3 ms·
Real password based vs challenge response. With real password when you type your password into the ssh password prompt it then sends that password to the serve
by pests 8y ago
Real password based vs challenge response.
With real password when you type your password into the ssh password prompt it then sends that password to the server.
Challenge response is a method in which you usually encrypt or hash random server provided data. You send the hash. The server knows your password and can hash the data with it too. The hashes are compared not the password. In this method the password never leaves your machine. Replay attacks are prevented due to the server sending different data for you to hash on different login attempts.
- e12e 8y agoNote also that requiring a password for sudo might have some issues, as the password is sent over the ssh connection as you type. I'm not sure what the state of the art is wrt counting and guessing characters - or if mossh makes the problem worse - or helps. For the general idea, see: http://www.securiteam.com/securitynews/5KP0O0A3PU.html http://www.securiteam.com/securitynews/5KP0O0A3PU.html Does anyone know of recent work on passively attacking interactive ssh in order to guess what's being typed? I could see machine learning helping here, given the ability to observe enough sessions to form a training set...
- e12e 8y agoOf course, with Pam for sudo authentication you could use otp, u2f with or in place of a password.