i got a fresh installation of slackware 7.1 (kernel 2.2.16) + openssl 0.9.6 +
openssh 2.3.0p1.
i got this from default sshd_config. just wonder if my understanding is
correct or not.
---
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
---
with this settting, i ran sshd -d, then:
---
debug1: sshd version OpenSSH_2.3.0p1
debug1: Seeding random number generator
debug1: read DSA private key done
debug1: Seeding random number generator
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
Generating 768 bit RSA key.
debug1: Seeding random number generator
debug1: Seeding random number generator
RSA key generation complete.
debug1: Server will not fork when running in debugging mode.
Connection from 202.130.148.224 port 27539
debug1: Client protocol version 1.5; client software version PuTTY
debug1: no match: PuTTY
debug1: Local version string SSH-1.99-OpenSSH_2.3.0p1
debug1: Sent 768 bit public key and 1024 bit host key.
debug1: Encryption type: 3des
debug1: Received session key; encryption turned on.
debug1: Installing crc compensation attack detector.
debug1: Attempting authentication for xxx.
Password authentication disabled. <-- is it the reason of failed pasword?
Failed password for xxx from xxx.xxx.xxx.xxx port 27539
Password authentication disabled. <-- is it the reason of failed pasword?
Failed password for xxx from xxx.xxx.xxx.xxx port 27539
---
can't login with failed password prompt even with correct user/password pair.
however, with PasswordAuthentication set to yes
---
PasswordAuthentication yes
---
i ran sshd -d again, it ok to logon my host.
---
debug1: sshd version OpenSSH_2.3.0p1
debug1: Seeding random number generator
debug1: read DSA private key done
debug1: Seeding random number generator
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
Generating 768 bit RSA key.
debug1: Seeding random number generator
debug1: Seeding random number generator
RSA key generation complete.
debug1: Server will not fork when running in debugging mode.
Connection from xxx.xxx.xxx.xxx port 27728
debug1: Client protocol version 1.5; client software version PuTTY
debug1: no match: PuTTY
debug1: Local version string SSH-1.99-OpenSSH_2.3.0p1
debug1: Sent 768 bit public key and 1024 bit host key.
debug1: Encryption type: 3des
debug1: Received session key; encryption turned on.
debug1: Installing crc compensation attack detector.
debug1: Attempting authentication for xxx.
Accepted password for xxx from xxx.xxx.xxx.xxx port 27728
debug1: session_new: init
debug1: session_new: session 0
debug1: Allocating pty.
debug1: Entering interactive session.
debug1: Setting controlling tty using TIOCSCTTY.
debug1: fd 3 setting O_NONBLOCK
debug1: fd 7 IS O_NONBLOCK
debug1: server_init_dispatch_13
debug1: server_init_dispatch_15
---
the question is: is the password send still in clear text across the network?
thx.
--
Regards, Christopher Luk
Software Engineer, AOL Hong Kong
Tel: (852) 2961 2650 Fax: (852) 2806 0527 email: [EMAIL PROTECTED]
