search for: thordur

I ran chkrootkit ( v. chkrootkit-0.43 ) earlier and noticed that chfn, date, and chsh showed as being infected. I remember reading post from the past that right now chkrootkit is giving alot of false positives, so I suspected that these 3 binaries are not bad. However, to be on the safe side, I deleted the 3 binaries, removed /usr/src and did a 'make world' to 4.10-STABLE. But, chfn,

Hi all again, I must add, there are no log entries after June 9, 2004. "LKM" message first apeared June 8, 2004, after this day, there is nothing in /var/messages, /var/security ..... How could I look for suspicious LKM module ? How could I find it, if the machine is hacked and I can not believe "ls", "find" etc. commands ? Peter Rosa

...rictHostKeyChecking Product: Portable OpenSSH Version: 7.1p1 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 Component: ssh Assignee: unassigned-bugs at mindrot.org Reporter: thorduri at secnorth.net Created attachment 2753 --> https://bugzilla.mindrot.org/attachment.cgi?id=2753&action=edit Two patches for the above. When SSHFP RR is missing (while there are records available) ssh does not distinguish between these two, leading to confusing error messages, that is th...

...connection should be allowed to proceed; I'm unsure if this is by design or not (as presented host key and known host key match), but I'd argue this violates POLA. Attached are two na?ve patches to portable (cloned from anongit at mindrot.org) that attempt to tackle the above. -- /ciao, thorduri.