Re: HEAD's UP: possible 0day SSH exploit in the wild
Peter Jordan <usernetwork@gmx.info> writes:
> Russ Allbery, Fri Jul 10 2009 16:31:14 GMT+0200 (CEST):
>> Yes. The master key isn't used on the network and changing it is
>> very difficult in lenny.
> But for new installations a change is not a bad idea?
Yeah, for new installations it's generally best to start the master key
at the strongest supported key type. MIT 1.7 supports rekeying, though,
which makes things much simpler.
>> Correct. Clients will negotiate the strongest available encryption key
>> automatically.
> How can i see that the change has worked?
klist -e will show you the enctypes of the tickets in your cache. You
can also check the enctypes of the tickets issued by the KDC in the KDC
logs, although those are numeric and a bit less easy to understand.
> It seems to work without renewing old keys (host/nfs). How can i see
> which enctypes the keys have.
kadmin examine on those principals.
> btw. if i list the principal for me in kadmin.local there are no
> values for Last successful authentication / Last failed authentication
> and ailed password attempts although the EQUIRES_PRE_AUTH Attribute is
> set:
Those fields aren't actually maintained in the database. (There is code
to do so, but it's ifdefed out and has serious problems.)
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: