On Tue, 2006-01-03 at 11:26 -0500, Michael H. Warfield wrote:
It's considered axiomatic that security
systems should NEVER disclose that level of information, even to the
point of not giving a different error (message or code) for invalid
password vs invalid account. Even timing (responding too quickly if the
account doesn't exist compared to wrong password) is considered a
SERIOUS no-no. I would have to consider that sshdfilter a security
vulnerability, not a security tool.
Fully agree.
Differences in the system's behavior, based on usernames, visible from
outside, are a security issue.
--
Florin Andrei
http://florin.myip.org/