Re: HEAD's UP: possible 0day SSH exploit in the wild
Michael Stone wrote:
[A way to enforce non-empty passwd on ssh-keys]
> You can't, which is why it is useful to have both passwords and keys
> simultaneously--you can enforce a policy on a password.
To cite Noah Meyerhans from his recent mail - my users would shoot me if I ever tried such a thing.
Sadly, I'm not their bossbut they are more or less my customers, so putting a security policy in place requiring the previously stated mechanism would be more like starting a war than a small skirmish.
Sebastian
--
baboo
--
Neu: GMX Doppel-FLAT mit Internet-Flatrate + Telefon-Flatrate
für nur 19,99 Euro/mtl.!* http://portal.gmx.net/de/go/dsl02
Reply to: