6 ms·

OpenBSD – sshd(8) split into multiple binaries

bozey07 2y ago
Interesting; will this change propagate to Linux? I don't know how intertwined OpenBSD and Linux' OpenSSHes are.
- throw0101c 2y ago
  > I don't know how intertwined OpenBSD and Linux' OpenSSHes are There is only one OpenSSH, and it is developed by the OpenBSD folks and used by everyone else.
  - codetrotter 2y ago
    But the OpenSSH they have in OpenBSD is maintained in-tree I think. And then they have the portable OpenSSH that they maintain separately for other systems to use. And then changes in either are probably integrated into the other keeping them largely the same. But there surely are some features in either that are intentionally kept out of the other?
    - NekkoDroid 2y ago
      One of these is probably the recently upstream added sd_notify support, as the BSDs currently (or probably ever) dont support systemd. But the notification mechanism isn't really systemd specific, so maybe they can make use of it somehow for something, dunno.
      - throw0101c 2y ago
        https://github.com/openssh/openssh-portable/commit/08f579231cd38a1c657aaa6ddeb8ab57a1fd4f5c https://github.com/openssh/openssh-portable/commit/08f579231... ?
        NekkoDroid 2y ago
        Yes, that is what I am talking about. This has no use for it in the in-tree openssh of BSD, so it wouldn't surprise me if this specific patch is omitted from the in-tree variant.
    - throw0101c 2y ago
      > This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM). * https://github.com/openssh/openssh-portable https://github.com/openssh/openssh-portable Perhaps see specifically the "openbsd-compat" directory, otherwise I think the source tree is very close the the 'OpenBSD version': * https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/
- djmdjm 2y ago
  Yes: https://github.com/openssh/openssh-portable/commit/03e3de416ed7c34faeb692967737be4a7bbe2eb5 https://github.com/openssh/openssh-portable/commit/03e3de416...
Affric 2y ago
And OpenBSD is doing this because? (Presumably it reduces attack surface by getting exploits in the session out of the listener but does it have greater significance?)
- ainar-g 2y ago
  Privilege separation[1], most likely. If your system needs to do three things, it could either just do all of them using a single executable requiring all three permissions (thus also theoretically allowing an attacker to use it to do all three things as well) or split your system into three executables, each only having the permission to do one thing (thus reducing the amount of potential damage). [1]: https://en.wikipedia.org/wiki/Privilege_separation https://en.wikipedia.org/wiki/Privilege_separation
  - ape4 2y ago
    Yes, the main daemon needs to run as root so it can become any user. Once you're logged in you just run as a regular user.
    - crest 2y ago
      Yes and no. At least one process needs to run as root to be able to become any (other) user. It doesn't have to be the one accepting incoming connections, or the one handling user authentication and authorisation. OpenBSD already contains several examples of this e.g. OpenBGPd limits the attack surface by putting the BGP session handling (and protocol parsing) in one process running with reduced privs (dedicated user and group, chroot(), pledge()/unveil()). To communicate with the other processes the parent creates unix socket pairs to be inherited. The children also re-exec after fork() so they're re-randomised and can't be abused as oracles for the memory layout of other processes.
  - Brian_K_White 2y ago
    The last sentence in the article seems like a clue.
- m000 2y ago
jmclnx 2y ago
Nice, and seems to conform to the the rule "do one thing and do it well". And from the article, looks like more to come.
deleted 2y ago
[deleted]

Interesting; will this change propagate to Linux? I don't know how intertwined OpenBSD and Linux' OpenSSHes are.

throw0101c 2y ago
> I don't know how intertwined OpenBSD and Linux' OpenSSHes are There is only one OpenSSH, and it is developed by the OpenBSD folks and used by everyone else.
- codetrotter 2y ago
  But the OpenSSH they have in OpenBSD is maintained in-tree I think. And then they have the portable OpenSSH that they maintain separately for other systems to use. And then changes in either are probably integrated into the other keeping them largely the same. But there surely are some features in either that are intentionally kept out of the other?
  - NekkoDroid 2y ago
    One of these is probably the recently upstream added sd_notify support, as the BSDs currently (or probably ever) dont support systemd. But the notification mechanism isn't really systemd specific, so maybe they can make use of it somehow for something, dunno.
    - throw0101c 2y ago
      https://github.com/openssh/openssh-portable/commit/08f579231cd38a1c657aaa6ddeb8ab57a1fd4f5c https://github.com/openssh/openssh-portable/commit/08f579231... ?
      - NekkoDroid 2y ago
        Yes, that is what I am talking about. This has no use for it in the in-tree openssh of BSD, so it wouldn't surprise me if this specific patch is omitted from the in-tree variant.
  - throw0101c 2y ago
    > This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM). * https://github.com/openssh/openssh-portable https://github.com/openssh/openssh-portable Perhaps see specifically the "openbsd-compat" directory, otherwise I think the source tree is very close the the 'OpenBSD version': * https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/
djmdjm 2y ago
Yes: https://github.com/openssh/openssh-portable/commit/03e3de416ed7c34faeb692967737be4a7bbe2eb5 https://github.com/openssh/openssh-portable/commit/03e3de416...

And OpenBSD is doing this because? (Presumably it reduces attack surface by getting exploits in the session out of the listener but does it have greater significance?)

ainar-g 2y ago
Privilege separation[1], most likely. If your system needs to do three things, it could either just do all of them using a single executable requiring all three permissions (thus also theoretically allowing an attacker to use it to do all three things as well) or split your system into three executables, each only having the permission to do one thing (thus reducing the amount of potential damage). [1]: https://en.wikipedia.org/wiki/Privilege_separation https://en.wikipedia.org/wiki/Privilege_separation
- ape4 2y ago
  Yes, the main daemon needs to run as root so it can become any user. Once you're logged in you just run as a regular user.
  - crest 2y ago
    Yes and no. At least one process needs to run as root to be able to become any (other) user. It doesn't have to be the one accepting incoming connections, or the one handling user authentication and authorisation. OpenBSD already contains several examples of this e.g. OpenBGPd limits the attack surface by putting the BGP session handling (and protocol parsing) in one process running with reduced privs (dedicated user and group, chroot(), pledge()/unveil()). To communicate with the other processes the parent creates unix socket pairs to be inherited. The children also re-exec after fork() so they're re-randomised and can't be abused as oracles for the memory layout of other processes.
- Brian_K_White 2y ago
  The last sentence in the article seems like a clue.
m000 2y ago

jmclnx 2y ago

Nice, and seems to conform to the the rule "do one thing and do it well". And from the article, looks like more to come.

deleted 2y ago

[deleted]