Re: Security in a shell that starts ssh

2001-06-16 Thread Steven Huang
[some text omitted for brevity] On Wed, 13 Jun 2001, Tim van Erven wrote: [...] > > > > { > > > > char name[21]; /* Should be macro (#define NAMELEN 21) */ > Possibly, but the name that can be entered is at most 20 chars long, so > NAMELEN should arguably be defined to 20 and the declaration f

Re: Security in a shell that starts ssh

2001-06-16 Thread Steven Huang
[some text omitted for brevity] On Wed, 13 Jun 2001, Tim van Erven wrote: [...] > > > > { > > > > char name[21]; /* Should be macro (#define NAMELEN 21) */ > Possibly, but the name that can be entered is at most 20 chars long, so > NAMELEN should arguably be defined to 20 and the declaration

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 01:50:56AM +0400, Daniel Ginsburg wrote: > [EMAIL PROTECTED] > It _won't_ be caught by fgets. See my other post. > Please refer to manpages and the Standard to see what does fgets return and > under what circumstances. The libc info page (run info libc, for those not fami

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 09:30:59PM +0200, Miquel Mart?n L?pez wrote: > Hi David! > Well, in my case the terminal is an VT-100, so it's connected directly to > the one of the serial ports of the server, so nothing's going wildly to the > network in cleartext. If you use really long RS-232 cables,

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 09:30:59PM +0200, Miquel Mart?n L?pez wrote: > Hi David! > Well, in my case the terminal is an VT-100, so it's connected directly to > the one of the serial ports of the server, so nothing's going wildly to the > network in cleartext. > I don't know about Xterminals, thoug

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 01:50:56AM +0400, Daniel Ginsburg wrote: > Ctrl-@. > It _won't_ be caught by fgets. See my other post. > Please refer to manpages and the Standard to see what does fgets return and > under what circumstances. The libc info page (run info libc, for those not familiar with

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 09:30:59PM +0200, Miquel Mart?n L?pez wrote: > Hi David! > Well, in my case the terminal is an VT-100, so it's connected directly to > the one of the serial ports of the server, so nothing's going wildly to the > network in cleartext. If you use really long RS-232 cables,

Re: Security in a shell that starts ssh

2001-06-14 Thread Peter Cordes
On Thu, Jun 14, 2001 at 09:30:59PM +0200, Miquel Mart?n L?pez wrote: > Hi David! > Well, in my case the terminal is an VT-100, so it's connected directly to > the one of the serial ports of the server, so nothing's going wildly to the > network in cleartext. > I don't know about Xterminals, thou

Re: Security in a shell that starts ssh

2001-06-14 Thread Steve Greenland
On 14-Jun-01, 14:30 (CDT), Miquel Mart?n L?pez <[EMAIL PROTECTED]> wrote: > And changing topic, how about that code-revieu debian list? It sure sounds > interesting, and many of us would learn a great deal :) Debian gurus out > there, let's give it a shot! Where/who can we contact? I've submitted

Re: Security in a shell that starts ssh

2001-06-14 Thread Miquel Mart?n L?pez
Hi David! Well, in my case the terminal is an VT-100, so it's connected directly to the one of the serial ports of the server, so nothing's going wildly to the network in cleartext. I don't know about Xterminals, though... I guess they are networked, but I really don't know much about the protocol

Re: Security in a shell that starts ssh

2001-06-14 Thread Steve Greenland
On 14-Jun-01, 14:30 (CDT), Miquel Mart?n L?pez <[EMAIL PROTECTED]> wrote: > And changing topic, how about that code-revieu debian list? It sure sounds > interesting, and many of us would learn a great deal :) Debian gurus out > there, let's give it a shot! Where/who can we contact? I've submitte

Re: Security in a shell that starts ssh

2001-06-14 Thread Miquel Mart?n L?pez
Hi David! Well, in my case the terminal is an VT-100, so it's connected directly to the one of the serial ports of the server, so nothing's going wildly to the network in cleartext. I don't know about Xterminals, though... I guess they are networked, but I really don't know much about the protocol

Re: Security in a shell that starts ssh

2001-06-14 Thread David Ehle
I am in a similar situation as Miquel, and was consdering a similar option... but one thing keeps nagging at me as far as the security of the setup. SSH will encrypt all the data transmitted between the "portal" machine and other hosts, but what is keeping someone from sniffing everything going f

Re: Security in a shell that starts ssh

2001-06-14 Thread David Ehle
I am in a similar situation as Miquel, and was consdering a similar option... but one thing keeps nagging at me as far as the security of the setup. SSH will encrypt all the data transmitted between the "portal" machine and other hosts, but what is keeping someone from sniffing everything going

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
On Thu, Jun 14, 2001 at 01:50:56AM +0400, Daniel Ginsburg <[EMAIL PROTECTED]> wrote: > On Wed, Jun 13, 2001 at 11:34:28PM +0200, Tim van Erven wrote: > > [snip] > > > > > Possible access to unallocated memory if "\0\n" supplied as input. > > > > > > > > Only if strlen(name) = 0 and besides from

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 11:34:28PM +0200, Tim van Erven wrote: [snip] > > > > Possible access to unallocated memory if "\0\n" supplied as input. > > > > > > Only if strlen(name) = 0 and besides from being hard to achieve when > > > entering data on stdin, fgets will return 0 if that happens. > >

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 04:10:27PM -0500, Steve Greenland wrote: > On 13-Jun-01, 13:47 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > > > > int main() > > > > > > > > int main(void) /* () != (void) in C */ > > > > The

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
On Wed, Jun 13, 2001 at 04:10:27PM -0500, Steve Greenland <[EMAIL PROTECTED]> wrote: > On 13-Jun-01, 13:47 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > > > > int main() > > > > > > > > int main(void) /* () != (void)

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 13:47 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > > > int main() > > > > > > int main(void) /* () != (void) in C */ > > The comp.lang.c faq (http://www.faqs.org/faqs/C-faq/faq/) says it's ok. Where does

Re: Security in a shell that starts ssh

2001-06-13 Thread Miquel Mart?n L?pez
Whoa! Amazing :) This is exactly the sort of feedback I expected, thanks a lot guys! I don't have trouble understanding your suggersions, my main delight comes from wondering how on earth can you think of so many tiny details :) And I thought I was paraonid :) Really, thanks a lot, that taught me q

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
On Thu, Jun 14, 2001 at 01:50:56AM +0400, Daniel Ginsburg <[EMAIL PROTECTED]> wrote: > On Wed, Jun 13, 2001 at 11:34:28PM +0200, Tim van Erven wrote: > > [snip] > > > > > Possible access to unallocated memory if "\0\n" supplied as input. > > > > > > > > Only if strlen(name) = 0 and besides from

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 11:34:28PM +0200, Tim van Erven wrote: [snip] > > > > Possible access to unallocated memory if "\0\n" supplied as input. > > > > > > Only if strlen(name) = 0 and besides from being hard to achieve when > > > entering data on stdin, fgets will return 0 if that happens. > >

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 02:02:10PM -0500, Steve Greenland wrote: [snip] > I'd still argue that exit(_macro_) is better style than return from > main(), but I'm hard pressed to find a technical argument. > There's subtle difference between returning from main and calling exit. Excelent explanatio

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 04:10:27PM -0500, Steve Greenland wrote: > On 13-Jun-01, 13:47 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > > > > int main() > > > > > > > > int main(void) /* () != (void) in C */ > > > > The

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
On Wed, Jun 13, 2001 at 04:10:27PM -0500, Steve Greenland <[EMAIL PROTECTED]> wrote: > On 13-Jun-01, 13:47 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > > > > int main() > > > > > > > > int main(void) /* () != (void)

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 11:24 (CDT), Daniel Ginsburg <[EMAIL PROTECTED]> wrote: > > > > if(name[strlen(name) - 1] != '\n') { > > > > Possible access to unallocated memory if "\0\n" supplied as input. Oops, didn't catch that one. > > > /* return 0; */ > > > > exit(EXIT_SUCCESS); /* return does

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
Thanks for the feedback, I'll respond to both your replies at once. On Wed, Jun 13, 2001 at 08:24:32PM +0400, Daniel Ginsburg <[EMAIL PROTECTED]> wrote: > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > Tim, good fixups, a few C coding/style nitpicks: > > > > On 12-Jun-01, 1

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 13:47 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > > > int main() > > > > > > int main(void) /* () != (void) in C */ > > The comp.lang.c faq (http://www.faqs.org/faqs/C-faq/faq/) says it's ok. Where doe

Re: Security in a shell that starts ssh

2001-06-13 Thread Miquel Mart?n L?pez
Whoa! Amazing :) This is exactly the sort of feedback I expected, thanks a lot guys! I don't have trouble understanding your suggersions, my main delight comes from wondering how on earth can you think of so many tiny details :) And I thought I was paraonid :) Really, thanks a lot, that taught me

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 02:02:10PM -0500, Steve Greenland wrote: [snip] > I'd still argue that exit(_macro_) is better style than return from > main(), but I'm hard pressed to find a technical argument. > There's subtle difference between returning from main and calling exit. Excelent explanati

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
On 13-Jun-01, 11:24 (CDT), Daniel Ginsburg <[EMAIL PROTECTED]> wrote: > > > > if(name[strlen(name) - 1] != '\n') { > > > > Possible access to unallocated memory if "\0\n" supplied as input. Oops, didn't catch that one. > > > /* return 0; */ > > > > exit(EXIT_SUCCESS); /* return doe

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > Tim, good fixups, a few C coding/style nitpicks: > > On 12-Jun-01, 17:57 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > #include > > #include /* For execlp */ > #include /* For exit */ > > > int main() > > int main(void

Re: Security in a shell that starts ssh

2001-06-13 Thread Tim van Erven
Thanks for the feedback, I'll respond to both your replies at once. On Wed, Jun 13, 2001 at 08:24:32PM +0400, Daniel Ginsburg <[EMAIL PROTECTED]> wrote: > On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > > Tim, good fixups, a few C coding/style nitpicks: > > > > On 12-Jun-01, 1

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > #include #include /* For execlp */ #include /* For exit */ > int main() int main(void) /* () != (void) in C */ > { > charname[21]; /* Should be macro (#define

Re: Security in a shell that starts ssh

2001-06-13 Thread Daniel Ginsburg
On Wed, Jun 13, 2001 at 10:57:08AM -0500, Steve Greenland wrote: > Tim, good fixups, a few C coding/style nitpicks: > > On 12-Jun-01, 17:57 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > > #include > > #include /* For execlp */ > #include /* For exit */ > > > int main() > > int main(voi

Re: Security in a shell that starts ssh

2001-06-13 Thread Steve Greenland
Tim, good fixups, a few C coding/style nitpicks: On 12-Jun-01, 17:57 (CDT), Tim van Erven <[EMAIL PROTECTED]> wrote: > #include #include /* For execlp */ #include /* For exit */ > int main() int main(void) /* () != (void) in C */ > { > charname[21]; /* Should be macro (#define

Re: Security in a shell that starts ssh

2001-06-13 Thread Javier Fernandez-Sanguino Peña
Miquel Mart?n L?pez escribió: > > Hi all! > We have several vt-100 terminal that log to the naub server at our office. > Still, some users without account in the main server would like to login to > another machine, so I was planning on creating a passwordless acount with a > shell that's a progra

Re: Security in a shell that starts ssh

2001-06-13 Thread Javier Fernandez-Sanguino Peña
Miquel Mart?n L?pez escribió: > > Hi all! > We have several vt-100 terminal that log to the naub server at our office. > Still, some users without account in the main server would like to login to > another machine, so I was planning on creating a passwordless acount with a > shell that's a progr

Re: Security in a shell that starts ssh

2001-06-12 Thread Tim van Erven
On Tue, Jun 12, 2001 at 11:40:08PM +0200, Miquel Mart?n L?pez <[EMAIL PROTECTED]> wrote: > #include > > main(){ > int i=0; > char name[10]; > > write(1,"Login as: ",10); > > while(i<10) > { > read(0,&name[i],1); > if (name[i]=='\n') {name[i]='\0';i=100;} > i++;

Re: Security in a shell that starts ssh

2001-06-12 Thread Aaron Dewell
That would probably work, but for style I'd use 'break;' instead of 'i=100;'. You also don't need to be quite so paranoid with printf, it's generally safe unless you are printf'ing data entered by the user. If it's all your own text, they can't insert anything strange into it... Also, instead of

Security in a shell that starts ssh

2001-06-12 Thread Miquel Mart?n L?pez
Hi all! We have several vt-100 terminal that log to the naub server at our office. Still, some users without account in the main server would like to login to another machine, so I was planning on creating a passwordless acount with a shell that's a program that asks for usernames and then execs ss

Re: Security in a shell that starts ssh

2001-06-12 Thread Tim van Erven
On Tue, Jun 12, 2001 at 11:40:08PM +0200, Miquel Mart?n L?pez <[EMAIL PROTECTED]> wrote: > #include > > main(){ > int i=0; > char name[10]; > > write(1,"Login as: ",10); > > while(i<10) > { > read(0,&name[i],1); > if (name[i]=='\n') {name[i]='\0';i=100;} > i++;

Re: Security in a shell that starts ssh

2001-06-12 Thread Aaron Dewell
That would probably work, but for style I'd use 'break;' instead of 'i=100;'. You also don't need to be quite so paranoid with printf, it's generally safe unless you are printf'ing data entered by the user. If it's all your own text, they can't insert anything strange into it... Also, instead o

Security in a shell that starts ssh

2001-06-12 Thread Miquel Mart?n L?pez
Hi all! We have several vt-100 terminal that log to the naub server at our office. Still, some users without account in the main server would like to login to another machine, so I was planning on creating a passwordless acount with a shell that's a program that asks for usernames and then execs s