dubious behavior during login

[mouring at etoh.eviladmin.org]

Can we get a ssh -v -v on the Tru64 machine please?


On Tue, 28 Nov 2000, Rafael Caetano dos Santos wrote:

> Hi,
> 
> I'm running openssh-2.3.0p1 under Tru64 4.0.
> I've got the sources and built it whithout additional options.
> The `problem' happens when a login from a non-existing user is attempted:
> 
> $ ssh bogus at foo.com
> Connection closed by foo.com
> 
> It doesn't even ask the password.  So anyone can test whether this
> host has a user called bogus.
> I'm not sure whether this is a bug, but I guess it's not advisable to
> give away such information.
> 
> I also run ssh 2.2.0p1 under Debian GNU/Linux, but its behavior 
> is different (and correct, I suppose):
> 
> $ ssh bogus at foo.com
> bogus at foo's password: 
> Permission denied, please try again.
> 
> Please cc: me, since I'm not subscribed to the list.
> 
> Thanks in advance.
> 
> bye 
>     Rafael Caetano <rcaetano at linux.ime.usp.br>
>