anchor.diff:  
   NOTE: This technique is ineffective if your distribution applied the patches
         for http://roumenpetrov.info/openssh/[X.509 certificate support] in
  -      OpenSSH. Gentoo with the X509 USE flag is one such distribution. Use
  +      OpenSSH. Gentoo with the `X509` USE flag is one such distribution. Use
         the shared memory inspection technique in that case.
   
   The command `ssh -G` has a different behavior on a system with
  
positive.code: ==== Shared Memory Inspection
  
  Linux/Ebury relies on POSIX shared memory segments (SHMs) for interprocess
  communications. Currently, it uses large segments of over 3 megabytes of memory
  with broad permissions like 666 (which means readable and writable by
  everyone).
  
  CAUTION: Other processes could legitimately create shared memory segments
           with broad permissions. Make sure to validate that `sshd` is the
           process that created the segment like we show below.
  
  Identify large shared memory segment with broad permissions by running the
  following as root:
  
  [listing]
  ....
  
negative.code: 0x00000000 0          root      644        80         2
  0x00000000 32769      root      644        16384      2
  0x00000000 65538      root      644        280        2
  0x000010e0 465272836  root      600        3282312    0
  ....
  
  Then to look for the process that created the shared memory segment, use:
  