5 ms·

Are you willing to send me a list of all your usernames on all your systems?

• mirimir 8y ago
  Sure. It's root and user, on everything :)
  • ddtaylor 8y ago
    Does that mean that `wc -l /etc/passwd` is just two?
    • daurnimator 8y ago
      No. There will be plenty of system user. But they do not have SSH access permitted.
      • tjoff 8y ago
        It doesn't matter if ssh access is permitted.
        • mirimir 8y ago
          So how is an attacker going to access the machine?
          • tjoff 8y ago
            If a certain account is present then the attacker might know a certain service is running and then target that. Might also reveal the purpose of the machine (oh, this is probably the build server) or who is managing it.
            • mirimir 8y ago
              Nothing crucial should be directly accessible from the Internet.
              • tjoff 8y ago
                Indirectly then, or, the publicly facing servers are crucial enough. It is information leakage, not the end of the world but it can potentially be helpful for an attacker.
• brodsky 8y ago
  there is an "ubuntu" user on most of my systems. I hope you find this information useful.
  • Someone1234 8y ago
    I know you're being facetious but, yes, I would find that information useful. Now I've just IDed the distribution I'm targeting.
    • thaumaturgy 8y ago
      A disappointing number of servers happily give away this information in their http response headers. For those that don't, `nmap -O` will sometimes do the trick.
      • Someone1234 8y ago
        nmap's OS detection won't normally tell you the distribution, only the OS (and maybe kernel version).
    • blattimwind 8y ago
      This is usually in the OpenSSH version string anyway, e.g. "OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)". Guess what distro that server is running?
      • eahman00 8y ago
        I believe only Debian does that, out of vanity (I presume).
        • jwilk 8y ago
          https://salsa.debian.org/ssh-team/openssh/raw/master/debian/patches/package-versioning.patch https://salsa.debian.org/ssh-team/openssh/raw/master/debian/... Subject: Include the Debian version in our identification This makes it easier to audit networks for versions patched against security vulnerabilities. It has little detrimental effect, as attackers will generally just try attacks rather than bothering to scan for vulnerable-looking version strings. (However, see debian-banner.patch.)
• zaarn 8y ago
  List of all users allowed to use SSH on my systems: - root - user - ansible_conf_daemon_user End of List. It's all containers so IDGAF and I use pubkey authentication on each user.
  • xorcist 8y ago
    For non trivial environments with audit requirements this is not an option. Running all software under the same uid is also usually best avoided, you'll always have data at rest somewhere (which needs to be backed up, access controlled, and so on).
    • zaarn 8y ago
      Of course there is other users but they aren't configured for SSH via AllowUser. Additionally most of those are containers where running it all as the same UID isn't a problem.
      • xorcist 8y ago
        User ids without login privileges can be just as interesting to enumerate. Containerization isn't really relevant to protecting data, as you'd normally find data volumes and backups attached.
        • zaarn 8y ago
          Well, it would but the exposed containers don't have any non-default users. Plus, this is LXC, not Docker. There is no data volumes or backups attached. Backups are shipped to an append only server via SSH tunnel with low privileges, which also doesn't have nonstandard users setup.