-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
During the maintenance on December 6th, 2010 I switched the Toolserver
SSH server from Sun SSH to OpenSSH. A difference in how OpenSSH uses
PAM to authenticate users meant that after the change, users were able
to log via SSH using their LDAP password, without using an SSH key.
This error has now been fixed.
If you have no LDAP password set, or if you have a strong password[0],
then this should not have affected you. However, if you had a weak or
easily guessable password set, or if your LDAP password could have been
compromised (e.g. if you wrote it down in plain text somewhere) then
it's possible someone could have used it to gain access to your account.
In that case, I suggest you immediately change your password (via
'passwd'), then review your home directory to ensure no unauthorised
changes have been made (e.g. new SSH keys added, or shell rc files
changed). If you have sensitive data such as SSH or PGP keys on the
Toolserver, you may wish to revoke them and issue new ones. (However,
storing that kind of data on the Toolserver is probably a bad idea in
any case.)
I'm very sorry for the inconvenience this issue might cause to users,
and I will be reviewing our authentication configuration to reduce the
chance of something like this happening in the future.
- river.
[0] Which is somewhat enforced by the LDAP password policy, but it's
still possible to set a weak password if you try hard enough.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (NetBSD)
iEYEARECAAYFAk1zvOgACgkQIXd7fCuc5vJpowCeMoLig31BAHnStWakKgeU/ZOr
pCYAoKMEF/6+yzzKGQNVYxXqJuhM2f63
=ykB1
-----END PGP SIGNATURE-----