共236篇文章。
Sometimes, when you are in a NAT’ed environment, ssh connection may be dropped when the gateway is busy.
OpenSSH has provided a solution against this.
The option is called “ClientAliveInterval”. With this setting in your sshd_config, sshd(8) would send a ping message through the encrypted channel periodically, thus prevent the early drop.
The default setting is 15, meaning the ping period is 15 seconds.
我们来看看那个人说的这段话：
I’d be really surprised if somebody is actually able to get a real-world attack on a real-world pgp key usage or similar out of it (and as to the covert channel, nobody cares). It’s a fairly interesting approach, but it’s certainly neither new nor HT-specific, or necessarily seem all that worrying in real life.(HT and modern CPU speeds just means that the covert channel is _faster_ than it has been before, since you can test the L1 at core speeds. I doubt it helps the key attack much, though, since faster in that case cuts both ways: the speed of testing the cache eviction may have gone up, but so has the speed of the operation you’re trying to follow, and you’d likely have a really hard time trying to catch things in real life).
It does show that if you want to hide key operations, you want to be careful. I don’t think HT is at fault per se.
A decision was made to enable SPF on beastie. SPF is a technology that mitigates forged spam (while it itself is not totally spam proof, as spammers can set up their own SPF record :-)
This article has suggested a way of hiding version.bind string. From a security perceive, this is an overkill and can usually be harmful:
Security can NOT be built on what others are not aware of.
Colin Percival has released his paper about a complex security issue that accompany with Intel HyperThreading Technology. This has became FreeBSD Security Advisory SA-05:09.htt.
Colin is very effective man that has made some changes to the kernel, and so@ has approved this, and 5.4-RELEASE gets its first patchlevel.
I’m happy that this did not forced me to go to the hosting provider :-)
Today, Colin has committed three security fixes that addresses three medium-risk security issues in FreeBSD kernel. That results in p11, p12 and p13 of FreeBSD 5.3-RELEASE, and has been committed to RELENG_5_4 as well so we will get that in the final release build.
Ken Smith has announced the tagging (with a mini heads-up in developers@), and then committed the naming (5.4-RELEASE) to the RELENG_5_4 tree. After that, RELENG_5_4 was tagged as RELENG_5_4_0_RELEASE, which is the last step of the release engineering that is related to the src/tree.
Please note that, this is not the final step of the final release. FreeBSD is very careful about the quality (not only as opposed to the kernel with colorful history of its security record, which is released under GPL and often release from time to time, haha, you know which is that) of a release, therefore, tagging does not mean that “we made it”, that is just a stage. Please be patient to wait for the PGP signed 5.4-RELEASE announcement BEFORE you download isos, even they were found on any sites.
Many SSH clients supports “key agent” or “authentication agent”, which holds private key for you, and ease the authentication process.
By default, OpenSSH does not enable this. You can easily use ssh-agent(1) to accomplish the mission.
ssh-agent startx
The above command will start X session with ssh-agent. This means that you can add private key to the agent.
ssh-add ~/.ssh/id_dsa
Add your own ssh key.
Then ssh authentications will be accomplished automatically. Note that you may need to use ssh -A in certain configurations.
They did it again!
CAN-2005-0176
CAN-2005-0177
CAN-2005-0178
CAN-2005-0449
Before patching your already fragile kernel, consider other true Open Source operating systems, like FreeBSD and DragonFlyBSD!
一个神话的最终结束……
http://www.schneier.com/blog/archives/2005/02/sha1_broken.html