full-disclosure - Re: Re: open telnet port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Re: Re: open telnet port 

On Thu, 09 Sep 2004 16:37:28 -0000, ktabic said:

> So the solution to not run a backup telnet server for updating SSH is to
> run a second, known insecure version of sshd on a different port,
> presuming of course, that you are allowed to run said sshd on said high
> port in the first place.

It's not perfect, but it's a hell of a lot better than telnet.

Security is never perfect, it's a set of trade-offs.  You don't like the risk
of starting another one, you're of course free to not do so, and find some
other way to do it (do it with physical access to the console, ssh to a
console server, whatever).

> Which results in something that sounds a bit like security by obscurity,
> which is bad. You end up presuming that potential attacker cannot do his
> thing because you are using ssh on an oddball port.

No.. you're betting on creating a *much smaller* window of vulnerability.
The fact that you're accepting remote connections *at all* means that we're
making some security vs ease-of-use tradeoffs already.

> Oh, and not everyone is root for all parts of the network they may be
> administrating.

I've never come across a case where somebody was sufficiently authorized to
install a patch to the ssh software, but not sufficiently authorized to start/
restart the daemon.  Possibly true for some military and other *very*
high-security systems where they're *very* anal-retentive about separation of
privileges, but I've not seen one....

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040909/3f100057/attachment.bin