>>> So I'm lying, then, is that it?
>>
>> OK, let me put it this way: I've never seen any manpage which is
>> anything more than a terse summary of command switches with an
>> incomplete description of what they do. The most in-depth manpage I've
>> seen is for Bash, which is still only a reference document, not an
>> introductory tutorial.
>
> Man pages are not intended to be tutorials.  They're manual pages.

...which is the point I'm trying to make, yes.

>> Then again, sometimes the manpage just says "use info". And then you had
>> /another/ problem...
>
> Well, no, it's not *another* problem - you just need to use the info
> command instead.

Have /you/ tried navigating the thing?

Since I'm guessing the answer is probably "yes", then I don't need to 
explain to you how hard it is...

>>> It doesn't say anything about CHAP.  I'm pretty sure it also doesn't
>>> change the password encryption method from AES to Triple-DES as well.
>>> It's not likely to document everything it *doesn't* do, just what it
>>> *does* do.
>>
>> So even with this line, people can *still* authenticate by password.
>
> Not to the best of my knowledge.

I'm fairly sure I tested it, and discovered that I needed to turn off 
multiple things to stop it accepting my password as a valid login. But 
since that was then and this is now, I guess I might be incorrect.

>>>> I thought the host key is how the server identifies itself to you, not
>>>> how you identify yourself to the server?
>>>
>>> Host keys aren't very commonly used AFAIK.
>>
>> All three of the SFTP systems we use commercially have them.
>
> A sample size of 3 isn't exactly data supporting "commonly used".

It's infinity times larger than a sample size of zero. ;-)

Then again, one of these systems is set up to use PK authentication, and 
the server administrators emailled /us/ with the private key to use to 
get access. *facepalm*

Imagine it: Going to all the trouble of setting up a secure system, and 
not even knowing how to secure it properly...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message