I'm scared Jow Forums.
LibSSH Flaw Allows Hackers to Take Over Servers Without Password
Logan Jackson
Jaxon Jones
>2018
>password authentication
Easton Morales
1. Don't use libSSH
2. Password authentication? HAHAHAHAHAHAHA
Seriously turn that off.
Nicholas Anderson
See that's why you don't use open source software.
Tyler Brown
You don't really have to work about server compromise; libssh was mostly used inside of applications, as a wrapper around some sort of data transport. Github for example used it as a wrapper around Git connections.
Some applications and small embedded systems might be at risk, but servers seem very unlikely to be affected.
Joseph Thomas
>there are still people that don't use the superior SSH
You deserve everything
openSSH and libreSSL are both a complete must
William Fisher
please redpill me on how else to authenticate
Cooper Mitchell
neither, but
RSA key
Easton Cook
key verification
Lincoln Morris
> Running Void Linux for the past 2 years
> Simple init system (no systemd)
> LibreSSL and OpenSSH by default
> mfw never affected by libssh/openssl bullshit
Jaxon Moore
please tell me
is my home server safe
Chase Phillips
Key exchange
Justin Sullivan
Just read the article you fuckwit.
Aiden Brown
Yes, libssh2 is not libssh
Jace Ross
thanks mate
Henry Hall
True, better let vulnerabilities stay undiscovered, right?
Gabriel Rodriguez
OpenSSH is not affected.
Bullshit. No-one uses libssh server code, which is why it was so low quality. If people use libssh they only use client code. People use openssh or dropbear.
Jason Smith
Old
Luis Taylor
>Using rsa key instead of Ed
Lol loser
Parker Sanchez
So here's what I don't get, why is key exchange better than a good password? Even a bad password - if you use fail2ban, then you can't brute force ssh very easily, rendering dictionary attacks pretty useless. As long as you don't use the same password as elsewhere then it should be fine.
Austin Miller
how do i turn off ssh in uboongo?
Julian Collins
> No-one uses libssh server code, which is why it was so low quality
Who even uses libssh? We did some digging yesterday, maybe PHP has a connector which depends on libssh2 (two), the original libssh was used by Wireshark, I believe.
Jack Walker
mfw feel the same feel of this pepe