From owner-freebsd-security Tue Mar 27 14:35: 0 2001 Delivered-To: freebsd-security@freebsd.org Received: from moek.pir.net (moek.pir.net [130.64.1.215]) by hub.freebsd.org (Postfix) with ESMTP id BE3E037B718 for ; Tue, 27 Mar 2001 14:34:56 -0800 (PST) (envelope-from pir@pir.net) Received: from pir by moek.pir.net with local (Exim) id 14i23D-0004Ww-00 for security@FreeBSD.ORG; Tue, 27 Mar 2001 17:34:55 -0500 Date: Tue, 27 Mar 2001 17:34:54 -0500 From: Peter Radcliffe To: security@FreeBSD.ORG Subject: Re: SSHD revelaing too much information. Message-ID: <20010327173454.J12888@pir.net> Reply-To: security@freebsd.org Mail-Followup-To: security@FreeBSD.ORG References: <20010327005503.J5425@rfx-216-196-73-168.users.reflex> <20010327005503.J5425@rfx-216-196-73-168.users.reflex> <4.3.2.20010327160147.02c1b6c0@207.227.119.2> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <4.3.2.20010327160147.02c1b6c0@207.227.119.2>; from jeff-ml@mountin.net on Tue, Mar 27, 2001 at 04:27:55PM -0600 X-fish: < X-Copy-On-Listmail: Please do NOT Cc: me on list mail. Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org "Jeffrey J. Mountin" probably said: > You also forget the point that the extra information means it isn't a > vulnerable version, which it would be without the patches. Thus moving > that information later would mean a potential attacker might think "Hey, > this system is vulnerable..." and try to exploit a hole that has been > plugged. Believe doing this would annoy far more people than those that > are complaining about the information. Blah! I'd rather they wasted their time trying to compromise vunerable machine and leaving tracks that are noticable than heading directly to the vunerable machines and compromising them without leaving tracks. > Something that no has pointed out yet is that if you try to limit the > information the system displays or not for that matter, you might attract > the attention of someone that likes a challenge. Sure there are far more > script kiddies, but would lump the obscurity idea along with boasting a > system is not vulnerable. Bragging might attract the wrong types to test > the truth of such a statement. For certain that might help when it turns > out it isn't true, but would be a hassle regardless. Do you leave your doors unlocked in case someone breaks it down, too ? P. -- pir pir@pir.net pir@net.tufts.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message