Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Date: Fri, 29 Aug 2003 01:24:28 +0100 (BST)
From: Matt Holgate <matt-cyg AT holgate DOT org DOT uk>
X-X-Sender: matt AT sauron DOT holgate DOT org DOT uk
To: cygwin AT cygwin DOT com
Subject: Worrying openssh behaviour
Message-ID: <Pine.LNX.4.55.0308290115530.7572@sauron.holgate.org.uk>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII

Hi,

I've had cygwin installed for a while on my Windows XP box and it's been
great. However, today I installed a personal firewall (Kerio Personal
Firewall to be exact) and I noticed some worrying behaviour with openssh.

When using the openssh client to connect to my linux box, it correctly
opened a TCP connection to the server on port 22.

However, it also seemed to open a local socket for listening. On each key
press, the ssh.exe process seemed to connect to itself, handle the
keypress and open another socket on a different port to listen again.

This behaviour seems very strange and I was worried in case this might be
a trojan or something? But it seems weird that it is listening on
localhost and receiving connections from itself.

If you could throw any light on this weirdness I'd be really grateful. It
doesn't appear to happen when using PuTTY, so I'm inclined to believe its
not a system wide keylogger or anything. The version of my ssh is as
follows:

$ ssh -V
OpenSSH_3.6.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090702f

thanks in advance,
Matt.


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/