4 ms·
If my server doesn't have any RSA public keys in its authorized_keys, only ed25519 keys; does this backdoor just not work?
by rany_ 3y ago
If my server doesn't have any RSA public keys in its authorized_keys, only ed25519 keys; does this backdoor just not work?
- keiba 3y agoThis backdoor does not care about any of the authorisation configuration set by the user. It is executed before that step. So just make sure you are not affected.
- rany_ 3y agoIt was just that it hooks to `RSA_public_decrypt` which threw me off, I didn't really understand this backdoor much. I only have one Debian sid machine which was vulnerable and accessible via a public IPv4 ssh, I'm not sure if I should just wipe it.
- adtac 3y agoIt will still work if the connecting client offers a RSA key. The only real way to be sure it's not on your system is if your liblzma version is strictly less than 5.6.0 (first infected version): ls -al $(ldd $(which sshd) | grep lzma | awk '{ print $3 }')