pacman
|
|
Security on grex
| 
Nov 8 01:05 UTC 2001 |
I suppose this isnt much a surprise to most of us, but it helps my conscience
if I make sure we all know. Unless you login to grex using SSH you are really
vulnerable. A packetsniffer will easily view your password. Speaking of SSH,
there is an exploit in it, check cert.org for details. But seriously, use
a crap password and for the paranoid and intelligent, SSH.
|
saw
|
|
response 1 of 4:
|
Nov 15 05:42 UTC 2001 |
Correct. Telnet does everything in cleartext (yikes!) which is
obviously not all that secure. Telnet is VERY secure as long as no one
is sniffing packets .. but after that, you know the deal. On the other
hand, SSH is more secure than Telnet. There is a vulnerability in SSH1
where you can do a man-in-the-middle attack. (I've done it on our
corporate LAN before, rather interesting.) SSH2 isn't vulnerable to
this, AFAIk. But, from what I've seen/heard, upgrading SSH on Grex
isn't as easy as one would expect. Look in the "garage" conference at
one of the more recent items, which covers the implications of upgrading
Grex's SSH.
|