Re: [cobalt-users] ssh stopped working and can't login as root

[Jeff Lasman <jblists@xxxxxxxxxxxxx>]

Wayne Sagar wrote:

> I read somewhere that ssh clients will not differentiate between asskey and
> binary, in fact, only sending files in binary.

WinSCP2 differentiates based on suffix rules, or lets you decide on a
case by case basis.

While it's probably true of the command-line clients we use on linux, it
shouldn't matter if we're moving between linux systems via the
command-line interface, on linux/unix there's no difference between
ascii (note spelling) and binary files.  The difference is only that
Windows and Linux use different characters for "end of line" character.

> Is this true? Any way to
> "trick" it by sending them as zipped or something?

Except that zipping them wouldn't help; by default the files DO NOT get
their end-of-line characters changed; if you're sending ascii between
Windows and Linux, you DO want them changed; zipping wouldn't do that.

There are lots of little programs/scripts around that'll do the changes
in both directions, and editors (joe, available via anonymous ftp from
ftp.nobaloney.net, for example) that can be set to work with
Windows-type ascii files on linux.  But it's not an issue with WinSCP2
and linux.

> I like the idea of a
> secure "ftplike" client to use, I don't like the idea of having to give
> shell access to users to be able to utilize these sshftp things. I did
> install the SafeTP client, but found that it gave me intense problems with
> my firewall, (home firewall) I was personally able to get it to work, but
> for any site users, it would have been over some of their heads so I did not
> impliment it ..*yet*..
> 
> Seems a good choice, other than that it has to be left open all the time. I
> normally keep ftp off, using it only when necessary, and fortunately for me,
> I don't have too many non-managed sites who need it.

We let customers manage their own sites via ftp.  We lock them to their
own directory path.  We separate email accounts from ftp accounts.

Very few websites have ever been defaced using ftp.  Most are defaced by
other exploits, usually aimed at "root" or "real" sites, not at virtual
sites such as those the RaQ uses.

> Found out one thing about MSFP, they don't need FTP on to upload. <scary>
> nor do they need sendmail to send mail from their sites.. <also scary>
> convenient but ... scary!

FP uploads via http, as does Netscape's browser.  FP can't require
sendmail, since it's designed to run on WinNT/2K, and most people don't
run sendmail on WinNT/2k.

Jeff
-- 
Jeff Lasman <jblists@xxxxxxxxxxxxx>
Linux and Cobalt/Sun/RaQ Consulting
nobaloney.net
P. O. Box 52672, Riverside, CA  92517
voice: (909) 778-9980  *  fax: (702) 548-9484