Announcement

Collapse
No announcement yet.

Putty security holes

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Putty security holes

    When I want to get into my Linux computer from Windows machines at school I use a program called Putty. You all have probably heard of it. Anyway Putty has two MAJOR security issues. The first is that the default protocol for connecting to computers is telnet, which you all know is not secure! Second, if you choose SSH protocol, it defaults to SSHv1, which you all probably know is not secure too. I have not tried to snoop SSHv1 session yet but I hear there are tools out there that make it real easy. Doesn't this seem like a horrible security problem to anyone else?

  • #2
    Originally posted by kidlinux
    When I want to get into my Linux computer from Windows machines at school I use a program called Putty. You all have probably heard of it. Anyway Putty has two MAJOR security issues. The first is that the default protocol for connecting to computers is telnet, which you all know is not secure! Second, if you choose SSH protocol, it defaults to SSHv1, which you all probably know is not secure too. I have not tried to snoop SSHv1 session yet but I hear there are tools out there that make it real easy. Doesn't this seem like a horrible security problem to anyone else?
    Defaulting to telnet is an annoyance but is readily visible, so I wouldn't really consider it a "security hole". However, you are right about PuTTY defaulting to SSHv1. You can save over the "Default settings" entry and configure it to use SSHv2 (and not allow SSHv1 fallback) as well as change the block cipher from 3DES to AES or Blowfish.
    45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B0
    45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B1
    [ redacted ]

    Comment


    • #3
      You can also take this a step further by telling your server (the one running sshd) to not even speak SSH1 and to reject those that do.

      I return whatever i wish . Its called FREEDOWM OF RANDOMNESS IN A HECK . CLUSTERED DEFEATED CORn FORUM . Welcome to me

      Comment


      • #4
        Originally posted by noid
        You can also take this a step further by telling your server (the one running sshd) to not even speak SSH1 and to reject those that do.

        Once again noid speaks the most wisely...
        It is easy as hell to do.

        Edit the sshd_config and uncomment the Protocols line. Then delete anything other than the number 2.


        Then HUP the sshd and you're in bidnesses.

        See attached screenshot.

        This ends my uncharacteristic spoonfeeding session for today.
        Attached Files
        Last edited by Chris; December 4, 2003, 13:29.
        perl -e 'print pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'

        Comment


        • #5
          Originally posted by noid
          You can also take this a step further by telling your server (the one running sshd) to not even speak SSH1 and to reject those that do.
          Wow thanks that is a great idea. I will edit my config to only allow SSH2 on my server, then I don't even have to fix Putty!

          Comment


          • #6
            Originally posted by kidlinux
            Wow thanks that is a great idea. I will edit my config to only allow SSH2 on my server, then I don't even have to fix Putty!
            The real annoyance with putty defaulting to telnet instead of SSH is if you happen to be trying to access a remote box running an IDS that's set to block any IP address connecting to a port not running a listening service (like telnet) - you automatically DoS the box you're coming from from being able to log in until the block is cleared. I've done this to myself at home more times than I want to think about.

            Comment


            • #7
              Originally posted by kidlinux
              Wow thanks that is a great idea. I will edit my config to only allow SSH2 on my server, then I don't even have to fix Putty!
              You should probably fix both, at least if you intend to ssh anywhere other than your home system.
              45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B0
              45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B1
              [ redacted ]

              Comment

              Working...
              X