Re: telnetd vulnerability from BUGTRAQ

2004-09-26 Thread s. keeling
Incoming from Rick Moen: > Quoting Milan Jurik ([EMAIL PROTECTED]): > > > The question isn't if stop using telnet. The question is why Debian's > > telnetd is still vunerable. > > I'd apologise for the off-topic digression -- if I thought I'd given > offence. ;-> No-one should have to apologise

Re: Debian Hardened project status.

2004-09-26 Thread Michael Stone
On Sun, Sep 26, 2004 at 11:45:23AM -0400, Stephen Frost wrote: That's unfortunate. Do you know of any workarounds? Haven't looked into it lately. We're seriously considering using RSA secureid with ssh (and quite possibly other things via pam...). Has RSA acknowledged this or said anything abou

Re: telnetd vulnerability from BUGTRAQ

2004-09-26 Thread Rick Moen
Quoting Milan Jurik ([EMAIL PROTECTED]): > The question isn't if stop using telnet. The question is why Debian's > telnetd is still vunerable. I'd apologise for the off-topic digression -- if I thought I'd given offence. ;-> -- Cheers,"A raccoon tangled with a 23,000 volt line, today.

Re: Debian Hardened project status.

2004-09-26 Thread Stephen Frost
* Michael Stone ([EMAIL PROTECTED]) wrote: > This is something that should be handled at the pam level and shouldn't > require special handling from ssh. (Assuming a good ssh pam > implementation.) The last time I looked at the securid pam module from > rsa it didn't work with our ssh, but that's b

Re: telnetd vulnerability from BUGTRAQ

2004-09-26 Thread Stephen Frost
* Jose Luis Domingo Lopez ([EMAIL PROTECTED]) wrote: > On Saturday, 25 September 2004, at 10:34:43 -0500, > hanasaki wrote: > > When IPSEC is being used, telnet works the same; however is secure > > because it, like all traffic, is sent over a transparent tunnel. > > > But an IPsec tunnel encrypt

Re: Debian Hardened project status.

2004-09-26 Thread Lorenzo Hernandez Garcia-Hierro
Hi Russell, El dom, 26-09-2004 a las 14:02, Russell Coker escribió: > On Sun, 26 Sep 2004 07:22, Lorenzo Hernandez Garcia-Hierro <[EMAIL PROTECTED]> > wrote: > > - openssh (i'm working on the patches that bring SecurID Token use > > features, and others from independent hackers) > > Most of the

Re: Debian Hardened project status.

2004-09-26 Thread Michael Stone
On Sun, Sep 26, 2004 at 10:02:03PM +1000, Russell Coker wrote: On Sun, 26 Sep 2004 07:22, Lorenzo Hernandez Garcia-Hierro <[EMAIL PROTECTED]> wrote: - openssh (i'm working on the patches that bring SecurID Token use features, and others from independent hackers) Most of the features you list are t

Re: telnetd vulnerability from BUGTRAQ

2004-09-26 Thread Lee Sheridan
On Sat, Sep 25, 2004 at 12:13:26PM +0200, Jan Minar wrote: > On Fri, Sep 24, 2004 at 04:15:09PM -0600, s. keeling wrote: > > Is anyone still using telnet when there's ssh? Why? I wouldn't even > > use it inside my own firewalled LAN. ssh is just better. > > I've been told telnet *does* make a

Re: Debian Hardened project status.

2004-09-26 Thread Russell Coker
On Sun, 26 Sep 2004 07:22, Lorenzo Hernandez Garcia-Hierro <[EMAIL PROTECTED]> wrote: > - openssh (i'm working on the patches that bring SecurID Token use > features, and others from independent hackers) Most of the features you list are things that are difficult to get into Debian/main. But to

Re: telnetd vulnerability from BUGTRAQ

2004-09-26 Thread Jose Luis Domingo Lopez
On Saturday, 25 September 2004, at 10:34:43 -0500, hanasaki wrote: > When IPSEC is being used, telnet works the same; however is secure > because it, like all traffic, is sent over a transparent tunnel. > But an IPsec tunnel encrypts traffic just between the tunnel endpoints. But this need not t

Re: telnetd vulnerability from BUGTRAQ

2004-09-26 Thread Jose Luis Domingo Lopez
On Friday, 24 September 2004, at 16:15:09 -0600, s. keeling wrote: > Is anyone still using telnet when there's ssh? Why? I wouldn't even > use it inside my own firewalled LAN. ssh is just better. > Yes, many people have a curious sense of "computer security". They ask for mega-cool (and MEGA e