X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=4.9 required=5.0 tests=AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,RFC_ABUSE_POST,T_RP_MATCHES_RCVD,T_TO_NO_BRKTS_FREEMAIL
X-Spam-Check-By:	sourceware.org
Message-ID:	<11457.95026.qm@web35305.mail.mud.yahoo.com>
Date:	Wed, 15 Jun 2011 06:09:19 -0700 (PDT)
From:	steve <paj_be_70 AT yahoo DOT com>
Subject:	Cygwin ssh vs NIPS
To:	cygwin AT cygwin DOT com
MIME-Version:	1.0
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

I have been using Cygwin for several years to remotely manage my servers via ssh.  In the last month our SiteProtector start killing my ssh connections.  It is flagging it as a DOS.  The specific NIPS rule is "ssh_ChallengeResponse_BO".  

"This signature looks at 32768 bytes of SSH connection traffic beginning 1024 bytes after the software version information has been exchanged.  The signature fires when if finds 48 consecutive characters of ASCII data.  The number of bytes is examine (pan.ssh.search.charcount) and the number of consecutive ASCII bytes to trigger the signature (pan.ssh.search.threshold) are user configurable."

Anyone have any suggestions.  This is driving me F'n crazy...had to start to use Putty....scp with Putty sux.

Any help is appreciated!
Thanks
Paj

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -