Hello list, i have the same problem but no answer. My config: SuSE 7.3 / OpenSSH 3.3p1 / MD5-pass Only Protocol-2 with RSA-Auth is working. What is the problem? MD5 or PAM? Please Help.... Mario

-----Original Message----- From: Thomas Reitelbach [mailto:tr@troficent.de] Sent: Tuesday, June 25, 2002 11:28 PM To: suse-security@suse.com Subject: Re: [suse-security] OpenSSH 3.3p1 / SuSE 7.3 / no login possible

On Tuesday 25 June 2002 23:13, Thomas Reitelbach wrote:

...

Hello list,

i know there are many threads about the actual OpenSSH and the upcoming problems. But i think my problem has not been discussed here before.

[snip]

I'm sorry to have sent this to the list... it was a problem with MD5 passwords :-/

shame on me!

Thomas

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

Hey Guys, Ease up... SuSE is doing what they can. The blame goes to Theo for not divulging the actually exploit... (even to the vendors.) If you read the release notes on the new version of SSH, you will find that this version isn't really ready for prime time. There is quite a list of "known problems" with it, including the PAM breakage that many people are experiencing. Now, I am sure that Theo and ISS have a good reason for not divulging the exploit... and even though it goes against the grain of "open source" philosophy, I'd rather they not announce it until a *REAL* fix has been produced. Especially since I have so many exposed machines in different places. - Herman Dave wrote:

----- Original Message ----- From: "M. Neubert" To: "'Thomas Reitelbach'" ; Sent: Wednesday, June 26, 2002 2:25 AM Subject: RE: [suse-security] OpenSSH 3.3p1 / SuSE 7.3 / no login possible

...

Hello list,

i have the same problem but no answer. My config: SuSE 7.3 / OpenSSH 3.3p1 / MD5-pass

Only Protocol-2 with RSA-Auth is working. What is the problem? MD5 or PAM?

This is my first post to the list, prompted by the OpenSSH 3.3p1 update. I'd like to thank the SuSE team for securing the system - specifically disabling ssh access via keyboard authentication.

I have the same problem, namely md5 passwords on SuSE 7.3 and can no longer get keyboard authentication to work, after disabling compression and privilege seperation.

I sympathise with the pressure the team is under day to day, but can we have a bit more testing next time, please guys? At least make the 2.9.9p2-98 patch available until there is an updated version that authenticates properly (I believe the OpenSSH team is moving for a security fix version by Monday, rather than one which merely coincidentally closes the hole?)

I'm surprised at the haste with which this update was released - especially considering the vague nature of security concerns raised.

Dave Alfar Networks

* Ben Rosenberg wrote on Tue, Jun 25, 2002 at 22:31 -0700:

* Dave (dave@alfar.co.uk) [020625 22:22]: ::I'm surprised at the haste with which this update was released - especially ::considering the vague nature of security concerns raised.

[...]

bit 1/2 baked with 3.3p1. As for a vague nature..blame Theo and the OpenBSD team for this. They didn't give any more information then "If you don't use privsep and 3.3p1 there is a "remote root exploit". *shrug* I would blame SuSE..

Well, exactly. I'm think the whole story is horrible and makes me angry. First, you have to use an experimental feature, which is known to cause many problems and on many architectures, and second, this update doesn't even solve the remote exploit! It just reduces it's impacts. Well, anything is guessed, since Theo didn't told details.

together a fix that works for most people. When the bug and true fix are released by the OpenBSD/SSH team I am sure SuSE will jump on it quickly.

Well, and maybe disabling those experimental security split mode, getting back the functionality. Well, and you'll have to upgrade next week in any case again...

so..no one's twisting your arm ..accept maybe a script kiddie who gets into your system because you didn't use the best fix that could be provided at the time. ;)

In this mode, the kiddie intrusion cracks a chroot jail with and some user==sshd or such. Well, I don't like that at all. Maybe they forgot an open directory file descriptor :) Surely the 2nd exploit from somewhere would use that... The thing that makes me nervous: since ssh had issues recently, the script kiddies have nice hostlist that are running ssh. Well, let's hope none of them read the flash worm articles and implemented that, since this issue maybe a really nice start. Even if it doesn't look like a zero day exploit, it may turn in fact to a minus-one-week-exploit, since maybe the script kiddies finished a work skeleton... I don't like to thing about that, huh... oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

Olaf Kirch wrote:

For the record, we were notified of this vulnerability on Monday afternoon (and I didn't learn that you have to go to 3.3 _and_ enable privilege separation until after I had built RPMs for all suse platforms :)

Speaking of all platforms - yeah, I know you didn't say versions :): The Suse-Advisory yesterday mentioned RPMs for 6.4 (which I am stuck with at the moment at least on two servers). I know about problems with older PAM-Versions and Kernel 2.2.x, but seeing that there are patches for 7.0 (which also seems to have 2.2.x, at least here), I'm wondering if I could go with these. Or did anyone have success with compiling OpenSSH on their own? Another question: What do I break if I use the RPMs for 7.0 on SuSE Mailserver II? It seems to require an update of openssl, which at least sslwrap uses, which seems to be needed for at least imaps. Any hints? Ralph

Hi there, just one thing, you at SuSE did a great job to me. I agree about your vision of security problems, first close the gate , second make the gate really secure. About the MD5 problem, well..none is perfect that's a prob that is giving some prob to the real writters of openSSH code. So? Shall we get upset with SuSE guys for this? NO WAY! Thanks for your great job. bye all Alberto