From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: Leo Famulari <leo@famulari.name>
Cc: Christopher Allan Webber <cwebber@dustycloud.org>,
26695-done@debbugs.gnu.org
Subject: bug#26695: openssh password-authentication? should be #f by default
Date: Mon, 28 Aug 2023 23:24:46 -0400 [thread overview]
Message-ID: <87jzteedj5.fsf@gmail.com> (raw)
In-Reply-To: <20170428192834.GB6736@jasmine> (Leo Famulari's message of "Fri, 28 Apr 2017 15:28:34 -0400")
Hi,
Leo Famulari <leo@famulari.name> writes:
> On Fri, Apr 28, 2017 at 09:37:13AM -0500, Christopher Allan Webber wrote:
>> Our default permits password authentication for the openssh service (and
>> the others it seems) by default in Guix. This is somewhat dangerous
>> because this is a much easier to break in this way, and some users might
>> not assume the default is reasonably safe. If users really want
>> password-authentication, they should turn it on explicitly.
>
> The upstream default is to allow password authentication (see
> sshdconfig(5)).
>
> With the current GuixSD defaults, my understanding is that nobody will
> be able to login remotely to a new GuixSD system with the default
> openssh-service, unless they make the effort to insert the user's
> password in their GuixSD declaration. Remote root login and empty
> password login is disabled by default.
>
> So the current situation seems safe to me. Please let us know if you see
> a hole.
I agree with your assessment. I think there's probably more hurt than
benefit in diverging from upstream's choice of defaults here.
I'm thus closing this old forgotten report.
--
Thanks,
Maxim
prev parent reply other threads:[~2023-08-29 3:26 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-28 14:37 bug#26695: openssh password-authentication? should be #f by default Christopher Allan Webber
2017-04-28 16:09 ` Maxim Cournoyer
2017-04-28 16:37 ` Christopher Allan Webber
2017-04-28 16:40 ` Maxim Cournoyer
2017-04-28 17:23 ` Marius Bakke
2017-04-28 18:25 ` Christopher Allan Webber
2017-04-30 19:47 ` Chris Marusich
2017-04-28 19:28 ` Leo Famulari
2023-08-29 3:24 ` Maxim Cournoyer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87jzteedj5.fsf@gmail.com \
--to=maxim.cournoyer@gmail.com \
--cc=26695-done@debbugs.gnu.org \
--cc=cwebber@dustycloud.org \
--cc=leo@famulari.name \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).