fsh-announce

fsh-announce@lists.lysator.liu.se

4 discussions

fsh 1.2 released
by Per Cederqvist 23 Dec '01

23 Dec '01

I've just released fsh version 1.2. The only change is that this version works with the newly released Python 2.2. Python 2.2 unfortunately broke fsh, and apparently no fsh user found out about this during the beta test cycle of Python. As always, fsh is available from http://www.lysator.liu.se/fsh/ I have started using Bugzilla to track fsh bugs. I have a backlog of old bugs that I have not yet entered into Bugzilla. They are not forgotten. /ceder

1 0

fsh-1.1 is released
by ceder＠lysator.liu.se 10 Dec '00

10 Dec '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Version 1.1 of fsh has been released. It is available from these locations: http://www.lysator.liu.se/fsh/ ftp://ftp.lysator.liu.se/pub/unix/fsh/ Here is a list of the most important changes made since version 1.0: * fshd exits when it has been unused ten hours. The timeout can be changed at configure time with --enable-timeout=TIME and at runtime with --timeout=TIME. (TIME is measured in seconds). * fcp should now work with OpenSSH 2.x. * The socket creation code in fshd was not paranoid enough. There were are at least two possible attacks: - If a malicious user has symlinked /tmp/fshd-<UID> to another file, fshd will chmod 0700 that file. - A race condition made it possible for an attacker to create an unsafe socket directory, so that the attacker can access an fshd tunnel. The attacker must alread have a local shell on the computer where fsh or fshd is invoked. * Detection of process death has been improved. A simple "fsh host echo hello" could sometimes take 5 extra seconds for no good reason. * Prompts such as "host key not found", "enter passphrase" and "enter password" emitted by ssh is no longer silently swollowed by fsh. This means that you can use fsh even if you need to supply a password to ssh when you log in. * The method name supplied in "-r method" may contain any character, including slashes. * Allow "fsh host -l login cmd" as well as "fsh -l login host cmd". This is needed in some configurations of CVS. /ceder -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (SunOS) Comment: Processed by Mailcrypt 3.5.5 and Gnu Privacy Guard <http://www.gnupg.org/> iEYEARECAAYFAjo0AhkACgkQTl5zjNKUYI4UaACgi/Y9kD196mPMtV7u0raNmJHT kWIAni6d56Y6Ek900YyZYO/ii/6INXyB =byr+ -----END PGP SIGNATURE-----

1 0

Local users can use other users tunnels
by ceder＠lysator.liu.se 28 Nov '00

28 Nov '00

Colin Phipps found a problem in fsh about a month ago: On Sat, Oct 21, 2000 at 02:48:10PM +0000, Colin Phipps wrote: > Package: fsh > Version: 1.0.post.1-2.1 > Severity: normal > > fshd has to create a directory in /tmp to hold its sockets; since the > dir is shared by sockets for different instances of fshd's, it has to > accept the possibility that the directory may already exist. The > logic in fshd for doing this is currently: > > make the directory; if it already existed, chmod 0700 it > > Since the chmod will throw an exception if it fails, this (normally) > prevents attacks with malicious local users precreating the socket > directory and trying evil things. But there are two problems with > this logic: > > - the chmod will follow symlinks, so a malicious user can symlink > /tmp/fshd-<UID> to another file and when fshd is first run by that UID > it will chmod 0700 the file pointed to. > - the obvious race condition; an attacker could symlink /tmp/fshd-<UID> > to a file owned by the user, then remove the symlink and create a > directory there instead between the chmod and creation of the socket. > This would defeat fshd's attempt to make the socket directory safe. Unfortunately, he didn't report the bug to me, but to the Debian bug reporting system. Less than twelve hours ago, I received notice about the potential security problem, and made the 1.0.post.4 release that should fix this problem. I recommend everybody to upgrade to this version. And in the future, please send security-related bug reports directly to fsh-bugs(a)lists.lysator.liu.se or ceder(a)lysator.liu.se! /ceder

1 0

New mailinglists for fsh
by ceder＠lysator.liu.se 17 Nov '00

17 Nov '00

I have created three new mailinglists for fsh. fsh-announce: Announcements of new versions et c. Subscribe: send a mail to fsh-announce-request(a)lists.lysator.liu.se, or visit http://lists.lysator.liu.se/mailman/listinfo/fsh-announce fsh-info: An open list for discussions about fsh. To avoid spam, only members can post to the list. Subscribe: send a mail to fsh-info-request(a)lists.lysator.liu.se, or visit http://lists.lysator.liu.se/mailman/listinfo/fsh-info fsh-bugs: A list for bug reports. You don't have to subscribe to send a bug report. Subscribe: send a mail to fsh-bugs-request(a)lists.lysator.liu.se, or visit http://lists.lysator.liu.se/mailman/listinfo/fsh-bugs Report a bug: send a mail to fsh-bugs(a)lists.lysator.liu.se

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

fsh-announce