Re: OpenSSH security hole on FreeBSD?

[Kris Kennaway]

On Tue, Feb 11, 2003 at 07:44:57PM -0800, BSD baby wrote:

 TWO major security holes:
 
 #1 - It won't let me turn off passwords 
  (PasswordAuthentication no)

Don't know about this one.

 #2 - It only requires I type the first 8 characters
  of my password!  (I use 16-character password.)

That's because you're using DES passwords, which only allow 8
characters.  See login.conf(5).

Kris



msg18970/pgp0.pgp
Description: PGP signature

Re: OpenSSH security hole on FreeBSD?

[Bsd Neophyte]

--- BSD baby [EMAIL PROTECTED] wrote:
 #2 - It only requires I type the first 8 characters
  of my password!  (I use 16-character password.)

check out this URL:
http://sddi.net/FBSDSecCheckList.html

it guides you how to change the password type to blowfish that allows for
more than 8 character passwords.

also remember (i don't recall where i heard this) but longer passwords
aren't neceassarily more secure.



__
Do you Yahoo!?
Yahoo! Shopping - Send Flowers for Valentine's Day
http://shopping.yahoo.com

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message

Re: OpenSSH security hole on FreeBSD?

[Willie Viljoen]

On Wednesday 12 February 2003 5:44, BSD baby wrote:
 I install OpenSSH like this:

 cd /usr/ports/security/openssh-portable
 make -DOPENSSH_OVERWRITE_BASE install

 That puts things here:
 /usr/bin/ssh
 /usr/sbin/sshd
 /etc/ssh/sshd_config

 BUT... it seems to be IGNORING the sshd_config!

 TWO major security holes:

 #1 - It won't let me turn off passwords
  (PasswordAuthentication no)

 #2 - It only requires I type the first 8 characters
  of my password!  (I use 16-character password.)


 I don't have these problems on OpenBSD.
 Any idea why they would be on FreeBSD?

They shouldn't. Why are you using the ported version though? The version 
included in base is in many cases more secure than the version from ports, 
and it's been checked and poked with a stick by FreeBSD coders to make sure 
every thing is compatible, not to mention that it's properly PAMified 
(which the ports one doesn't seem to be)

If you must have the latest version, rather get it from base and while 
you're at it, upgrade the rest of base too. Install the sources in /usr/src 
and use cvsup (in ports) to get the latest source, then follow instructions 
in /usr/src/UPDATING to upgrade your system.

Will



 To Unsubscribe: send mail to [EMAIL PROTECTED]
 with unsubscribe freebsd-questions in the body of the message

-- 
Willie Viljoen
Freelance IT Consultant

214 Paul Kruger Avenue, Universitas
Bloemfontein
9321
South Africa

+27 51 522 15 60
+27 51 522 44 36 (after hours)
+27 82 404 03 27 (mobile)

[EMAIL PROTECTED]

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message