Bug in OpenSSH / Config Checker

puffy.nolink.ch

29 pointsoherrala9 comments

Open articleView on HN

Sound like this, strictly speaking, is a bug in the config checker, not in the SSH daemon itself.

Strictly speaking the config checker is part of the SSH daemon.

Not a part which is ever run when the SSH daemon is started normally.

Now you are just trying to move the goal posts.

Strictly speaking, I’m splitting hairs.

Just like a flat tire is a problem with the tire, not with the car.

No, not really. The config checker is an entirely optional part, and I was not even aware it existed.

This situation is like “Ford dealership installed wrong tires on Ford truck when customer asked for them, causing an accident”. Yes, it is the same people, and the car ended up on the ditch, but I wouldn’t call this “problem with the car”

Fair enough, I did not read the article too carefully, and thought that the config checker was the part of sshd that validates the configuration when the daemon is starting.

although this isn't nice I bet there are multiple ways to fool the config checker and not be able to login anymore.

Reply on news.ycombinator.com