Re: Logging attempted passwords

From: Greg Wooledge (wooledg_at_eeg.ccf.org)
Date: 10/25/04

  • Next message: pleriche: "Re: Logging attempted passwords" 
    Date: Mon, 25 Oct 2004 07:46:04 -0400
To: secureshell@securityfocus.com

    On Mon, Oct 25, 2004 at 02:48:43AM +0900, Derek Martin wrote:
    > In some rare and extreme
    > cases, I can even conceive of it being possible to know passwords that
    > people are successfully using... such as (perhaps) when tracking a
    > cracker illegally accessing your systems.

    For a honeypot, it does make sense. But anyone capable of setting up
    a honeypot should be capable of editing the source code to change the
    logging.

    > No, but even if my password is not logged in some log, I would think
    > my password was not safe if I knew that someone had gotten a hold of
    > the logs...

    Someone might have managed to get hold of your backup media, without
    having compromised the system itself. Or if you're logging to a remote
    system, perhaps they sniffed the syslog traffic. There are any number
    of situations in which logfiles might be retrieved without requiring
    a compromise of the system that generated them.

  • Next message: pleriche: "Re: Logging attempted passwords"

    Relevant Pages

    • Re: SSH as root
      ... and the passwords are sent securely. ... unix passwords is when the same passwordcan be used to compromise ... > you are in the same boat if you choose passwords, or keys with passphrases. ... Yes, indeed, if the client system is compromised then all bets are off, ...
      (SSH)
    • SSH & root logins
      ... people are logging into boxes across their own (internal, ... If you are using SSH, do you rely on public/private key pairs solely, ... regular users but forcing the use of passwords for root? ...
      (SunManagers)
    • Monkeybrains.net and badtrans compromise information
      ... I recently received an e-mail from a security ... Para-Protect is doing investigations into compromised accounts associated ... Though actual username and passwords are not specifically displayed at the ... compromise of accounts and passwords for a specific domain will be. ...
      (Incidents)
    • Re: Password log in problem
      ... The passwords are correct and the only way to log in is to restart the computer and then the passwords will work. ... The first thing to ask is whether the users are logging in to a Windows Domain using their Domain accounts; or are they logging in using local workstation accounts? ... If various workstations cannot log on to the Domain from time to time, there's probably a communications problem between the workstations and the DC. ...
      (microsoft.public.windowsxp.general)
    • Re: ALERT: WPA-TKIP isnt secure - use WPA2 instead
      ... If passwords aren't changed regularly, ... why "compromise is much more likely". ... How good is the encryption? ... don't tell you what the valid characters are for passwords. ...
      (alt.internet.wireless)