Re: ssh ident

From: Renaud Deraison (deraisonat_private)
Date: Thu Mar 20 2003 - 12:00:39 PST

Next message: Anne Carasik: "Re: ssh ident"

Previous message: sulloat_private: "ssh ident"
In reply to: sulloat_private: "ssh ident"
Next in thread: Anne Carasik: "Re: ssh ident"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, Mar 20, 2003 at 02:16:21PM -0500, sulloat_private wrote:
> We're seeing some odd messages with regard to SSH running on many servers. On
> one host, for example, I see:
> 
> - An unknown service is running on this port.
>   It is usually reserved for SSH
>   Nessus ID : 10330
> 
> - Remote SSH version : SSH-2.0-2.0.12 (non-commercial)
>   Nessus ID : 10267
> 
> It seems that find_service.nes is not identifying the SSH server. But the
> ssh_version.nasl is correctly figuring out that it is SSH...
> 
> Any idea why find_services.nes is not properly identifying it? The match in
> find_services.nes is:

find_services.nes is the first plugin to really connect to the remote
services. Maybe the remote host first tried to do a reverse lookup on
your IP, so the recv() in find_service.nes failed, and subsequent
connections worked because your IP finally resolved and is in the DNS
cache of the remote host ?

				-- Renaud

Next message: Anne Carasik: "Re: ssh ident"
Previous message: sulloat_private: "ssh ident"
In reply to: sulloat_private: "ssh ident"
Next in thread: Anne Carasik: "Re: ssh ident"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Mar 20 2003 - 12:01:11 PST