Re: [PLUG] recent vulnerability in OpenSSH

["Alan D. Salewski via plug" <plug@lists.phillylinux.org>]

On 2024-07-01 16:21:40, "Alan D. Salewski via plug" <plug@lists.phillylinux.org> spake thus:
[...]
> This note from Damien Miller on the 'oss-security' list has a workaround plus
> patches:
>
>     https://www.openwall.com/lists/oss-security/2024/07/01/2

I hit send too quickly; I meant to include djm's blurb about the workaround:
<quote>
    Regarding the race condition fixed in OpenSSH 9.8. A mitigation to
    prevent exploitation of this bug is to disable the login grace timer
    by setting LoginGraceTime=0 in sshd_config. This will however make
    it much easier for an attacker to deny service to sshd.
</quote>

--
a l a n   d.   s a l e w s k i
ads@salewski.email
salewski@att.net
https://github.com/salewski
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug