Re: ssh and root on 4.10 = password discovery (maybe)

On Wed, 21 Jul 2004, Tig wrote:

> Hello. I'm not 100% sure if this is a configuration error on my side or
> a 'bad idea' on sshd/FreeBSD sides.
>
> A remote root ssh connection to a FreeBSD 4.10 server (with no remote
> root access) will allow you to 'work out' the root password. However, if
> you try the same against 5.2.1 FreeBSD, you have little chance. The
> following are pretty clear examples.
>
> If this is a config mistake on my side, please let me know as I have
> clearly done something wrong.
>
> Correct root password - 4.10
> tigger@piglet:~% ssh root@4.10-FreeBSD
> Password:
> Connection to 4.10-FreeBSD closed by remote host.
> Connection to 4.10-FreeBSD closed.
> tigger@piglet:~%
>
> Incorrect root password - 4.10
> tigger@piglet:~% ssh root@4.10-FreeBSD
> Password:
> Password:
> Password:
> [e-mail]'s password:
> Permission denied, please try again.
> [e-mail]'s password:
> Permission denied, please try again.
> [e-mail]'s password:
> Permission denied (publickey,password,keyboard-interactive).
> tigger@piglet:~%
>
> Correct root password - 5.2.1
> tigger@piglet:~% ssh root@5.2.1-FreeBSD
> Password:
> Password:
> Password:
> [e-mail]'s password:
> Permission denied, please try again.
> [e-mail]'s password:
> Permission denied, please try again.
> [e-mail]'s password:
> Permission denied (publickey,password,keyboard-interactive).

I roughly remember to have read about that problem for older versions of
OpenSSH.

But on my 4.10 boxes, there's no problem. Looks always like this, correct
and incorrect password given:

% ssh root@box
root@boxes's password:
Permission denied, please try again.
root@boxes's password:
Permission denied, please try again.

Version:

% ssh -V
OpenSSH_3.5p1 FreeBSD-20030924, SSH protocols 1.5/2.0, OpenSSL 0x0090704f

Best regards

Konrad Heuer ([e-mail])  ____            ___  _______
GWDG                           / __/______ ___ / _ )/ __/ _ \
Am Fassberg                   / _// __/ -_) -_) _  |\ \/ // /
37077 Goettingen             /_/ /_/  \__/\__/____/___/____/
Germany


_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[e-mail]"