Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: On why debugging OpenSSH can be so hard |
|---|---|
| Date: | Tue, 8 Jul 2008 10:24:59 +0300 |
2008/7/8, Ben Ford <ben@kalifornia.com>:
No. He's saying that it leaks information that doesn't need to be leaked. For comparison, long long ago, there used to be different error messages when authentication failed. It would helpfully tell you that your password was wrong, or that you'd supplied the wrong username. Great for debugging, right? Well yeah ... and it was great for enumerating the users on the box, making further attacks much simpler.
How about leaving what ssh server sends to the client as it is but making it at least log in syslog that the key was not found? VL
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: On why debugging OpenSSH can be so hard, Ben Ford |
|---|---|
| Next by Date: | Re: SSH VPN trouble, LÃszlà Monda |
| Previous by Thread: | Re: On why debugging OpenSSH can be so hard, Ben Ford |
| Next by Thread: | RE: On why debugging OpenSSH can be so hard, Parsons, Rick |
| Indexes: | [Date] [Thread] [Top] [All Lists] |