[ILUG] openssh vulnerability

[Rick Moen]

[Replying to John Madden's recent post, which unfortunately I've 
already deleted locally.]

John, the bulleted notes in the most recent Debian security advisory 
on this matter cast some light on your experiences, and clear up the 
/etc/ssh/sshd_config default-settings matter:

http://www.debian.org/security/2002/dsa-134

I notice that, contrary to what the advisory says, installing the Debian
Security Team's update package did _not_ create group sshd on my
systems, so I did so myself.  Priv sep does appear to work as described.
(The advisory further confirms what you said about priv sep being the
default even without the keyword.)