OpenSSH user enumeration

I don't know, judging by my SSH logs it seems a lot of the automated malicious login attempts are looking for common software used to deploy code. Knowing that a target machine has a username used by some popular software might be valuable information in an attack.

But on the subject of passwords, best practice for SSH for a long time has been to disable password based login entirely and rely on keys.

Re: OpenSSH user enumeration

#5

Post by mackal » Sun, Aug 19, 2018, 4:27 AM UTC

jarfil wrote: post #2

Usernames are not a secret, passwords are a secret.

They are useful though. If you check a bunch of usernames from a person leak and find matches, you got a password to try.

Re: OpenSSH user enumeration

#6

Post by ddtaylor » Sun, Aug 19, 2018, 4:52 AM UTC

jarfil wrote: post #2

Usernames are not a secret, passwords are a secret.

Are you willing to send me a list of all your usernames on all your systems?

Re: OpenSSH user enumeration

#7

Post by mirimir » Sun, Aug 19, 2018, 4:57 AM UTC

jarfil wrote: post #2

Usernames are not a secret, passwords are a secret.

Does anyone still use password authentication on servers that actually matter? I mean, I'm just a hobbyist, and I switched to keys several years ago. Basically, I just use root and user, because anything else unnecessarily adds information.

Re: OpenSSH user enumeration

#8

Post by mirimir » Sun, Aug 19, 2018, 4:58 AM UTC

ddtaylor wrote: post #6

jarfil wrote: post #2

Usernames are not a secret, passwords are a secret.

Are you willing to send me a list of all your usernames on all your systems?

Sure. It's root and user, on everything :)

Re: OpenSSH user enumeration

#9

Post by est » Sun, Aug 19, 2018, 5:37 AM UTC

jarfil wrote: post #2

Usernames are not a secret, passwords are a secret.

yeah but what if some user names are known to have a weak secret?

Re: OpenSSH user enumeration

#10

Post by tptacek » Sun, Aug 19, 2018, 5:41 AM UTC

If you're a startup and this matters to you, you're doing it very wrong.