similar to: Keyboard Interactive Attack?

You need to disable ?ChallengeResponse? (aka keyboard-interactive) authentication, not password authentication, to protect against this attack. On Jul 22, 2015, at 1:56 PM, Bostjan Skufca <bostjan at a2o.si> wrote: > > And to answer your question about what to do, you have three options: > - disable access to ssh with a firewall > - disable password authentication > -

Quoth Iain: >I'm not sure if the work being done to allow OpenSSH to be built without OpenSSL includes SHA-1 support. Hi Iain. I haven't heard of this effort before. Can you give a few more details? Thanks, ScottN --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

I haven't been keeping up with the internals, I'm afraid. Does OpenSSH have support for Port Knocking? I might be interested in looking into that, as a way of reacquainting myself with the current code base. --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

Thanks for clarification. One question though: As far as I have tested openssh, it logs every unsuccessful authentication attempt on the very moment it becomes unsuccessful, not after the connection is closed (after timeout or when reaching max auth attempts). Is this true or not even for this attack or not? Because if it is true, if there is a IDS system that bans IP after X failed logins,

Hi everyone, I know scp is kind of the red-headed stepchild of the suite, but I'd like to propose an extension to the syntax for remote-remote passthrough using the "-3" option. Currently the syntax is essentially scp -3 [ -P port ] [user@]host1:file [user@]host2:file This is great, as long as both remotes are on the same port. It causes difficulties if host1 and host2 are not

I may have asked this before ... my memory is bad. Is it possible to run "make tests" on a cross-compile build? --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

I'm seeing something similar to bug 1179 (https://bugzilla.mindrot.org/show_bug.cgi?id=1179), even with the reordered IP options check. For some reason, getsockopt is returning an IP options of length 2, value 00 00. Would Mark Weindling's original patch (https://bugzilla.mindrot.org/attachment.cgi?id=1105) break anything if I incorporated it? Platform: HP NonStop S7000 series

A couple of notes about mget/mput in SFTP (5.1p1). 1. They aren't documented in the SFTP man page 2 They misbehave -- "mput a.txt b.txt" copies a.txt to b.txt on the server "mput *.txt b.txt" copies the first wildcard match to b.txt on the server "mput a.txt b.txt c.txt" copies a.txt to b.txt on the server "mput a.txt

I'm using 5.0p1 (Yeah, yeah. I know.). For various reasons, I am unable to upgrade to the latest and greatest, which probably would solve my problem. Here's my question. When doing an scp from remote to local (e.g.: scp user at host:remote localfile), is there any way to specify the path to the remote scp? Or do I have to patch the code to allow it? ---- Scott

For 6.6p1, is there a way to run configure for a cross-compiler? --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

Oops. That's -T. From the man page, it doesn't really look like there's an ssh_config option for -N. -----Original Message----- From: openssh-unix-dev [mailto:openssh-unix-dev-bounces+scott_n=xypro.com at mindrot.org] On Behalf Of Scott Neugroschl Sent: Tuesday, August 09, 2016 1:04 PM To: Volker Diels-Grabsch; openssh-unix-dev at mindrot.org Subject: RE: Equivalent ssh_config

I'm working from modified 5.0p1 codebase. What I'm looking for is a mechanism to limit the number of simultaneous connections on a per-user/IP basis. That is, disallow multiple simultaneous logins/authentication of the same user from different IP addresses. e.g.: fred from 10.1.1.1 - accept fred from 10.1.1.2 -- reject while fred is still connected from 10.1.1.1 fred from 10.1.1.1 - OK

On 13/04/18 07:59, Josh Soref wrote: > Randall S. Becker <rsbecker at nexbridge.com> wrote: > >> -REGRESSTMP = "$(PWD)/regress" >> +REGRESSTMP = `pwd` >> >> ? tests interop-tests t-exec unit: regress-prep regress-binaries >> $(TARGETS) >> > It looks like the problem is that pwd is in uppercase, not so much the > distinction between

On Thu, Apr 20, 2017 at 11:00 AM, Scott Neugroschl <scott_n at xypro.com> wrote: > > On Wed, Apr 19, 2017 at 1:02 PM, navern <livingdeadzerg at yandex.ru> wrote: > >> Is there any available tool with this for pre-evaluating the resulting sshd_config for fatal errors? I'm not demanding: I'm thinking "that could be really, really useful". > >

Hi guys, Given that internal-sftp is the only way to support chrooted users, is there any particular reason why sftp-server is still the default SFTP subsystem? --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

In the configure script, when it checks to see if _res is an extern, there are two problems: 1. There is no ac_WHATEVER variable to control it and override it. 2. Because the extern reference to _res is unused, the linker on some systems may elide it, causing an erroneous definition of HAS__RES_EXTERN The test should be coded as follows: /* ... confdefs.h */ #include <stdio.h> #if

>> However - as I got into that - I realized that I have no way to "find" >> just the keys for a single user. Since the only argument to that ssh >> keys command, is the username. It's not HTTP so I couldn't point at a >> subdomain and use that to look up the information. >You may be interested in the bug report "extend the parameters to the

Hi there, (context: I was optimizing Roundcube mailbox list server response, and in that 300-400ms response time, around 170ms is spent on single fgets() call which is waiting IMAP repsonse to "SELECT MyMailbox" command) I straced dovecot and of the whole request/response process, around 30ms is spent for everything else, and overwhelming majority of time (150-170ms) is spent for

On Sun, Aug 30, 2015 at 6:57 AM, Bostjan Skufca <bostjan at a2o.si> wrote: > Nico, > > those were my thoughts, exacly, except that I was thinking about using "dig > +short HOST | ..." which has the cleanest output of all. Excellent point. I like it! It can get a bit confusing with round-robin DNS, which can give multiple responses. > But there is that initial

If I want to specify for LAN addresses that I don't want to deal with host keys, how do I do that? Understanding the risks, knowing almost everyone will say not to do this - it's a horrible idea, but deciding I want to do it anyway. Tired of having to remove entries from known_hosts with the multiple VM's I have that often change fingerprints, and am willing to live with the risks.