GNU bug report logs - #18967
Tramp disables important SSH security features

Previous Next

Package: emacs;

Reported by: Daniel Colascione <dancol <at> dancol.org>

Date: Thu, 6 Nov 2014 00:49:01 UTC

Severity: normal

Tags: security

Fixed in version 26.1

Done: Michael Albinus <michael.albinus <at> gmx.de>

Bug is archived. No further changes may be made.

Full log

View this message in rfc822 format

From: Daniel Colascione <dancol <at> dancol.org>
To: 18967 <at> debbugs.gnu.org
Subject: bug#18967: Tramp disables important SSH security features
Date: Thu, 06 Nov 2014 00:47:40 +0000

[Message part 1 (text/plain, inline)]
Tramp disables SSH host key checks by setting
GlobalKnownHostsFile=/dev/null, UserKnownHostsFile=/dev/null, and
StrictHostKeyChecking=no in its default method configuration. These
settings allow attackers to intercept connections to remote hosts, sniff
passwords, and cause other mischief. I don't think we should ship an
insecure configuration.


[signature.asc (application/pgp-signature, attachment)]
This bug report was last modified 8 years and 211 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.