summaryrefslogtreecommitdiff
path: root/lib/libpam/modules
diff options
context:
space:
mode:
authorthorpej <thorpej@NetBSD.org>2005-02-27 21:32:46 +0000
committerthorpej <thorpej@NetBSD.org>2005-02-27 21:32:46 +0000
commit80ea74d85df53c60929ce4e1afd6f3f5a974872e (patch)
tree0d82d4dc3623014889847acc7258b8fff9e3d6a1 /lib/libpam/modules
parent11b55133f088b4a35276523ed7cf82ce66b08f6b (diff)
Add a SECURITY CONSIDRATIONS section.
Diffstat (limited to 'lib/libpam/modules')
-rw-r--r--lib/libpam/modules/pam_ssh/pam_ssh.819
1 files changed, 18 insertions, 1 deletions
diff --git a/lib/libpam/modules/pam_ssh/pam_ssh.8 b/lib/libpam/modules/pam_ssh/pam_ssh.8
index 48b692c334d..d965698db76 100644
--- a/lib/libpam/modules/pam_ssh/pam_ssh.8
+++ b/lib/libpam/modules/pam_ssh/pam_ssh.8
@@ -1,4 +1,4 @@
-.\" $NetBSD: pam_ssh.8,v 1.3 2005/02/26 15:14:44 thorpej Exp $
+.\" $NetBSD: pam_ssh.8,v 1.4 2005/02/27 21:32:46 thorpej Exp $
.\" Copyright (c) 2001 Mark R V Murray
.\" All rights reserved.
.\" Copyright (c) 2001-2003 Networks Associates Technology, Inc.
@@ -150,3 +150,20 @@ Associates, Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035
as part of the DARPA CHATS research program.
This manual page was written by
.An "Mark R V Murray" Aq markm@FreeBSD.org .
+.Sh SECURITY CONSIDERATIONS
+The
+.Nm
+module implements what is fundamentally a password authentication scheme.
+Care should be taken to only use this module over a secure session
+.Po
+secure TTY, encrypted session, etc.
+.Pc ,
+otherwise the user's SSH passphrase could be compromised.
+.Pp
+Additional consideration should be given to the use of
+.Nm pam_ssh .
+Users often assume that file permissions are sufficient to protect their
+SSH keys, and thus use weak or no passphrases.
+Since the system administrator has no effective means of enforcing
+SSH passphrase quality, this has the potential to expose the system to
+security risks.