On Sun, 13 Mar 2016, Nico Kadel-Garcia wrote: > >> Dag-Erling Smørgrav <des@xxxxxx> writes: > >> > Some OS distributions (FreeBSD, RHEL / CentOS, probably Fedora) have > >> > X11Forwarding enabled by default. > >> I'm not sure I see your point. > > > > With X11Forwarding off by default, one would assume that it is only > > enabled on a case-by-case basis for users or groups who already have the > > necessary privileges to run arbitrary code on the server and therefore > > have nothing to gain from exploiting this bug. With X11Forwarding on by > > default, it might remain enabled for e.g. gitolite users. > > OK, right. gitolite and similar tools that use ForcCommand, such as > "svn+ssh" based setups or "rsnapshot" based backup setups should be > ideally, be publishing keys with Forcecommand and > no-port-forwarding,no-X11-forwarding,no-pty" options. better to use "restrict" if you're running a recent OpenSSH _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
