http://bugzilla.mindrot.org/show_bug.cgi?id=117 ------- Additional Comments From djm at mindrot.org 2003-03-10 11:57 ------- Created an attachment (id=245) --> (http://bugzilla.mindrot.org/attachment.cgi?id=245&action=view) Use supplied username in pam_start calls always Make sshd always use supplied username (even if it is invalid) in calls to PAM ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.
http://bugzilla.mindrot.org/show_bug.cgi?id=117
djm at mindrot.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |patch
------- Additional Comments From djm at mindrot.org 2003-03-10 12:17 -------
I'm still not sure whether supplying a bad username to PAM is a good idea,
but
at least there is a patch that people can try timing attacks against.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.