorrectly?
> 
> Thanks, Justin
> 
> ps:  please reply to email address as well as deb list.  

According to sshd manpage (well at least here on Redhat), if ssh has been
compiled with LIBWRAP support, then you can use /etc/hosts.allow and
/etc/hosts.deny to achieve what you want.  See man 5 hosts_access.
Someone else might be so kind as to post the exact syntax.


- Chris


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

RE: ssh update or upgrade required? which is it? [now restricting ssh]

2002-06-24 Thread justin cunningham 
If I wanted to restrict ssh to only listen for my office's ip until it
gets patched how do I do this?  I tried editing sshd_config and putting
my office ip as the listenaddress but it didn't work.  What did I do
incorrectly?

Thanks, Justin

ps:  please reply to email address as well as deb list.  

-Original Message-
From: Chris Kenrick [mailto:[EMAIL PROTECTED] 
Sent: Monday, June 24, 2002 6:29 PM
To: justin cunningham
Cc: debian-user@lists.debian.org
Subject: Re: ssh update or upgrade required? which is it?

On Mon, Jun 24, 2002 at 06:14:18PM -0700, justin cunningham wrote:
> Hi list, can you please clarify something for me-- this should be
pretty
> straight forward so sorry if the question seems a bit lame.  Can you
> please reply to the email in addition to the list since I'm not
> currently subscribed.
> 
> I read this release http://www.debian.org/security/2002/dsa-134 and it
> says to upgrade to ssh 3.3p1 for woody and that the package for potato
> hasn't yet been compiled.
> 
> On my stable boxes I ran apt-get update and it pulled down some
patches
> from security though the only recent post for security updates is this
> one so was my open ssh from the potato branch updated proficiently or
do
> I need to install this new version?  If I need to install ssh 3.3 and
> want the rest of my box to stay in stable until woody is complete how
do
> I do this?
> 
> Thanks, Justin
> 

According to my traversing through the security updates section via FTP,
the ssh version there for potato i386 is 1.2.3-9.4  So no, you haven't
fixed the vulnerability via any apt-get upgrades ...

You really have two options: download the ssh source and compile it
yourself, or wait until the potato update gets done.  I presume potato
is still being security patched, at least until a bit after Woody is
released.

- Chris



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]