On Wed, Mar 26, 2003 at 12:11:58PM +0100, Sven Hoexter wrote: > Well yes it could :) As long as the user has no valid password it's not very > usefull. Take a look into the /etc/shadow and in the second field you'll find > ! or * indicating that this user has a invalid password. See man 5 shadow. That's hardly true. If an attacker could somehow create an ssh authorized_keys file, they could log in without a password. noah -- _______________________________________________________ | Web: http://web.morgul.net/~frodo/ | PGP Public Key: http://web.morgul.net/~frodo/mail.html
Attachment:
pgpKL_Z14_arY.pgp
Description: PGP signature