Bugtraq mailing list archives
Re: Strengthen OpenSSH security?
From: Damien Miller <djm () mindrot org>
Date: Thu, 20 Apr 2006 15:13:54 +1000 (EST)
On Mon, 17 Apr 2006, Brett Glass wrote:
It seems to me that sshd should not tip its hand by returning different responses when a user ID can be used for logins than when it can't -- allowing an attacker to focus password guessing attacks on user IDs with which it would have a chance of gaining access. For those folks out there who are more familiar with OpenSSH than I am: How hard would it be to make the responses indistinguishable?
It would help if you reported what the actual differences you were experiencing are, the operating systems and versions of OpenSSH in question and how you came to the conclusion that password guessers were able to figure out the difference. OpenSSH already tries to minimise any exposed difference when attempting authentication using a valid account, a non-existent account and a valid account barred by Allow/DenyUsers policy. On the platforms immediately at my disposal (Linux running an older OpenSSH and OpenBSD running CVS -current OpenSSH), there is no visible difference in the protocol messages sent or in the rough timing between them when making incorrect password guesses between a valid account in AllowUsers and one that is not. We would consider divergences from this as bugs, so if you find one then please report it to us (see http://www.openssh.com/report.html) -d
Current thread:
- Strengthen OpenSSH security? Brett Glass (Apr 19)
- Re: Strengthen OpenSSH security? Mike Hoskins (Apr 20)
- Re: Strengthen OpenSSH security? Carson Gaspar (Apr 20)
- Re: Strengthen OpenSSH security? Theo de Raadt (Apr 21)
- Re: Strengthen OpenSSH security? Kd (Apr 20)
- Re: Strengthen OpenSSH security? MaddHatter (Apr 20)
- Re: Strengthen OpenSSH security? Damien Miller (Apr 20)
- Re: Strengthen OpenSSH security? c0redump (Apr 20)
- <Possible follow-ups>
- Re: Strengthen OpenSSH security? Bob Goodman (Apr 23)