Re: Re: Re: open telnet port

[Valdis.Kletnieks () vt edu]

On Thu, 09 Sep 2004 16:37:28 -0000, ktabic said:

> So the solution to not run a backup telnet server for updating SSH is to
> run a second, known insecure version of sshd on a different port,
> presuming of course, that you are allowed to run said sshd on said high
> port in the first place.

It's not perfect, but it's a hell of a lot better than telnet.

Security is never perfect, it's a set of trade-offs.  You don't like the risk
of starting another one, you're of course free to not do so, and find some
other way to do it (do it with physical access to the console, ssh to a
console server, whatever).

> Which results in something that sounds a bit like security by obscurity,
> which is bad. You end up presuming that potential attacker cannot do his
> thing because you are using ssh on an oddball port.

No.. you're betting on creating a *much smaller* window of vulnerability.
The fact that you're accepting remote connections *at all* means that we're
making some security vs ease-of-use tradeoffs already.

> Oh, and not everyone is root for all parts of the network they may be
> administrating.

I've never come across a case where somebody was sufficiently authorized to
install a patch to the ssh software, but not sufficiently authorized to start/
restart the daemon.  Possibly true for some military and other *very*
high-security systems where they're *very* anal-retentive about separation of
privileges, but I've not seen one....

Attachment: _bin
Description: