3 ms·

> If the SSH process dies or is restarted for any reason, the user level process can harvest usernames and passwords. That wouldn't work because the user level

> If the SSH process dies or is restarted for any reason, the user level process can harvest usernames and passwords. That wouldn't work because the user level process wouldn't have read access to the machine's host keys in /etc/ssh/*_key, so when things connect, they would get known_hosts warnings and nobody clicks through those

kevincox 4y ago
It is still a DoS attack. And of course SSH is usually TOFU so that isn't a strong defense. Imagine this at a company network. 1. The attacker compromises an application process on one machine and manages to get code execution. 2. They wait for SSH to restart (updates, trigger a crash, OOM?) then bind port 22. 3. Wait for some developer to connect to this machine for the first time. They (unexpectedly) see a new host key so accept it. Now if that developer has forwarding enabled you can log into other machines (probably with root/sudo access). You have just escalated your privileges from a non-root user on one machine to the entire network.