Re: [gentoo-user] OpenSSH upgrade warning

[Michael Orlitzky <mjo@gentoo.org>]

On 11/10/2015 03:52 PM, wabenbau@gmail.com wrote:
> 
> That's right. If an attacker has the full control over your machine
> then it doesn't make any difference. 
> 
> But if he can only see what you are typing, for example by a keylogger 
> or by detecting the electromagentic radiation of your keyboard or by 
> watching your keyboard with a camera, then he can do nothing with the 
> root password of your server when root login with password is forbidden.
> 

I said I would give up but I lied.

The scenario that we're talking about has the user log in via an SSH key
to some server. Once he's logged in to the server, the user uses "su" or
"sudo" to become root. This requires that he type the root password. So
a keyboard camera would still obtain the password.

If you never actually obtain root access, of course you are safe =)