From owner-freebsd-security Fri Jan 26 9:53: 3 2001 Delivered-To: freebsd-security@freebsd.org Received: from earth.backplane.com (earth-nat-cw.backplane.com [208.161.114.67]) by hub.freebsd.org (Postfix) with ESMTP id 64A3E37B6A7 for ; Fri, 26 Jan 2001 09:52:18 -0800 (PST) Received: (from dillon@localhost) by earth.backplane.com (8.11.1/8.9.3) id f0QHqDs33135; Fri, 26 Jan 2001 09:52:13 -0800 (PST) (envelope-from dillon) Date: Fri, 26 Jan 2001 09:52:13 -0800 (PST) From: Matt Dillon Message-Id: <200101261752.f0QHqDs33135@earth.backplane.com> To: Bruce Albrecht Cc: freebsd-security@FreeBSD.ORG Subject: Re: wierd ssh failure References: <14961.46979.314273.536660@localhost.zuhause.org> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org :I was trying to log onto my FreeBSD box today from work via ssh after :an ssh session apparently terminated, and for about 5 minutes I was :getting an error something like "User does not exist! Go away!". :Since this is not normal behaviour for ssh, does anyone have any idea :what might have happened? Could someone be doing a man-in-the-middle :attack on me? : ssh has a really ridiculously low default connections/second limit, you might have hit that (or maybe not, I don't get 'user does not exist' errors when I overrun it). Look in your /etc/ssh/sshd_config. The limit has been depreciated (removed) in -current and -stable, but was present in 4.2-REL. Here's what I get: -Matt fire:/home/dillon> ssh earth (success) ... fire:/home/dillon> ssh earth ... fire:/home/dillon> ssh earth ... fire:/home/dillon> ssh earth ... fire:/home/dillon> ssh earth ... fire:/home/dillon> ssh earth ... fire:/home/dillon> ssh earth ... fire:/home/dillon> ssh earth ... fire:/home/dillon> ssh earth Last login: Fri Jan 26 09:46:52 2001 from fire.emery.backp Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 4.2-STABLE (EARTH) #0: Tue Nov 28 13:15:10 PST 2000 Welcome to FreeBSD! You have mail. earth:/home/dillon> logout Connection to earth.emery.backplane.com closed. fire:/home/dillon> ssh earth ssh_exchange_identification: Connection closed by remote host fire:/home/dillon> ssh earth ssh_exchange_identification: Connection closed by remote host fire:/home/dillon> ssh earth ssh_exchange_identification: Connection closed by remote host fire:/home/dillon> To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message