What a great solution. I will use it, but... I guess I found a serious security ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

js4all on Sept 24, 2011 | parent | context | favorite | on: Simple Two-Factor SSH Authentication

What a great solution. I will use it, but...

I guess I found a serious security problem.

When logging ssh commands with '-vT', I can see the secret. The secret should be hard coded in the two_factor script.

moomerman on Sept 24, 2011 [–]

I don't see the secret in the output when I run that command. It just says:

debug1: Remote: Forced command.

moomerman on Sept 24, 2011 | [–]

It seems that certain versions of OpenSSH do print out the command and parameters so I've updated the blog post to include a work-around

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact