Hello Folks, I tested only versions OpenSSH_3.5p1 (FreeBSD-STABLE), but it also work on other versions, as published May 01, 2003. Ok, let's talk about it. First, the /etc/ssh/sshd_config file: <cut> PermitRootLogin no <cut> As you can see above, is not allowed to root login on that system. Fine. Now, trying login as root to the system, and type the wrong password: felipe@worm felipe $ ssh -l root host Password: Password: Password: root@host's password: Permission denied, please try again. root@host's password: Permission denied, please try again. root@host's password: Permission denied (publickey,password,keyboard-interactive). And now, trying login as root to the system, but typing the correct password: felipe@worm felipe $ ssh -l root host Password: Connection to host closed by remote host. Connection to host closed. It's easy to make one little program to discover with bruteforce the correct password of the root login. If the attacker have physical access to the system, it's very easy own the system. But... why still FreeBSD-STABLE are running this version of OpenSSH? -- Felipe Neuwald felipe.neuwald@xxxxxxxxxxxxx +55 61 3038-5038 +55 61 9557-6870 ------ Chave pública PGP / PGP public key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE508F3
Attachment:
signature.asc
Description: Esta =?iso-8859-1?q?=E9?= uma parte de mensagem assinada digitalmente