Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: !SPAM! [Full-Disclosure] Automated ssh scanning
From: Tremaine (tremainegmail.com)
Date: Thu Aug 26 2004 - 14:01:45 CDT
On Thu, 26 Aug 2004 12:26:04 -0500 (CDT), Ron DuFresne
> On Thu, 26 Aug 2004, Stephen Agar wrote:
> > I think many of you are missing the point. Yes the guest/guest account is
> > weak, but this kernel is (according to debian) patched..therefore free from
> > local exploits that can be used to gain superuser access. I mean if this
> > were the case, then any box that ran this version of debian to do something
> > like "web hosting" that gave users shell access, may as well give them all
> > full sudo. Because you people are assuming that if someone can gain access
> > to the box, secured or not, they can gain root..i disagree.
> The issue here is why does debain include such a weak account,m thaqt has
> not been tamed via a very restricted chroot env!?
That's not the issue though. As someone who has installed and
maintained debian systems over a period of years, I can assure you
that debian does not include a guest account (or any account) with a
weak password or shell.
There aren't any shell accounts other than root on a debian install
until added by the administrator.
The weak account in question here was created by the original poster
with the intent of catching one of these apparently automated ssh
> As Barry pointed to directly, it all depends upon what you make available
> to your clients once in a shell. It;s very likely your server would be as
> exploitable as most 'default' installs with the kitchen sink dropped in.
> Perhaps not, but likely, depending upon what you 'installed and allow
> clients access to'.
> Ron DuFresne
As for the defaults on the original posters install... that would of
course depend entirely on what install method he chose. Like many
current distros (Mandrake, Redhat etc) Debian offers a packaged
install of a couple varieties (desktop, server, workstation etc) for
an admin to pick from, or they can choose to run dselect (package
management interface) and choose by hand what they do and do not want.
This of course again comes back to not knowing what the initial poster
did with the system beyond running dselect -> update -> install which
would have autohandled updates and dependency resolution for installed
IT Security Consultant
Full-Disclosure - We believe in it.