Hello Folks,

I tested only versions OpenSSH_3.5p1 (FreeBSD-STABLE), but it also work
on other versions, as published May 01, 2003.
Ok, let's talk about it. First, the /etc/ssh/sshd_config file:
<cut>
PermitRootLogin no
<cut>
As you can see above, is not allowed to root login on that system. Fine.
Now, trying login as root to the system, and type the wrong password:

felipe@worm felipe $ ssh -l root host
Password:
Password:
Password:
root@host's password:
Permission denied, please try again.
root@host's password:
Permission denied, please try again.
root@host's password:
Permission denied (publickey,password,keyboard-interactive).

And now, trying login as root to the system, but typing the correct
password:

felipe@worm felipe $ ssh -l root host
Password:
Connection to host closed by remote host.
Connection to host closed.

It's easy to make one little program to discover with bruteforce the
correct password of the root login. If the attacker have physical access
to the system, it's very easy own the system.
But... why still FreeBSD-STABLE are running this version of OpenSSH?

--
Felipe Neuwald
felipe.neuwald (at) loreno.com (dot) br [email concealed]
+55 61 3038-5038
+55 61 9557-6870
------
Chave pública PGP / PGP public key:
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE508F3

[ reply ]