Re: ssh warning!

[consul tores <consultores1@gmail.com>]

2010/3/24 Berni Elbourn <berni@elbournb.fsnet.co.uk>:
> consul tores wrote:
>>
>> Hello
>>
>> I do not want to create panic, but playing with my Lenny Laptop,
>> against Squezee and ArchLinux; i got (literaly) access without
>> password.
>> Conditions:
>> New installation in my testing box, from Lenny i was ready to edit
>> sshd_config after intallation, and i opened a console, i did ssh
>> root@IP, when ssh asked me for password, i opened a window doing
>> fish://root@IP, magically i was inside my Squezee or ArchLinux box.
>> I tested it few times and it was the same thing 1/20 aproximately, i
>> could not find a logical explanation but it happened. has someone
>> found something similar?
>>
>> francisco
>>
>>
>
> Sure, just set a valid cached password for the target systems.
>
> I have always found fish to be unreliable so your 1 in 20 sounds about
> normal to me.
>
> Berni

i tested it on OpenBSD and nothing happens, could be pam responsable
of it? After adding rsa/dsa.key, everything goes well.

francisco.