Re: openssh remote upgrade procedure?

Alright, the workaround was to create a new keypair and have local stuff install the public key as ~/.ssh/authorized_hosts I now have access to the machine but haven't had the time to do serious troubleshooting (and honestly, I don't want to push it too much for fear of being locked out again).

Re: openssh remote upgrade procedure?

On Fri, May 23, 2008 at 12:28 AM, Karl Goetz [EMAIL PROTECTED] wrote: On Thu, 2008-05-22 at 07:49 +0100, Alexandros Papadopoulos wrote: Hi all, thanks for the suggestions so far. I talked local staff through backing up the sshd configuration file, purging the openssh-server package

Re: openssh remote upgrade procedure?

Hi all, thanks for the suggestions so far. I talked local staff through backing up the sshd configuration file, purging the openssh-server package and then reinstalling openssh. I'm quite frustrated to say this didn't fix anything. Had exactly the same behaviour: snip debug1: Next

openssh remote upgrade procedure?

I administer a couple of remote Debian servers and must say the latest security update has left me stranded. My only access to these machines was over SSH, using keys. So I logged in the other night and this was the series of events: + I enabled password authentication in sshd_config

Re: openssh remote upgrade procedure?

Unfortunately my question has still not been answered. 1. What's the information in /usr/share/doc/openssh-server that is so enlightening? I don't have access to a debian machine right now so would be nice to know. Tried downloading from http://packages.debian.org/etch/openssh-server to no avail.

debsums: no md5sums for a lot of important packages on sarge

Dear all During investigation of kernel panics on a Debian stable (sarge) server I administer I installed debsums. The result of the first run was: blah:~# debsums -c debsums: no md5sums for at debsums: no md5sums for base-files debsums: no md5sums for binutils debsums: no md5sums for bsdutils

UsePAM in /etc/ssh/sshd_config and timing attacks

Dear all People have been complaining for too long that timings attacks are possible because of the way OpenSSH responds to keyboard-interactive authentication. With the variance in the delay of response, it makes it obvious whether the username it tries to authenticate indeed exists on the