109 posts tagged openssh
SubscribeI clean up the OpenSSH mess on my Debian Etch box
http://lxer.com/ module/ newswire/ ext_link.php?rid=103054-
ssh-vulkey : How to test weak SSH keys on your server
http://blog.mypapit.net/ 2008/ 05/ using-ssh-vulkey.htmlThis might be stale news by most security alert people, but I felt compelled to write this post nevertheless. Byy this time most security alert people have realised that a serious security vulnerability has been discovered in the random number generator used by OpenSSL on Debian and Ubuntu systems, and there are a lot of sites have published information about it.
-
[Linux] Setting Up a Debian VNC Server
http://news.metaparadigma.de/ ?p=237I. Abstract No doubt, configuring a web server won’t work without being in the know of basics about the terminal, vim or nano. Anyway many tasks can also performed by administrating a server using a GUI. The problem is: only Windows 2003 or Windows 2008 come with a preinstalled remote desktop connection - and they are really much more expensive than Linux solutions.
-
The viability of remote SSH key cracking
http://taint.org/ 2008/ 05/ 16/ 165301a.htmlThe viability of remote SSH key cracking May 16, 2008 at 4:53 pm Here’s some pretty scary figures from Craig Hughes on the viability of an SSH worm: when doing this, connecting to localhost: find rsa -type f !
-
That’s why I love Debian
http://wolfgang.lonien.de/ ?p=647From loldebian, by Amaya: So refreshing. People who still can laugh about themselves…
-
Mitigating SSH Vulnerabilities UsingSingle Packet Authorization
http://www.securethoughts.net/ 2008/ 05/ mitigating-ssh-vulnerabilities-using-si…This past week has seen a bit of activity on the SSH security front. To begin with, on Tuesday (13/05/08) Linux distributions Debian and Ubuntu announced that due to a flaw in the random number generator used to generate cryptographic keys used by OpenSSL, OpenSSH and OpenVPN, making these keys far more predictable than they should be, and can be discovered by performing a brute force attack.
-
Predictable random number generater in Debain’s OpenSSL package
http://blog.sw-designs.co.uk/ index.php/ 2008/ 05/ 15/ predictable-random-number…Since the Debian security advisory was published there has been plenty of discussion about who is to blame and how such a bug has gone unnoticed since September 2006. While they are important discussions that need to be had, I’ll focus on how to protect your Debian based PCs, laptops, servers, etc.
-
The SSH/SSL vulnerability: what you should know
http://mindboosternoori.blogspot.com/ 2008/ 05/ sshssl-vulnerability-what-you-sh…I wasn't going to post about this, but it seems that, for my own sanity, I must. As you might know by now, a Debian Security Advisory came out, talking about a problem that affected the OpenSSL package, not only for Debian but for its derivatives too, like Ubuntu.
-
[Linux] Severe SSH security issues in Debian
http://news.metaparadigma.de/ ?p=227I. Abstract It has been found by Luciano Bello that the Debian OpenSSL package has a severe security bug since 2006. By removing some lines of code from the md_rand.c source code that originally caused the memory check tool Valgrind to alert (see original Debian discussion here) the box of pandorra has been opened and the flaw been introduced.
-
Brute Force SSH Attacks On The Rise
http://www.douglasward.net/ ?p=678Brute force SSH attacks have seen a marked increase over the last week. It’s a good idea to run a daemon on your servers that blocks this kind of attack. I recommend BlockHosts. “From the most recent reports I have seen, the attackers have been using either ‘low and slow’ style attacks to avoid
-
Critical SSH Vulnerability
http://www.douglasward.net/ ?p=676The random number generator that Debian and Ubuntu use to generate ssh keys has a published vulnerability. Debian and Ubuntu Linux users should look into their OpenSSH setup. It turns out the PRNG (Pseudo Random Number Generator) as used was predictable.