From owner-freebsd-questions  Thu Jan  1 14:30:23 1998
Return-Path: <owner-freebsd-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id OAA13663
          for questions-outgoing; Thu, 1 Jan 1998 14:30:23 -0800 (PST)
          (envelope-from owner-freebsd-questions)
Received: from ns1.hiper.net (ns1.hiper.net [207.137.172.11])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id OAA13646
          for <questions@FreeBSD.ORG>; Thu, 1 Jan 1998 14:30:18 -0800 (PST)
          (envelope-from randyk@ccsales.com)
Received: from ntrkcasa (pool38.hiper.net [207.137.172.38])
	by ns1.hiper.net (8.8.5/8.8.5) with SMTP id OAA15281;
	Thu, 1 Jan 1998 14:50:47 GMT
Message-Id: <3.0.5.32.19980101143122.02cd5740@ccsales.com>
X-Sender: randyk@ccsales.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Thu, 01 Jan 1998 14:31:22 -0800
To: mgraffam@mhv.net, Steve Hovey <shovey@buffnet.net>
From: "Randy A. Katz" <randyk@ccsales.com>
Subject: Re: HACKED (again)
Cc: questions@FreeBSD.ORG
In-Reply-To: <Pine.LNX.3.96.980101152832.28029B-100000@localhost>
References: <Pine.BSI.3.95.980101111731.24847F-100000@buffnet11.buffnet.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-questions@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

How do they get that kind of control with ftp? Are there standard exploits?
I had removed all anonymous access to that box...guess that wasn't it, eh?


>
>I dont think this is necessarily a problem with ssh. Ssh's security can
>be circumvented through the insecurity of other things that are running,
>such as ftp.
>
>While I havent looked over every line of ssh source, what I have seen
>shows good technique against programming glitches that allow root access
>through broken suid programs, and the crypto looks fine when compared
>against other (trusted) implementations.
>