bugzilla-daemon at mindrot.org
2012-Jul-19 15:47 UTC
[Bug 2026] New: OpenSSH client leaks username to server
https://bugzilla.mindrot.org/show_bug.cgi?id=2026 Priority: P5 Bug ID: 2026 Assignee: unassigned-bugs at mindrot.org Summary: OpenSSH client leaks username to server Severity: normal Classification: Unclassified OS: Linux Reporter: longpoke at gmail.com Hardware: Other Status: NEW Version: 5.9p1 Component: ssh Product: Portable OpenSSH -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: OpenSSH client leaks username to server Context: Some issue tracker that includes portable openssh (https://bugzilla.mindrot.org) When connecting to an SSH server, OpenSSH will send your username as the SSH username if you don't provide one explicitly. This is an information leak. Why is this bad? Imagine Bill Gates is using linux to hack into apple.com. He was told Linux is good, and he is planning on making the next release of windows be an open source Linux distribution. He gets the root password for the SSH server on apple.com. He tries to get on by running "ssh apple.com", it fails for wrong password, then he realizes he forgot to set the username so he runs "ssh root at apple.com". But now apple.com has a login attempt in their logs for the account "billgates" (he was using a botnet which is hardcoded in every Windows kernel, providing an anonymity network to Bill Gates, so apple.com didn't get his IP address). So after Bill Gates changed apple.com to show bad financial reports and say that they're closing down (making them lose all their investors/market share etc), Bill Gates gets arrested because of this irrefutable evidence left in the log file. Now Bill Gates hates Linux forever and will never make Windows be Linux based. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlAIK0cACgkQ3PGpByoQpZHNQACgr6hjOAUzkt23kcMFiIN5r17h jesAniXPMtaT3/bSgegF36gWrVwiJC1W =GDxu -----END PGP SIGNATURE----- -- You are receiving this mail because: You are watching the assignee of the bug.
bugzilla-daemon at mindrot.org
2012-Jul-20 00:14 UTC
[Bug 2026] OpenSSH client leaks username to server
https://bugzilla.mindrot.org/show_bug.cgi?id=2026 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |djm at mindrot.org Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #1 from Damien Miller <djm at mindrot.org> --- Assuming this isn't an unsubtle joke: echo "User notbillgates" > ~/.ssh/config is all you need. -- You are receiving this mail because: You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
bugzilla-daemon at mindrot.org
2015-Aug-11 13:04 UTC
[Bug 2026] OpenSSH client leaks username to server
https://bugzilla.mindrot.org/show_bug.cgi?id=2026 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #2 from Damien Miller <djm at mindrot.org> --- Set all RESOLVED bugs to CLOSED with release of OpenSSH 7.1 -- You are receiving this mail because: You are watching someone on the CC list of the bug. You are watching the assignee of the bug.