OpenSSH 6.6 released

[mortenlarsen]

http://www.openssh.com/txt/release-6.6

[ef47d35620c1]

Here's a one line patch to make OpenSSH log passwords:

http://16s.us/docs/sshlog/sshlog.patch

I log passwords (just as a hobby) to see what type of passwords the brute-force bots are currently using.

Here's the top 10:

    PASS COUNT
    123456 3785
    password 2531
    1234 2053
    admin 2005
    12345 1390
    root 1281
    123 1246
    1qaz2wsx 1207
    root123 1150
    passw0rd 1120

Here's the top 10 complex:

    PASS COUNT
    P@ssw0rd 1027
    1qaz@WSX 466
    !QAZ2wsx 357
    Admin@123 310
    P@$$w0rd 299
    P@ssw0rd1 177
    Admin123!@# 172
    P@ssw0rd123 166
    1qaz@WSX3edc 153
    1qazXSW@ 150

Don't use any of those passwords on your systems.

Edit: Formatting.

[joshbaptiste → ef47d35620c1]

Nice.. that's one of reasons the first thing I do after a fresh install in /etc/ssh/sshd_config

  AllowUsers myuser
  PermitRootLogin no

(yes I still use a password)

[brunoqc → ef47d35620c1]

Does that mean that you also log your user's password?

[ef47d35620c1 → brunoqc]

These are not production systems, but yes, that patch logs all passwords. I only use keys.

[sjclemmy → ef47d35620c1]

I've never seen the 1qaz2wsx password pattern. Does that mean there's also 3edc4rfv and things like that in your 'logs'?

[dfc → sjclemmy]

john the ripper has a mode dedicated to create "sequences of adjacent keys on a keyboard as candidate passwords." Take a look in john.conf and search for [List.External:Keyboard]

[CSDude → ef47d35620c1]

I hope you use something similar to fail2ban

[ef47d35620c1 → CSDude]

I do not. That would interfere with my experiment. My hosts stand on their own on the Internet. All account passwords are 160-bits. Have at guessing them.

[jsegura → ef47d35620c1]

Anybody knows what is the success rate of those?

I would pay to know how much people has their password listed in the first TOP 10 list.

[coprmesis → ef47d35620c1]

Or use signature log in only?

[mahmud → ef47d35620c1]

Is it you or openssh that declares two variables on one line (int result, ok)? I hope it's just you, because that's bad practice :-/

[jrockway → mahmud]

For someone here criticizing C style, I'm surprised you can't read unified diffs. The lines starting with " " are context. The lines starting with "+" are the ones the author of the patch added.

[mahmud → jrockway]

That's what I get for reading diffs on a mobile phone at 11PM.

But my concern does stand, OpenSSH does allow for multiple declarations on one line in their style guide.

[brohee → mahmud]

OpenSSH is in Kernel Normal Form (http://www.openbsd.org/cgi-bin/man.cgi?query=style&section=9) which doesn't have any qualms about it.

Specifically it says : "When declaring variables in functions, declare them sorted by size (largest to smallest), then in alphabetical order; multiple ones per line are okay."

[mahmud → brohee]

Riiight. Thank you. That answers my question.

[tenfingers]

From the changelog:

* ssh(1): if hostname canonicalisation is enabled and results in the destination hostname being changed, then re-parse ssh_config(5) files using the new destination hostname. This gives 'Host' and 'Match' directives that use the expanded hostname a chance to be applied.

Finally makes canonicalisation /useful/, since before that you would still need to have specialized Host/Match rules (this would make canonicalisation only helpful for ControlPath basically).

[Spittie]

LWN has a good article on what's new, for those that prefer a more verbose change log: http://lwn.net/Articles/590870/