Re: [cobalt-users] installing ssh on raq2

["Jens Kristian Søgaard" <jens@xxxxxxxxxxxxxxxxxxxx>]

> I >have< it installed, but have experienced no problems as of yet
(except for
> catching port-scanners who get, booted, but that's the point...), so
I'd like to
> know how it could be exploited.  I assume the attackers would have to
some how
> figure out that portsentry is running in the first place also..

Yes, but figuring that out is quite easy (just test it).

The main types of exploits are:

  1. Getting PortSentry to ban users that should be allowed to the
server (by spoofing ip-packages to weird ports).

  2. Use the same technique to fill your logfiles.


--
Jens Kristian Søgaard, Mermaid Consulting I/S,
jens@xxxxxxxxxxxxxxxxxxxx