OpenSSH mild security bug
-
-
I don't allow password auth with SSH. ;)
-
Even if you did, an online attack that is limited to some small number(tends of thousands) of attempts is meaningless against a strong password. And fail2ban would catch it anyway.
-
Turns out the issue isn't OpenSSH, it's PAM, and from the sounds of it, only PAM on FreeBSD, not any Linux distro.
-
It's specific to a configuration that seemingly only FreeBSD uses by default. It's really a non-issue, should disable password logins if you're opened to the Internet, and if your password is guessable in the amount of tries you could get through you're doing it wrong. We dropped the grace time to limit the potential impact in 2.2.4 and newer. https://redmine.pfsense.org/issues/4875