The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


Strengthen OpenSSH security?


<< Previous INDEX Search src / Print Next >>
Date: Mon, 17 Apr 2006 22:31:52 -0600
To: [email protected]
From: Brett Glass <brett@lariat.org.>
Subject: Strengthen OpenSSH security?
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-Virus-Scanned: antivirus-gw at tyumen.ru

I'm sure that most folks with hosts that expose an OpenSSH daemon 
to the Internet have been getting the usual probes and password 
guessing attempts and have been taking appropriate actions (e.g. 
setting AllowUsers and using strong passwords) to protect 
yourselves. But today, on one of my servers, I noticed a new trend: 
the attackers are getting smarter. Apparently, they can tell the 
difference between a user ID which is not named in an AllowUsers 
directive -- or which does not exist at all -- from one for which 
they just haven't guessed the correct password. I've now watched as 
some attackers (but not all... yet) tried various user IDs, noted 
which ones existed and were in AllowUsers, and focused password 
guessing attacks on just those user IDs.

It seems to me that sshd should not tip its hand by returning 
different responses when a user ID can be used for logins than when 
it can't -- allowing an attacker to focus password guessing attacks 
on user IDs with which it would have a chance of gaining access. 
For those folks out there who are more familiar with OpenSSH than I 
am: How hard would it be to make the responses indistinguishable?

--Brett Glass



<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2025 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру