GNU bug report logs - #18967
Tramp disables important SSH security features

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#18967: closed (Tramp disables important SSH security features)
Date: Wed, 21 Dec 2016 11:45:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Wed, 21 Dec 2016 12:44:23 +0100
with message-id <87mvfpmrqg.fsf <at> gmx.de>
and subject line Re: bug#18967: Tramp disables important SSH security features
has caused the debbugs.gnu.org bug report #18967,
regarding Tramp disables important SSH security features
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
18967: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=18967
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Daniel Colascione <dancol <at> dancol.org>
To: bug-emacs <bug-gnu-emacs <at> gnu.org>
Subject: Tramp disables important SSH security features
Date: Thu, 06 Nov 2014 00:47:40 +0000

[Message part 3 (text/plain, inline)]

Tramp disables SSH host key checks by setting
GlobalKnownHostsFile=/dev/null, UserKnownHostsFile=/dev/null, and
StrictHostKeyChecking=no in its default method configuration. These
settings allow attackers to intercept connections to remote hosts, sniff
passwords, and cause other mischief. I don't think we should ship an
insecure configuration.

[signature.asc (application/pgp-signature, attachment)]

[Message part 5 (message/rfc822, inline)]

From: Michael Albinus <michael.albinus <at> gmx.de>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 18967-done <at> debbugs.gnu.org, Daniel Colascione <dancol <at> dancol.org>,
 Ted Zlatanov <tzz <at> lifelogs.com>, Stefan Monnier <monnier <at> IRO.UMontreal.CA>
Subject: Re: bug#18967: Tramp disables important SSH security features
Date: Wed, 21 Dec 2016 12:44:23 +0100

Version: 26.1

> I have some plans for a while to obsolete tramp-gw.el. When I wrote it
> back in 2007, it was the only possibility to have an own implementation
> of HTTP CONNECT tunneling.
>
> Meanwhile, putty supports HTTP CONNECT natively. And with ssh, one could
> use a ProxyCommand based on "nc -X connect ...". No need for Tramp to
> implement it itself anymore.
>
> This would perform much better than my implementation in
> tramp-gw.el. And this bug would disappear automatically.
>
> So let's keep this bug as reminder. And I will see, whether I could
> document these settings in the Tramp manual. There are some free days
> next two weeks, isn't it the Xmas break?

Done, closing the bug.

Best regards, Michael.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.