rip putty
Looking Forward: Support for Secure Shell
271–280 of 404 posts
Re: Looking Forward: Support for Secure Shell
#272Re: Looking Forward: Support for Secure Shell
#273Earlier quoted context omitted.
No it makes it harder and more of a pain. Trust me I have a friend who loves breaking into my personal server. That one trick two ssh running on different ports screwed with him for a long, long time. He is a genius of a hacker and has been doing it for a living for years. When he finally got in he was so pissed that threw him.
You are describing an anecdotal instance of a person whose capabilities are not established being thrown by something that nmap will catch on a normal scan. Color me skeptical. I shall decline to "trust you."
Scanning the internet isn't that slow
Re: Looking Forward: Support for Secure Shell
#274What's next? Powershell for Linux? Powershell for Mac? (Pretty please?) Powershell's piping of .NET objects is so brilliant compared to Bash piping and parsing of text.
Why not just use one of the many other languages available.
You could use ipython if you wanted object handling. Now i wonder what would have happened if they didn't have gates or ballmer upstairs and they wanted to implement a new shell.
Re: Looking Forward: Support for Secure Shell
#275Earlier quoted context omitted.
MS has supported event forwarding since 2003. You can set machines to forward events or have them pulled. The events are XML that conform to a published schema. There is a WMI call that call pull the aggregated events off the collection servers. I heard this kind of thing from a vendor the other day. It's like people don't even try to learn how it works. Why are they different? The event log has some transactional gu…
From what I know, you can use Microsoft RPC to pull event logs or you can install a syslog forwarder, or you can do a combination of these two things (have a Windows syslog forwarder that is not a DC that can pull logs from a DC through RPC). The problem with the last option is, adding another Windows server costs an additional license. Installing a client on the DC doesn't. And there are limitations, so in a huge Wi…
Secureworks was the vendor I was referring to...
Any place large enough to need a SIEM wouldn't balk at licensing a server or servers if it was explained to them that you wouldn't need yet another highly privileged agent running on a domain controller.
Its not just RPC. That's the thing I've noticed about a lot of security people... they don't even really pretend to take windows seriously despite its insanely large footprint and exposure at an organization. For what its worth... most IT people are just as bad. I'm trying to turn that around at my organization. I don't blame people...I get it. It just takes time to disseminate info.
Its called event collector. Spread the word.
https://msdn.microsoft.com/en-us/library/windows/desktop/bb4...
Re: Looking Forward: Support for Secure Shell
#276I happily await the day when I no longer need to install PuTTY on all of my fresh Windows installs.
In a recent HN thread, someone pointed me to MobaXterm ( http://mobaxterm.mobatek.net/ ) and I have gladly deleted PuTTY.
Awesome.
I've been stressing over finding a Windows SSH client that supports ed25519 and even thought SecureCRT recently just announced support for ECDSA, they do not have a timeframe for ed25519.
Off to try out how well this works.
Re: Looking Forward: Support for Secure Shell
#277Earlier quoted context omitted.
MS has supported event forwarding since 2003. You can set machines to forward events or have them pulled. The events are XML that conform to a published schema. There is a WMI call that call pull the aggregated events off the collection servers. I heard this kind of thing from a vendor the other day. It's like people don't even try to learn how it works. Why are they different? The event log has some transactional gu…
It's like people don't even try to learn how it works It's much harder to know how it works, for some reason. Information like this doesn't make its way into the community and circulate. On a UNIX system you can poke around /etc and get an idea of the scope of what is configurable. The same is very much not true of the registry and only slightly true of WMI.
You are right. The guy that wrote PowerShell says that UNIX is document oriented configuration while windows is API oriented configuration.
To get into it in any depth you have to approach windows programmatically. The most power is through C\C++...to be a good windows admin you need to read the docs about how you interact with different subsystems, even if you aren't going to code against them.
Re: Looking Forward: Support for Secure Shell
#278Earlier quoted context omitted.
SSH clients are also typically terminal emulators, though. The idea here would be to have an ssh client which acts as a better terminal than cmd.exe does. The effect of this isn't about whether you get access to a better shell, but instead about whether you have a better terminal with which to talk to that shell.
FYI: http://www.hanselman.com/blog/Console2ABetterWindowsCommandP... Will happily run a cmd window, or other command you supply (e.g. I run a cygwin zsh)
I recommend checking out ConsoleZ which is a fork that looks very promising and has a github repo that has more traffic than the sourceforge console2 project.
Re: Looking Forward: Support for Secure Shell
#279Earlier quoted context omitted.
Come back to us when you've found a way to implement the good stuff that Windows has, such as IOCPs: https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... And no, epoll isn't enough.
If I remember correctly, the node.js team needed a lot of help from experienced Windows developers (even from Microsoft itself??) to add IOCP support to libuv. I think kqueue is the best (well I guess I'm a BSD fan :D) but in general: app developers generally don't care about this, they just use libuv or libevent or something like that. Does Windows really have "good stuff" for developers? .NET is excellent, but the…
That doesn't make IOCP worse than epoll, it's just not the same as epoll. Look at PyParallel:
https://speakerdeck.com/trent/pyparallel-how-we-removed-the-...