bugtraq - Re: Strengthen OpenSSH security?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200604210115.k3L1FUTo017686@cvs.openbsd.org>
Date: Thu, 20 Apr 2006 19:15:30 -0600
From: Theo de Raadt <deraadt@....openbsd.org>
To: Carson Gaspar <carson@...tos.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: Strengthen OpenSSH security?

> > It seems to me that sshd should not tip its hand by returning different
> > responses when a user ID can be used for logins than when it can't --
> > allowing an attacker to focus password guessing attacks on user IDs with
> > which it would have a chance of gaining access. For those folks out there
> > who are more familiar with OpenSSH than I am: How hard would it be to
> > make the responses indistinguishable?
> 
> Are you running the latest version of portable OpenSSH? If not, you need to 
> upgrade. As far as I know, there should be no more leaks of this sort in 
> the current code. If there are, please notify the openssh developers (and 
> include your authentication configuration - your PAM modules may be leaking 
> the info, and there's nothing OpenSSH can do about that).

He's right.  If there are still problems with leakage, it is due to PAM.

And we can't do anything about it.

I will try to be as nice as anyone has ever seen me be:

	PAM is completely and utterly broken and cannot be fixed.