5 ms·

Does it strike anyone else as bizarre / poor form for an experimental feature to be enabled by default in OpenSSH, which is normally very conservative with opti

Does it strike anyone else as bizarre / poor form for an experimental feature to be enabled by default in OpenSSH, which is normally very conservative with option defaults?

agwa 11y ago
What's more, it was not documented in the ssh_config(5) man page. If it had been, I probably would have disabled it long ago when hardening my SSH config. Time to head to the source to look for other undocumented options... Update: my findings are here (scroll to bottom for the upshot): https://gist.github.com/AGWA/e92d4f5343be1f7a941d https://gist.github.com/AGWA/e92d4f5343be1f7a941d UseRoaming is the only one to be concerned about. There are many other undocumented options, but they're all aliases for a documented option or are deprecated/unsupported.
- noja 11y ago
  Please report back what you find!
- ryanlol 11y ago
  https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c https://github.com/openssh/openssh-portable/blob/e6c85f8889c... Here you go
  - ryanlol 11y ago
    Actually, I quickly generated a list of undocumented config options: http://sprunge.us/QDSE http://sprunge.us/QDSE Edit: Fixed version http://sprunge.us/LVYB http://sprunge.us/LVYB
    - vesinisa 11y ago
      most of those seem to be documented: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/ssh_config.5?query=ssh_config&sec=5 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/... I did a quick comparison between the OpCodes enum and the latest man page, and `UseRoaming` is the only real undocumented option.
      - ryanlol 11y ago
        Weird, my manpages didn't get updated despite man claiming they did. Fixing that now. Edit: fixed, http://sprunge.us/LVYB http://sprunge.us/LVYB
    - jlgaddis 11y ago
      I believe "kerberosauthentication" and "rhostsauthentication" are documented as well. I'd check the "official" OpenBSD man page instead of whatever you have on your system. Regardless, thanks.
      - ryanlol 11y ago
        Neither of those are mentioned on the latest manpage from git.
      - agwa 11y ago
        In the latest OpenSSH-portable source, those are considered "unsupported" and "deprecated," respectively (which means they're ignored, essentially). See https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undocumented_client_options https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undoc... as well as the source https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c#L191 https://github.com/openssh/openssh-portable/blob/e6c85f8889c...
drzaiusapelord 11y ago
It just sounds like a big code-base fuckup. They more or less admit it: "Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten." Sounds like this was put in at one time, forgotten about, and the code lingered for a long time until someone pointed it out. SSH as a protocol is pretty crazy. Everyone loves it, but its a lot of things in one, which ironically goes against the unix philosophy. Its a remote terminal, a file transfer server, a network tunnel server, a socks server, etc. There's a lot of stuff in there and I imagine difficult to work with sometimes. No word if this is enabled in Putty, but I imagine it is if its using openssh libraries.
- jlgaddis 11y ago
  Pretty sure this is OpenSSH only. PuTTY and SecureCRT, at least, are reported not to be affected.
  - larrymcp 11y ago
    We use WinSCP also, a file copying utility; it would be useful to know whether that's affected if anybody has that info.
    - voltagex_ 11y ago
      Last time I looked WinSCP used PuTTY components or a fork. Would appreciate additional verification of this, though.
- alanpost 11y ago
  Given that this exploit happens during capability negotiation (or whatever SSH calls that part of the protocol), it also cannot be mitigated via pledge[2], which is where OpenBSD has been focusing a lot of attention. This is an unusual stumble for the OpenBSD team. Client-side privsep support, if such a thing existed, might mitigate attacks like this. As it stands protecting against exploits of this type wasn't even on the hardening roadmap. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/...
jlgaddis 11y ago
Server-side you can see the "full config" sshd uses: $ /usr/sbin/sshd -T -f /etc/ssh/sshd_config Modify, if necessary, to point to the location of your `sshd` and configuration file.
JimmaDaRustla 11y ago
I came here to ask exactly this, and also why this feature isn't documented. Sounds like a nice little exploit.

Does it strike anyone else as bizarre / poor form for an experimental feature to be enabled by default in OpenSSH, which is normally very conservative with option defaults?

agwa 11y ago

What's more, it was not documented in the ssh_config(5) man page. If it had been, I probably would have disabled it long ago when hardening my SSH config. Time to head to the source to look for other undocumented options... Update: my findings are here (scroll to bottom for the upshot): https://gist.github.com/AGWA/e92d4f5343be1f7a941d https://gist.github.com/AGWA/e92d4f5343be1f7a941d UseRoaming is the only one to be concerned about. There are many other undocumented options, but they're all aliases for a documented option or are deprecated/unsupported.

noja 11y ago
Please report back what you find!
ryanlol 11y ago
https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c https://github.com/openssh/openssh-portable/blob/e6c85f8889c... Here you go
- ryanlol 11y ago
  Actually, I quickly generated a list of undocumented config options: http://sprunge.us/QDSE http://sprunge.us/QDSE Edit: Fixed version http://sprunge.us/LVYB http://sprunge.us/LVYB
  - vesinisa 11y ago
    most of those seem to be documented: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/ssh_config.5?query=ssh_config&sec=5 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/... I did a quick comparison between the OpCodes enum and the latest man page, and `UseRoaming` is the only real undocumented option.
    - ryanlol 11y ago
      Weird, my manpages didn't get updated despite man claiming they did. Fixing that now. Edit: fixed, http://sprunge.us/LVYB http://sprunge.us/LVYB
  - jlgaddis 11y ago
    I believe "kerberosauthentication" and "rhostsauthentication" are documented as well. I'd check the "official" OpenBSD man page instead of whatever you have on your system. Regardless, thanks.
    - ryanlol 11y ago
      Neither of those are mentioned on the latest manpage from git.
    - agwa 11y ago
      In the latest OpenSSH-portable source, those are considered "unsupported" and "deprecated," respectively (which means they're ignored, essentially). See https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undocumented_client_options https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undoc... as well as the source https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c#L191 https://github.com/openssh/openssh-portable/blob/e6c85f8889c...

drzaiusapelord 11y ago

It just sounds like a big code-base fuckup. They more or less admit it: "Server side was disabled/gutted for years already, but this aspect was surprisingly forgotten." Sounds like this was put in at one time, forgotten about, and the code lingered for a long time until someone pointed it out. SSH as a protocol is pretty crazy. Everyone loves it, but its a lot of things in one, which ironically goes against the unix philosophy. Its a remote terminal, a file transfer server, a network tunnel server, a socks server, etc. There's a lot of stuff in there and I imagine difficult to work with sometimes. No word if this is enabled in Putty, but I imagine it is if its using openssh libraries.

jlgaddis 11y ago
Pretty sure this is OpenSSH only. PuTTY and SecureCRT, at least, are reported not to be affected.
- larrymcp 11y ago
  We use WinSCP also, a file copying utility; it would be useful to know whether that's affected if anybody has that info.
  - voltagex_ 11y ago
    Last time I looked WinSCP used PuTTY components or a fork. Would appreciate additional verification of this, though.
alanpost 11y ago
Given that this exploit happens during capability negotiation (or whatever SSH calls that part of the protocol), it also cannot be mitigated via pledge[2], which is where OpenBSD has been focusing a lot of attention. This is an unusual stumble for the OpenBSD team. Client-side privsep support, if such a thing existed, might mitigate attacks like this. As it stands protecting against exploits of this type wasn't even on the hardening roadmap. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/...

jlgaddis 11y ago

Server-side you can see the "full config" sshd uses: $ /usr/sbin/sshd -T -f /etc/ssh/sshd_config Modify, if necessary, to point to the location of your `sshd` and configuration file.

JimmaDaRustla 11y ago

I came here to ask exactly this, and also why this feature isn't documented. Sounds like a nice little exploit.