On Wed, 21 Jul 2004, Tig wrote: > Hello. I'm not 100% sure if this is a configuration error on my side or > a 'bad idea' on sshd/FreeBSD sides. > > A remote root ssh connection to a FreeBSD 4.10 server (with no remote > root access) will allow you to 'work out' the root password. However, if > you try the same against 5.2.1 FreeBSD, you have little chance. The > following are pretty clear examples. > > If this is a config mistake on my side, please let me know as I have > clearly done something wrong. > > Correct root password - 4.10 > tigger@piglet:~% ssh [email protected] > Password: > Connection to 4.10-FreeBSD closed by remote host. > Connection to 4.10-FreeBSD closed. > tigger@piglet:~% > > Incorrect root password - 4.10 > tigger@piglet:~% ssh [email protected] > Password: > Password: > Password: > [email protected]'s password: > Permission denied, please try again. > [email protected]'s password: > Permission denied, please try again. > [email protected]'s password: > Permission denied (publickey,password,keyboard-interactive). > tigger@piglet:~% > > Correct root password - 5.2.1 > tigger@piglet:~% ssh [email protected] > Password: > Password: > Password: > [email protected]'s password: > Permission denied, please try again. > [email protected]'s password: > Permission denied, please try again. > [email protected]'s password: > Permission denied (publickey,password,keyboard-interactive). I roughly remember to have read about that problem for older versions of OpenSSH. But on my 4.10 boxes, there's no problem. Looks always like this, correct and incorrect password given: % ssh root@box root@boxes's password: Permission denied, please try again. root@boxes's password: Permission denied, please try again. Version: % ssh -V OpenSSH_3.5p1 FreeBSD-20030924, SSH protocols 1.5/2.0, OpenSSL 0x0090704f Best regards Konrad Heuer ([email protected]) ____ ___ _______ GWDG / __/______ ___ / _ )/ __/ _ \ Am Fassberg / _// __/ -_) -_) _ |\ \/ // / 37077 Goettingen /_/ /_/ \__/\__/____/___/____/ Germany _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"