Ever heard of anything like this?

[hatebreed2000]

I am on my XP box, andi ssh into a remote server via putty, and i type in the user name, then prompts me for the passwd and after typing in the first 4 letters of this 32 char long passwd i accidently hit "rf". I knew that it was goin to wrong, and since the passwd doesnt even come up as a cipher when typing it on a linux driven box i just hit enter to re-enter it, but it lets me log on!!
I had typed in the wrong passwd, not even close to what the passwd really is, and it lets me in. So at first im thinking that it is a config error on there server, but i decide to do it again just as i done it the first time just to see if it happens again, and it does. So for further troubleshooting purposes, i log on to my RH box and try the same thing, typing the first 4 letters of the passwd then "rf" but it doesnt log me on, it says access denied, so i try it again, and i get the same msg, access denied, so i go back to the XP comp and try it one last time via putty, and it still lets me do it. So my question to you guys is this: Why? why is putty letting me do this and not by ssh via command line on RH. I looked in all the config details under putty, and found nothing that might be causing this, so i looked on google for a bit, and came up with nothing as well. Obviously this isnt good at all, so i would greatly appreciate it if someone could give me some insight as to why putty is doing this, and what i can do to fix it. Thank you much, take it easy people. BTW, the server i am trying to log on to is valid, i did not hack it or anything, and any one with doubts can express them and the member on this site that has given me this ssh account can verify that he did give me this account and it wasnt gained by any of my uberness <---- that last part was a joke btw :P .

[ammo]

Any chances you might be unkowingly using certificates for auth or perhaps kerberos or NTLM(although AFAIK OpenSSH doesn't support that)... Or perhaps you some rhosts set...

Still, odd thing indeed...


Ammo

[roswell1329]

I think ammo's on the right track. When you configured SSH, did you generate a public/private key pair and install the public key on the RH box, and the private one on the remote machines? If so, you could be using remote key verification. You can disable it in the sshd-config file (usually in /etc/ssh). If you edit sshd-config, remember to run a "killall -HUP sshd" to recycle the daemon and refresh the config. You may also want to glance through sshd-config to see if you have any other remote verification schemes installed that could be causing the password-less entry.

[hatebreed2000]

nope, i am not using any cert verification services, and no ssh doesnt support NTLM, but i have been playin around with it more and its gotten a bit more interesting, i have a suse box and a RH box, so what i did was set up a sshd on both boxes on my own lan and tried to log on to both via putty. My results were this: I can log on to the suse 8.2 box via putty tryping only the first 4letters then "rf", but i can not do this to the RH box. and the daemons on both boxes are confied identically, so now im asking myself is it putty? or is it suse? I'm kinda confused at this point, im gonna search on google some more, see what i come up with, but anyone that has any ideas, feel free to spit em out. Thanx to both of you guys though, take it easy.