[ILUG-BOM] Security hole in OpenSSH

I dont know if to call this a security hole or not. Basically if you are using OpenSSH which autheticates using PAM its open to a timing attack by which you can see if a user is a vaild user on a box or not. It works like this

ssh [valid.user]@hostname password: <enter gibbrish> [2 second delay] wrong password, enter password:

basically if u are a valid user on the system there is a 2 second delay before you are prompted again to enter the password when u type a wrong password and if the user you are trying is not a vaild user there is not 2 second delay.

usually ssh root@hostname gives u the 2 second dealy since root is always around :)

but say you try ssh god@hostname might not give u the dealy unless the box has an account god