back

by LinuxBender·10y ago·view on hn ↗
This didn't exist in 2000. It was created and made default on the server in OpenSSH 5. OpenSSH 5 did not make it into enterprise distros for quite some time.

There are literally tens of thousands of articles telling folks to enable ControlMaster (Multiplexing) on the client to "make ssh faster". You would be hard pressed to find a devops shop that isn't already using ControlMaster in their ssh client config. There are at least a handful of government and financial sites that set MaxSessions to 1 because they understand the risk.

1 comments
This specific mechanism didn't exist in 2000; the behavior is no different from the ILOVEYOU virus: user runs code, code does something malicious, code contacts cracker.

It all boils down to "if you require security, you can't have a default-open environment"; blaming a specific tool seems ... strange.

Strange as it may be, this virus will never be detected as a virus. That is why I am blaming the default settings in the tool.