21–30 of 89 posts
If you're a startup and this matters to you, you're doing it very wrong.
Sorry, can you explain what you mean by this? I didn’t follow.
ChallengeResponseAuthentication no # \
PasswordAuthentication no # | nukes "Password: "
UsePAM no # /
PermitRootLogin no # (duh)
PubkeyAuthentication yes # enables public keys; very important
AllowUsers user1 user2 # maybe? combine with an obscure username...Earlier quoted context omitted.
there is an "ubuntu" user on most of my systems. I hope you find this information useful.
I know you're being facetious but, yes, I would find that information useful. Now I've just IDed the distribution I'm targeting.
Earlier quoted context omitted.
I think he’s saying: a) Why are you using bleeding edge software in production, and especially so unreleased versions of OpenSSH? b) Why are your SSH servers exposed to public traffic? c) User enumeration is useful for finding accounts with weak passwords. Why do you have personal accounts on prod servers? Why do you have _any_ accounts not using public key authentication at all?
FWIW, regarding a), > We believe that this issue warrants a CVE; it affects all operating systems, all OpenSSH versions (we went back as far as OpenSSH 2.3.0, released in November 2000), and is easier to exploit than previous OpenSSH username enumerations... As for b) and c), I 100% agree. In fact: if you're using KVM-based virtualization, and you have VNC or serial access to your node (GCP gives you serial access, v…
Earlier quoted context omitted.
FWIW, regarding a), > We believe that this issue warrants a CVE; it affects all operating systems, all OpenSSH versions (we went back as far as OpenSSH 2.3.0, released in November 2000), and is easier to exploit than previous OpenSSH username enumerations... As for b) and c), I 100% agree. In fact: if you're using KVM-based virtualization, and you have VNC or serial access to your node (GCP gives you serial access, v…
Ah, my bad. I got the impression that it was introduced in the commit on the 31st of July.
Earlier quoted context omitted.
Sorry, can you explain what you mean by this? I didn’t follow.
I think he’s saying: a) Why are you using bleeding edge software in production, and especially so unreleased versions of OpenSSH? b) Why are your SSH servers exposed to public traffic? c) User enumeration is useful for finding accounts with weak passwords. Why do you have personal accounts on prod servers? Why do you have _any_ accounts not using public key authentication at all?
c) Not only production servers utilize internet.
Earlier quoted context omitted.
I know you're being facetious but, yes, I would find that information useful. Now I've just IDed the distribution I'm targeting.
A disappointing number of servers happily give away this information in their http response headers. For those that don't, `nmap -O` will sometimes do the trick.
Usernames are not a secret, passwords are a secret.
Are you willing to send me a list of all your usernames on all your systems?
- root
- user
- ansible_conf_daemon_user
End of List. It's all containers so IDGAF and I use pubkey authentication on each user.
Earlier quoted context omitted.
They are useful though. If you check a bunch of usernames from a person leak and find matches, you got a password to try.
A correct sshd_config includes: PasswordAuthentication no