4 ms·

Interesting. Does ssh-agent(1) also make you afraid? http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/ssh-agent.1 http://www.openbsd.org/cgi-bin/man

by scbrg 11y ago

Interesting. Does ssh-agent(1) also make you afraid? http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/ssh-agent.1 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...

daurnimator 11y ago
The default settings are bad for the majority of sysadmins. See http://unixwiz.net/techtips/ssh-agent-forwarding.html#sec http://unixwiz.net/techtips/ssh-agent-forwarding.html#sec With the ssh-agent defaults, if I have root/sudo access on a server you are logged into with ssh on, I practically have free use of your private SSH key. I use gpg's ssh-agent emulation (See the man page for gpg-agent under --enable-ssh-support), and store my ssh private key on my yubikey. With this setup, the yubikey's light flashes when something wants to use my private key, and you can just touch the button on it to approve.
- LinuxBender 11y ago
  That is bad. Even worse was a default that the OpenSSH developers quietly added and folks have become addicted to. It also enables me to phish any company and get access to all their servers, bypassing 2FA with almost no logging. Some time read up on SSH Multiplexing. The default is MaxSessions 10. You auth once, my phishing exercise can utilize your session to connect anywhere you have connected. Nothing will show up in syslog. I can take care of `lastlog` entries since folks cache sudoer privs for so long; or in some cases, don't even require a pw. I will set up a github with a working example of how to set up a backdoor leveraging ssh multiplexing. I got the idea from a coworker (whitehat) that used a simple ruby script to completely pwn my system. The cool part is, it doesn't require exploiting anything beyond the helpful developer or sysadmin.
  - Piskvorrr 11y ago
    Does that boil down to "if root is malicious, Bad Things can happen to other users"? Well...duh. Why not keylog all terminals instead of fumbling with ssh-agent and connection multiplexing?
    - daurnimator 11y ago
      No. The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine). ssh-agent is like temporarily uploading your private key to each remote server logged into.
      - everythingcli 11y ago
        Do you have any material I can read up on to this?
      - Piskvorrr 11y ago
        In the same way, a helicopter is like a hot-air baloon. Except it's mostly not - the comparison is very much misleading. The GP is mixing together SSH agent with agent forwarding, and private keys with key signing by agent. There is last week's CVE-2016-0777, which is a vulnerability that enables the exploit you are describing, but in a properly patched configuration, without agent forwarding (nb: this feature is off by default), this is not the case. Same with connection multiplexing: off by default (for good reasons). In other words, either a) please explain how that would work, or b) please stop spreading FUD.
        Piskvorrr 11y ago
        An illustrated explanation how ssh-agent is not like copying private key anywhere. http://www.unixwiz.net/techtips/ssh-agent-forwarding.html http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
        LinuxBender 11y ago
        ssh multiplexing is ON by default. The default is `MaxSessions 10`. Unless you have `MaxSessions 1` in your config, then you have it enabled in your environment. If you have 2FA and SOC1/SOC2 controls, then technically you are out of compliance.
- everythingcli 11y ago
  > If a root user is able to convince his ssh client to use another user's agent, root can impersonate that user on any remote system which authorizes the victim user's public key. Yes, root can also simply `su - user` and then do all stuff you do. But you should also not put YOUR private keys on a system that has a root user who should not have access YOUR keys.
  - daurnimator 11y ago
    (copying from https://news.ycombinator.com/item?id=10943166 https://news.ycombinator.com/item?id=10943166) > The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine). > ssh-agent is like temporarily uploading your private key to each remote server logged into. That is very different (and much more common) than an attacker having root on your local machine.

by scbrg 11y ago

Interesting. Does ssh-agent(1) also make you afraid? http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/ssh-agent.1 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...

daurnimator 11y ago

The default settings are bad for the majority of sysadmins. See http://unixwiz.net/techtips/ssh-agent-forwarding.html#sec http://unixwiz.net/techtips/ssh-agent-forwarding.html#sec With the ssh-agent defaults, if I have root/sudo access on a server you are logged into with ssh on, I practically have free use of your private SSH key. I use gpg's ssh-agent emulation (See the man page for gpg-agent under --enable-ssh-support), and store my ssh private key on my yubikey. With this setup, the yubikey's light flashes when something wants to use my private key, and you can just touch the button on it to approve.

LinuxBender 11y ago
That is bad. Even worse was a default that the OpenSSH developers quietly added and folks have become addicted to. It also enables me to phish any company and get access to all their servers, bypassing 2FA with almost no logging. Some time read up on SSH Multiplexing. The default is MaxSessions 10. You auth once, my phishing exercise can utilize your session to connect anywhere you have connected. Nothing will show up in syslog. I can take care of `lastlog` entries since folks cache sudoer privs for so long; or in some cases, don't even require a pw. I will set up a github with a working example of how to set up a backdoor leveraging ssh multiplexing. I got the idea from a coworker (whitehat) that used a simple ruby script to completely pwn my system. The cool part is, it doesn't require exploiting anything beyond the helpful developer or sysadmin.
- Piskvorrr 11y ago
  Does that boil down to "if root is malicious, Bad Things can happen to other users"? Well...duh. Why not keylog all terminals instead of fumbling with ssh-agent and connection multiplexing?
  - daurnimator 11y ago
    No. The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine). ssh-agent is like temporarily uploading your private key to each remote server logged into.
    - everythingcli 11y ago
      Do you have any material I can read up on to this?
    - Piskvorrr 11y ago
      In the same way, a helicopter is like a hot-air baloon. Except it's mostly not - the comparison is very much misleading. The GP is mixing together SSH agent with agent forwarding, and private keys with key signing by agent. There is last week's CVE-2016-0777, which is a vulnerability that enables the exploit you are describing, but in a properly patched configuration, without agent forwarding (nb: this feature is off by default), this is not the case. Same with connection multiplexing: off by default (for good reasons). In other words, either a) please explain how that would work, or b) please stop spreading FUD.
      - Piskvorrr 11y ago
        An illustrated explanation how ssh-agent is not like copying private key anywhere. http://www.unixwiz.net/techtips/ssh-agent-forwarding.html http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
      - LinuxBender 11y ago
        ssh multiplexing is ON by default. The default is `MaxSessions 10`. Unless you have `MaxSessions 1` in your config, then you have it enabled in your environment. If you have 2FA and SOC1/SOC2 controls, then technically you are out of compliance.
everythingcli 11y ago
> If a root user is able to convince his ssh client to use another user's agent, root can impersonate that user on any remote system which authorizes the victim user's public key. Yes, root can also simply `su - user` and then do all stuff you do. But you should also not put YOUR private keys on a system that has a root user who should not have access YOUR keys.
- daurnimator 11y ago
  (copying from https://news.ycombinator.com/item?id=10943166 https://news.ycombinator.com/item?id=10943166) > The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine). > ssh-agent is like temporarily uploading your private key to each remote server logged into. That is very different (and much more common) than an attacker having root on your local machine.