Slashdot Mirror

← Back to Stories (view on slashdot.org)

Bug Exposes OpenSSH Servers To Brute-Force Password Guessing Attacks

Posted by samzenpus on from the protect-ya-neck dept.

itwbennett writes: OpenSSH servers with keyboard-interactive authentication enabled, which is the default setting on many systems, including FreeBSD ones, can be tricked to allow many authentication retries over a single connection, according to a security researcher who uses the online alias Kingcope, who disclosed the issue on his blog last week. According to a discussion on Reddit, setting PasswordAuthentication to 'no' in the OpenSSH configuration and using public-key authentication does not prevent this attack, because keyboard-interactive authentication is a different subsystem that also relies on passwords.

1 of 157 comments (clear)

  1. actually had this on my list today by epine · · Score: 4, Interesting

    The unofficial official FreeBSD security posture: two layers, where the outer layer has a singular purpose in life.

    Protecting sshd using spiped

    Like many system administrators, I used to restrict access to port tcp/22 on most of my servers based on source IP address; this provided some protection from "zero-day" exploits against OpenSSH, as well as eliminating the annoying "log spam" caused by brute force attacks. This worked fine as long as I always connected from the same location, but heading off to conferences meant that I needed to either tunnel SSH connections over other SSH connections or make temporary changes to my firewall rules.