But if we wrote a Thimbl user information update server and asked you to run that on your own server, you would do that and consider our service as secure as sshd? Really? Our position is that you give as a standard remote login interface, that is ssh, how you implement that for your own finger users is up to you (see my other comment)
There are ways of locking down an incoming ssh connection to scp-only, you can even filter the files it has access to. I looked into this once, but never implemented it b/c we went elsewhere with the project.
Note: This is by making the handling script the thing that runs for a certain ssh key, I don't think it works with a password though.
Excatly! There are many ways to set up secure ssh access. Which is why a solid, know protocol like ssh is the right one to use for remote login, because it provides many options and all sysops can configure access for their own users as they see fit, yet all users, on all systems can still follow each other.
