Re: SSH bruteforce on its way...
From: Lionel Ferette (lionel.ferette_at_belnet.be)
Date: 10/26/05
- Previous message: Michael Lang: "Re: SSH bruteforce on its way..."
- In reply to: Michael.Lang_at_jackal-net.at: "Re: SSH bruteforce on its way..."
- Next in thread: Michael Lang: "Re: SSH bruteforce on its way..."
- Reply: Michael Lang: "Re: SSH bruteforce on its way..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: incidents@securityfocus.com Date: Wed, 26 Oct 2005 08:29:17 +0200
Hello Michael,
In the wise words of Michael.Lang@jackal-net.at, on Tuesday 25 October 2005
09:29:
[SNIP]
> I've put the session data on a website
> (http://www.jackal-net.at/tiki-read_article.php?articleId=20) where you can
> see what i've setup and what the guys where doing. (currently only one
> session is online but i'm sure, others will follow :) ... )
Just had a look at that page, and I would recommend against using ethereal to
capture traffic: there are too many vulnerabilities in ethereal's decoders (a
few have been disclosed last week) to allow that program to run unattended as
root (needed to capture traffic). Instead, I always recommend to use tcpdump:
tcpdump -s 1500 -w traffic.trace port 22
(in your case you're only interested in ssh traffic, aren't you? otherwise,
just skip the 'port 22' part).
Then, *as a normal user*, open the trace file with ethereal if you don't like
tcpdump's output of
tcpdump -s 1500 -r traffic.trace -X
Regards,
Lionel
-- "To understand how progress failed to make our lives easier, please press 3" Lionel Ferette BELNET CERT Coordinator Tel: +32 2 7903385 http://cert.belnet.be/ Fax: +32 2 7903375 PGP Key Id: 0x5662FD4B
- application/pgp-signature attachment: stored
- Previous message: Michael Lang: "Re: SSH bruteforce on its way..."
- In reply to: Michael.Lang_at_jackal-net.at: "Re: SSH bruteforce on its way..."
- Next in thread: Michael Lang: "Re: SSH bruteforce on its way..."
- Reply: Michael Lang: "Re: SSH bruteforce on its way..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
