Re: Can't login to an OS X box using ssh

From: Richard E. Silverman (slade@shore.net)
Date: 02/26/03 

From: slade@shore.net (Richard E. Silverman)
Date: 26 Feb 2003 10:10:32 -0500

> (Explanation of "debug1: sshd version <CHANGED>": one of my linux guru
> friends seemed to think that sshd giving out it's version tag was a
> security issue since a hacker could look for vulerabilities in that
> particular version. This seemed correct to me at the time and so I
> allowed him to help me hack the sshd to display a wierd string there.
> It worked fine after I made the change and sshd is still working in
> some cases, so I don't think this is the problem. But then again, I
> could be wrong ;-) )

Yes, you and your friend are wrong; this is your problem. The version
comment string allows SSH programs to recognize specific implementations
and work around known incompatibility problems. In this case, it's an
issue with the DH group-exchange draft protocol extension. If you return
the string to its normal state, this problem will go away.

Munging the string is not a real security win anyway, since your attacker
can simply try known exploits and see if they work. In fact, since your
attacker knows that you can change that string if you want and hence he
can't trust it, it's probably what he's going to do anyway.

http://www.snailbook.com/faq/version-string.auto.html 

-- 
  Richard Silverman
  slade@shore.net

Relevant Pages

  • Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
    ... probably a content-type/file association/command string handling problem. ... padding and added IO checking of a very secure app. ... secure programming language or framework. ... hyperventalating over the security of your own code will ever make it ...
    (Full-Disclosure)
  • Re: WSE 3.0, usernameOverTransportSecurity, custom Token Manager w/ securityTokenManager,
    ... I've added the web service call directly to my Data binding method ... expected but not present in the security header of the incoming ... the username token to the message. ... protected override string AuthenticateToken(UsernameToken token) ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: WSE2005: Protection requirements in MutualCertificate11Asserti
    ... error when there is a algorithm mismatch between the client and the ... The Web service is using different security requeriments. ... my client, the response page is a browser page ... message, String messageContentType) ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Secure C library
    ... I read much of the new "security TR", and gee, I don't know. ... the buffer from the buffer size. ... It is not hard to design a better form of buffer and string handling. ... but this is just one example of how thoughtful interface design can ...
    (comp.std.c)
  • Re: WSE2005: Protection requirements in MutualCertificate11Asserti
    ... The solution will be to make my client match the service since ... The Web service is using different security requeriments. ... my client, the response page is a browser page ... message, String messageContentType) ...
    (microsoft.public.dotnet.framework.webservices.enhancements)