Re: using PubkeyAuthentication, still getting dictionary attacks!

"NN" == Nomen Nescio <nobody@xxxxxxxxx> writes:

NN> Unruh <unruh-spam@xxxxxxxxxxxxxx> wrote:
>> >AIUI, dictionary attacks on PubkeyAuthentication are hopeless, and
>> I'm >surprised the attacking "clients" try it. Am I right? Why do
>> they keep >trying? Anything else I can/should do?
>>
>> Do you thinkthat there is a human being behind those attacks,
>> trying all the passwords? It is a program. which is launched from
>> someone else's computer.

NN> Of course I know that ... what I mean is, can't the bot tell that
NN> the server only takes key authentication?

NN> What's the bot trying to send me, random big numbers?

No, it's likely still trying password authentication. The SSH-AUTH
protocol allows a client to try any authentication method it likes at any
point, regardless of whether the server accepts it. The attack program in
question probably just connects and tries passwords, without bothering to
notice whether password authentication is even supported.

--
Richard Silverman
res@xxxxxxxx

.

Relevant Pages

  • RE: VmWare and Pen-test Learning
    ... Setup a tftp server on your client machine. ... Use John the Ripper to crack the passwords. ... (dictionary attacks, brute force, single mode). ... Download FREE whitepaper on how a managed service can help ...
    (Pen-Test)
  • RE: Whitespace in passwords - now alt+xxx
    ... Subject: Whitespace in passwords ... 60 possible characters and the password is 7 characters long. ... >> Check your website for vulnerabilities to SQL injection, ... >> scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • RE: policy-based password cracker
    ... that required at least one upper, one lower and one number in all passwords. ... password checks can be eliminated due to the policy. ... Since the vast majority of the time for a brute-force attack is ... most brute-force attacks are very fast. ...
    (Pen-Test)
  • RE: Rainbow Tables
    ... Subject: Rainbow Tables ... Fortunatly for this project we are only doing LM passwords, ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
    (Pen-Test)
  • pf vs null route
    ... My web server is always being attacked by people trying to guess our user's passwords. ... For a long time I have been using null routes for the persistent attacks. ... I do have pf running on several of our servers for other purposes and have been thinking about replacing the null routes with a blocking table using pf. ...
    (freebsd-questions)