Security Incidents mailing list archives

Re: OpenSSH anomaly


From: Will Tipton <tiptonw () neverland ncssm edu>
Date: Mon, 23 Feb 2004 14:17:42 -0500 (EST)

This sounds like an issue we had recently.  It turned out that the 
passwords had expired and that openssh is broken as far as dealing with 
it.  If this is the case, as console login should prompt you to change the 
password.  Or, try a chage -l
Will Tipton

On Sun, 22 Feb 2004, Benjamin Franz wrote:


I'm running a RedHat Enterprise 3 ES server that has been running fairly
reliably for a month. This morning we could not remotely login to the
server via SSH because openssh would terminate the connection immediately
(no delay) after apparently successfully logging in - without giving a
prompt. We are current on patches up to Feb 1 with the exception of the
kernel which is RHES 2.4.21-4.0.1.ELsmp. A console reboot succeeded in
restoring connectivity. We couldn't find any footprints in any log or any
suspicious file activity. No record of the failed logins (we attempted
using both pubkey and password) were in the logs. The openssh version is
RedHat's 3.6.1p2-18.

Has anyone else seen something similiar?




---------------------------------------------------------------------------
Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection

Protect your network with the comprehensive security solution that
integrates six applications for ease of use and lower TCO.

Firewall - Virus protection - Spam protection - URL blocking - VPN
- Wireless security.

Download 30-day evaluation at:
http://www.securityfocus.com/sponsor/Astaro_incidents_040219
----------------------------------------------------------------------------


Current thread: