Keyboard Interactive Attack?

[Ron Frederick]

You need to disable “ChallengeResponse” (aka keyboard-interactive) authentication, not password authentication, to protect against this attack.

On Jul 22, 2015, at 1:56 PM, Bostjan Skufca <bostjan at a2o.si> wrote:
> 
> And to answer your question about what to do, you have three options:
> - disable access to ssh with a firewall
> - disable password authentication
> - install and enable IDS to mitigate brute forcing
> 
> b.
> 
> 
> On 22 July 2015 at 22:54, Bostjan Skufca <bostjan at a2o.si> wrote:
>> I just stumbled upon this story too (on /.), and as far as I
>> understand it, it allows a bit simpler way to perform brute force
>> attacks.
>> 
>> If you go about bruteforcing ssh, does it really matter that much if
>> you do it over one or 10 tcp connections?
>> 
>> If you do not have IDS (Intrusion Detection System, fail2ban or ossec
>> HIDS) installed and functioning, this bug does not matter all that
>> much. Determined attacker has this covered, regardles of number of
>> kbd-interactive attempts you allow per single connection.
>> 
>> b.
>> 
>> PS: Actually I tried the proof of concept + patch provided for ssh.
>> Openssh, patched with this patch, does not even compile.
>> 
>> On 22 July 2015 at 21:41, Scott Neugroschl <scott_n at xypro.com> wrote:
>>> I read an article today about keyboard interactive auth allowing bruteforcing.
>>> 
>>> I'm afraid I have minimal understanding of what keyboard-interactive really does.  What does it do, and should I have my clients set it to off in sshd_config?
>>> 
>>> 
>>> ---
>>> Scott Neugroschl | XYPRO Technology Corporation
>>> 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

-- 
Ron Frederick
ronf at timeheart.net