Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Strengthen OpenSSH security?
From: Theo de Raadt <deraadt () cvs openbsd org>
Date: Thu, 20 Apr 2006 19:15:30 -0600

It seems to me that sshd should not tip its hand by returning different
responses when a user ID can be used for logins than when it can't --
allowing an attacker to focus password guessing attacks on user IDs with
which it would have a chance of gaining access. For those folks out there
who are more familiar with OpenSSH than I am: How hard would it be to
make the responses indistinguishable?

Are you running the latest version of portable OpenSSH? If not, you need to 
upgrade. As far as I know, there should be no more leaks of this sort in 
the current code. If there are, please notify the openssh developers (and 
include your authentication configuration - your PAM modules may be leaking 
the info, and there's nothing OpenSSH can do about that).

He's right.  If there are still problems with leakage, it is due to PAM.

And we can't do anything about it.

I will try to be as nice as anyone has ever seen me be:

        PAM is completely and utterly broken and cannot be fixed.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]