Bug#780797: openssh-server: modifies the user configuration
On 2015-03-19 23:44:00 +0100, Christoph Anton Mitterer wrote:
> On Thu, 2015-03-19 at 23:37 +0100, Vincent Lefevre wrote:
> > BTW, it's also annoying that the user can no longer pass env variables
> > (e.g. the charset) to the remote side for machines where the admin
> > just uses Debian's default.
> But that was the case before either, at least except those matching LANG
> or LC_*
But at least the user could use non-standard (thus unused by the
system) variables to pass information to the remote side (in my case,
I used LC_CHARMAP). After this change only the standard variables can
be passed, but one shouldn't use them to pass information other that
what these variables normally carry.
> ... upstream allows per default even less (nothing)
IMHO, this is silly. Passing information to the remote side is
useful, and completely safe as long as the environment variable
is not used by the system.
> and both is done for good reasons (security).
I don't see how the change could improve security.
--
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
Reply to: