full-disclosure - Re: Re: open telnet port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: ahaning at gmail.com (Andrew Haninger)
Subject: Re: Re: open telnet port

> So the solution to not run a backup telnet server for updating SSH is to
> run a second, known insecure version of sshd on a different port,
> presuming of course, that you are allowed to run said sshd on said high
> port in the first place.
Sorry, that was stupid of me. First build the new sshd and start it on
a high port. If you're supposed to have enough access to update sshd,
you should have access enough to run something on a high port.

> Which results in something that sounds a bit like security by obscurity,
> which is bad.
True. Much worse than logging in over telnet would be to run a
temporary sshd on a high port.  Wait...

> You end up presuming that potential attacker cannot do his
> thing because you are using ssh on an oddball port.
I did not suggest running it there for a long time but rather just
enough time to allow you to update your system. You're presuming that
your attacker is presuming that you're smart and not using clear-text
protocols to administer your server.

> Oh, and not everyone is root for all parts of the network they may be
> administrating.
True. That's why you're the admin and why you're updating sshd. You have root.

-Andy