On Mon, 17 Apr 2006, Brett Glass wrote: > It seems to me that sshd should not tip its hand by returning > different responses when a user ID can be used for logins than when > it can't -- allowing an attacker to focus password guessing attacks > on user IDs with which it would have a chance of gaining access. For > those folks out there who are more familiar with OpenSSH than I am: > How hard would it be to make the responses indistinguishable? It would help if you reported what the actual differences you were experiencing are, the operating systems and versions of OpenSSH in question and how you came to the conclusion that password guessers were able to figure out the difference. OpenSSH already tries to minimise any exposed difference when attempting authentication using a valid account, a non-existent account and a valid account barred by Allow/DenyUsers policy. On the platforms immediately at my disposal (Linux running an older OpenSSH and OpenBSD running CVS -current OpenSSH), there is no visible difference in the protocol messages sent or in the rough timing between them when making incorrect password guesses between a valid account in AllowUsers and one that is not. We would consider divergences from this as bugs, so if you find one then please report it to us (see http://www.openssh.com/report.html) -d
