3.22 x86 ssh bug?

RouterOS General
1

Hi Tikpeople!

I try ssh login with user password length >= 32 chars and don't work! (x86 arch)
Is a bug?

\



If I disable ftp privilege from group user this bug not occur, only if privilege ftp is enabled. :open_mouth:

With wrong password returns me:

admin@192.168.1.1's password:
Permission denied, please try again.

With correct passwords returns me:

admin@192.168.1.1's password:
Login failed, incorrect username or password

Login:

I belive that's a privileges error.

2

I can confirm this bug. The system is a 3.22 mikrotik on a Pc Engines alix6b2 board.

 
/user set system password=01234567890123456789012345678901

/user pr detail 
Flags: X - disabled 
 0   ;;; system default user
     name="system" group=full address=0.0.0.0/0

/user group pr detail 
 0 name="read" policy=local,telnet,ssh,reboot,read,test,winbox,password,web,
                    sniff,!ftp,!write,!policy 

 1 name="write" policy=local,telnet,ssh,reboot,read,write,test,winbox,password,
                     web,sniff,!ftp,!policy 

 2 name="full" policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,
                    password,web,sniff

Setting the password to 32char i cannot login with ssh [telnet,winbox,mac-telnet yes i can] with user system:

system@192.168.1.10's password:
Login failed, incorrect username or password

echo: system,error,critical login failure for user system from 192.168.1.217 via
 ssh
echo: system,error,critical login failure for user  from 192.168.1.217 via ssh

Please look at the last line of the log… there isn’t the name of the user.

3

Anyone else have the same problem?
It’s strange… :open_mouth:

4

we will look at this. but why such long password ? :slight_smile:

5

For security reasons. It’s a client requeriment.

Thanks a lot!

6

I think it’s much more secure to use certificates:
http://www.mikrotik.com/testdocs/ros/3.0/admin/ssh.php

7

Sure! that’s more secure!! :smiley: but only I need large passwords

Thanks

8

to be honest - it does not make any sense first you say, that you need very very safe and secure, so you are using password, when you have more secure option - you say, you do not need that and you need less secure solution. Make your mind - what you need, more secure - use certificate, less secure - password. and in last case any password longer than 32 symbols does not make sense, ask any security expert out there about “feature” where password is longer than that.

9

  1. We will investigate why SSH doesn’t work with long passwords, don’t worry about that.

  2. I think such long password is not possible to remember, and user will be forced to write it down somewhere, decreasing security ~-0 :slight_smile:

10

Yes it’s difficult to remember the password but it’s my client requeriment… :open_mouth:

But this is a bug and I think it’s a error in privileges control. With ftp privilege disabled then works perfect.

Normis, to report other critical error, which mail I have to write?

Sorry for my english…

11

write to support with steps how to reproduce the bug

12

Ssh bug (x86 arch) still in v3.23.

Any news?

Thanks