5 ms·

What can be learned here and improve? - systemd and libsystemd is an absolute mess. What are the alternatives at this point? - what processes can be improved

by xyst 3y ago

What can be learned here and improve? - systemd and libsystemd is an absolute mess. What are the alternatives at this point? - what processes can be improved for Linux distributions to catch malicious actors trying to push back doors into the ecosystem? - is there a dependency graph that would show how many programs use a specific utility library? Might aid in finding other possible attempts to backdoor

looperhacks 3y ago
> systemd and libsystemd is an absolute mess how? Because they link against a third-party library? > is there a dependency graph that would show how many programs use a specific utility library Agree, important topic > is there a dependency graph that would show how many programs use a specific utility library Depends on the distro, but your package manager should be able to do that. On a global scale, that's likely impossible, because there's no true register of how programs are linked - in fact, the inclusion of libsystemd was distro-specific
- metalforever 3y ago
  Because its a very large monolithic piece of code, which causes issues with trying to audit it / brings it code that might not be necessary / increases attack surface
  - LtWorf 3y ago
    Well said… by someone who has clearly never opened the sources of systemd.
TacticalCoder 3y ago
> What can be learned here and improve? - which firewalling setups would still prevent that exploit from working (like whitelisting IP addresses or blocks allowed to SSH in or, drumroll..., port-knocking). I don't use port-knocking but now I really wonder what's going to be the argument against port-knocking. Is it really security theatre in the fact of the rube-goldberg too-big-to-ever-be-secure systemd, loading totally unrelated code for a freaking ssh server? This method of operating was just proved to be a security nightmare. And people who are using port-knocking (or IP whitelisting) were/are totally fine versus these kinds of exploits. So, yup, today I really want to read what people dismissing port-knocking as security theatre have to say (even though I, myself, don't use port-knocking: but I do use IP whitelisting in firewall rules to decide which IPs can SSH in).
- unethical_ban 3y ago
  Port knocking isn't security theater, in that it is a layer of obfuscation and (weak) authentication. I consider it another weak "noise decreased" like moving SSH to a nonstandard port. Your sshd logs will be quieter making analysis easier.
metalforever 3y ago
There are a lot of alternatives to systemd

by xyst 3y ago

looperhacks 3y ago

> systemd and libsystemd is an absolute mess how? Because they link against a third-party library? > is there a dependency graph that would show how many programs use a specific utility library Agree, important topic > is there a dependency graph that would show how many programs use a specific utility library Depends on the distro, but your package manager should be able to do that. On a global scale, that's likely impossible, because there's no true register of how programs are linked - in fact, the inclusion of libsystemd was distro-specific

metalforever 3y ago
Because its a very large monolithic piece of code, which causes issues with trying to audit it / brings it code that might not be necessary / increases attack surface
- LtWorf 3y ago
  Well said… by someone who has clearly never opened the sources of systemd.

TacticalCoder 3y ago

> What can be learned here and improve? - which firewalling setups would still prevent that exploit from working (like whitelisting IP addresses or blocks allowed to SSH in or, drumroll..., port-knocking). I don't use port-knocking but now I really wonder what's going to be the argument against port-knocking. Is it really security theatre in the fact of the rube-goldberg too-big-to-ever-be-secure systemd, loading totally unrelated code for a freaking ssh server? This method of operating was just proved to be a security nightmare. And people who are using port-knocking (or IP whitelisting) were/are totally fine versus these kinds of exploits. So, yup, today I really want to read what people dismissing port-knocking as security theatre have to say (even though I, myself, don't use port-knocking: but I do use IP whitelisting in firewall rules to decide which IPs can SSH in).

unethical_ban 3y ago
Port knocking isn't security theater, in that it is a layer of obfuscation and (weak) authentication. I consider it another weak "noise decreased" like moving SSH to a nonstandard port. Your sshd logs will be quieter making analysis easier.

metalforever 3y ago

There are a lot of alternatives to systemd