6 ms·
User enumeration seems to be the biggest hazard of running a server. I'd be curious to see a fingerd that lets you set a different name than your actual usernam
by cykros 24d ago
User enumeration seems to be the biggest hazard of running a server. I'd be curious to see a fingerd that lets you set a different name than your actual username, to avoid just spitting out names that an attacker can then set to work on cracking passwords for with an ssh daemon. Though I'm sure people will tell me that ssh keys sort this issue well enough -- and given that nobody self hosts email the spam issue isn't really there either.
Still, something like a masked identd used for masking system usernames for irc would go a long way to break the link between actual user accounts and display names for finger.