TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The OpenSSH Bug That Wasn't

129 点作者 glass-将近 10 年前

10 条评论

geerlingguy将近 10 年前
Key takeaway:<p>&gt; And as several correspondents have reminded me already -- switching your sshd to keys only authentication will let you sleep better at night.<p>Even with fail2ban and limited retries, there&#x27;s no excuse for using password-based authentication anymore. Use an SSH key, protect the key with a password, and turn off password login on all your servers.<p>Other than that, the main gist of this post is: on most platforms, the default settings for remote login already make brute-force login attempts annoying at best, and with fail2ban or something similar, it&#x27;s a non-issue.
评论 #9943102 未加载
评论 #9943064 未加载
评论 #9943493 未加载
评论 #9944661 未加载
评论 #9943081 未加载
akkartik将近 10 年前
Oh, good old PAM: <a href="http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20131205090841&#x2F;http:&#x2F;&#x2F;deadmemes.net&#x2F;2010&#x2F;10&#x2F;19&#x2F;fear-and-loathing-in-debianubuntu-or-who-needs-etcmotd" rel="nofollow">http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20131205090841&#x2F;http:&#x2F;&#x2F;deadmemes.n...</a> (Discussed previously: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=3325510" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=3325510</a>)
评论 #9943498 未加载
cbsmith将近 10 年前
This really is a bug in <i>how</i> OpenSSH USE_PAM is implemented.<p>Particularly if you presume that PAM is the devil, the last thing you want to do, from a security standpoint, is to let a client dictate how a server applies PAM. The policy _has_ to be entirely controlled by the server&#x27;s config. Once you let the client decide, you&#x27;re just asking for things to go wrong.
评论 #9945499 未加载
feld将近 10 年前
Thankfully my use of PAM is for 2FA with SSH when I don&#x27;t have my key. So they wouldn&#x27;t have been successful in pulling off a bruteforce anyway. But it&#x27;s annoying that their attempts weren&#x27;t being limited as it can waste resources...
评论 #9946075 未加载
hyperion2010将近 10 年前
I have disabled PAM by default on all my boxes that run sshd for the last 9 years out of habit, I long ago forgot the reason why (probably because the gentoo sshd handbook entry said it was a good idea). Why UsePAM is set to yes in sshd_config by default on many distros is beyond me.
评论 #9943365 未加载
评论 #9943327 未加载
liveoneggs将近 10 年前
NetBSD is integrating a system called blacklistd to address fail2ban being less than elegant.<p><a href="http:&#x2F;&#x2F;netbsd.gw.com&#x2F;cgi-bin&#x2F;man-cgi?blacklistd++NetBSD-current" rel="nofollow">http:&#x2F;&#x2F;netbsd.gw.com&#x2F;cgi-bin&#x2F;man-cgi?blacklistd++NetBSD-curr...</a>
评论 #9944461 未加载
j_m_b将近 10 年前
I am curious as to what happens when this is done with an existent user? I feel like there would be different behaviors for timeouts when a non-existent username is used and when a wrong password is used for an existent username.
评论 #9943050 未加载
baby将近 10 年前
They talk about FreeBSD in the original article and the guy tests that on other OS and say it&#x27;s not a serious vuln?<p>This is a serious vuln for FreeBSD. Period.
评论 #9943938 未加载
pellaeon将近 10 年前
FreeBSD hasn&#x27;t released a patch, so I patched it myself.<p><a href="https:&#x2F;&#x2F;nyllep.wordpress.com&#x2F;2015&#x2F;07&#x2F;25&#x2F;emergency-fix-for-cve-2015-5600-on-freebsd&#x2F;" rel="nofollow">https:&#x2F;&#x2F;nyllep.wordpress.com&#x2F;2015&#x2F;07&#x2F;25&#x2F;emergency-fix-for-cv...</a>
gosukiwi将近 10 年前
Lol&#x27;d at the blog&#x27;s title