Re: Strengthen OpenSSH security?



On Mon, 17 Apr 2006, Brett Glass wrote:

It seems to me that sshd should not tip its hand by returning
different responses when a user ID can be used for logins than when
it can't -- allowing an attacker to focus password guessing attacks
on user IDs with which it would have a chance of gaining access. For
those folks out there who are more familiar with OpenSSH than I am:
How hard would it be to make the responses indistinguishable?

It would help if you reported what the actual differences you were
experiencing are, the operating systems and versions of OpenSSH in
question and how you came to the conclusion that password guessers were
able to figure out the difference.

OpenSSH already tries to minimise any exposed difference when attempting
authentication using a valid account, a non-existent account and a valid
account barred by Allow/DenyUsers policy.

On the platforms immediately at my disposal (Linux running an older
OpenSSH and OpenBSD running CVS -current OpenSSH), there is no visible
difference in the protocol messages sent or in the rough timing between
them when making incorrect password guesses between a valid account in
AllowUsers and one that is not.

We would consider divergences from this as bugs, so if you find one then
please report it to us (see http://www.openssh.com/report.html)

-d



Relevant Pages

  • Re: [Full-disclosure] OpenSSH User Enumeration Time-Based Attack
    ... we will show a bug concerning OpenSSH. ... the attacker is interested in the all-mighty “root” aka ... non-existing account shows a quite high delay. ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • [Full-disclosure] OpenSSH User Enumeration Time-Based Attack
    ... we will show a bug concerning OpenSSH. ... normal Brute-force-Attack tests for the correct user and password ... the attacker is interested in the all-mighty “root” aka ... non-existing account shows a quite high delay. ...
    (Full-Disclosure)
  • Re: Strengthen OpenSSH security?
    ... responses when a user ID can be used for logins than when it can't -- ... allowing an attacker to focus password guessing attacks on user IDs with ... Are you running the latest version of portable OpenSSH? ...
    (Bugtraq)
  • Re: Strengthen OpenSSH security?
    ... responses when a user ID can be used for logins than when it can't -- ... allowing an attacker to focus password guessing attacks on user IDs with ... Are you running the latest version of portable OpenSSH? ...
    (Bugtraq)
  • Re: sshd [871] random session key or cracked?
    ... >scanner trying to look for UseLogin=Yes OpenSSH <v3.x hosts on which to ... if the attacker want's to do this, he already needs an local account ...
    (comp.security.unix)