Re: ssh rulez

[Felix Lee <flee@teleport.com>]

> Is that true?  I thought the whole point of ssh/sshd was allow secure
> remote access through encryption, and host/user verification by encrypted
> keys.

yes, but there's no access control to the forwarded port.
if port 119 on your machine is being forwarded somewhere,
all the traffic between you and the somewhere is encrypted
and compressed, etc, but ssh doesn't care who connects to
port 119 on your local machine.

forwarded connections (like the X forwarding) typically rely
on end-to-end user authentication (like xauth) to be secure.
however, nntp authentication tends to be weak, and often
relies on "source" IP address, which looks like it's you if
you're using forwarding.

it shouldn't be too hard to add to ssh a flag that says,
"don't accept connections at the forwarding port unless they
come from a particular IP address", but I don't see such a
thing (in 1.2.20 at least.  haven't looked at newer yet.)
--