From: Andrew Haninger (ahaninggmail.com)
Date: Thu Sep 09 2004 - 10:56:19 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> So the solution to not run a backup telnet server for updating SSH is to
> run a second, known insecure version of sshd on a different port,
> presuming of course, that you are allowed to run said sshd on said high
> port in the first place.
Sorry, that was stupid of me. First build the new sshd and start it on
a high port. If you're supposed to have enough access to update sshd,
you should have access enough to run something on a high port.

> Which results in something that sounds a bit like security by obscurity,
> which is bad.
True. Much worse than logging in over telnet would be to run a
temporary sshd on a high port. Wait...

> You end up presuming that potential attacker cannot do his
> thing because you are using ssh on an oddball port.
I did not suggest running it there for a long time but rather just
enough time to allow you to update your system. You're presuming that
your attacker is presuming that you're smart and not using clear-text
protocols to administer your server.

> Oh, and not everyone is root for all parts of the network they may be
> administrating.
True. That's why you're the admin and why you're updating sshd. You have root.

-Andy

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]