SSH Brute Force – The 10 Year Old Attack That Still Persists

Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by Hello71 on Monday July 15, 2013 @02:36PM (#6047632)

With "password" authentication method, the password is not transmitted to the remote server. (AFAIK)

However, all modern sshds (AFAIK, at least OpenSSH) default to (publickey, keyboard-interactive). As the name says, keyboard-interactive sends your keystrokes, one at a time (bar buffering) to the remote server.

This is required, for example, when using PAM, as PAM requires the actual authentication key.

[ Parent | on HN ]

Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by andrewcooke on Monday July 15, 2013 @03:00PM (#6047793)

about password auth - you're wrong (AFAIK). i even gave a reference in my original post. didn't you bother to check it?

[ Parent | on HN ]

Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by Hello71 on Monday July 15, 2013 @03:51PM (#6048135)

I am wrong. No.

[ Parent | on HN ]