Re: [cobalt-users] RE: telnet vs ssh

["David B. Peterson" <dave@xxxxxxxxxxx>]

> Do you mean the "sshd1 allows unencrypted sessions regardless of 
> server policy" thread?

That's one, I think there was another too.  Someone who must be 
running servers for banks over there because he said he would never 
put up an ssh1 server now that ssh2 is out, regardless of which 
version his client connections were.


> It's still a lot better than telnet <smile>.  And as David Schwartz' 
> post of December 14th points out, a server cannot protect you 
> against a client compromise.
>
> Not easily, I add.

It's a hell of a lot better than telnet.  And it is much better if 
you turn off all non-encrypted authentication on the box (ftp too.) 
scp seems to be working for me.

Of course it is best of you power off the machine, encase it in 
concrete, place it in a locked room in the bowels of a nuclear waste 
facility.  But that seems to be going a little too far.


> The tin man wanted a heart.  The scarecrow wanted a brain.  I'd 
> settle for enough time to follow bugtraq <smile>.

I try to only give it about 10 minutes a day.  Just enough to keep up 
with exploits on the software that I use.

-Dave

--
  David B. Peterson    Metagraphics, Inc.
1023 Corporation Way, Palo Alto, CA  94303
  650-964-4600 x225    FAX: 650-964-9575