4 ms·

Will this all work by default? E.g. other than simply being enabled by default (looks like it is), does OpenSSH automatically generate new host keys every time

by cnst 12y ago

Will this all work by default? E.g. other than simply being enabled by default (looks like it is), does OpenSSH automatically generate new host keys every time the new host key algorithm is started being supported? If it's system-dependent, e.g. rc(8)-based, http://mdoc.su/o/rc.8 http://mdoc.su/o/rc.8, how do most systems behave here? Also, looking at the code, http://bxr.su/o/usr.bin/ssh/clientloop.c#client_input_hostkeys http://bxr.su/o/usr.bin/ssh/clientloop.c#client_input_hostke... will be calling http://bxr.su/o/usr.bin/ssh/hostfile.c#hostfile_replace_entries http://bxr.su/o/usr.bin/ssh/hostfile.c#hostfile_replace_entr..., doesn't it mean that it's quite easy for the attacker who can actually do MitM and has indeed obtained the keys, to effectively cause a race condition, and deprecate the non-exploited spare keys? Together with the existing key that has been compromised? In such a scenario, it sounds like the attacker could effectively replace the key they compromised (plus all the spare keys) with their own brand new key, which will then make the ssh client generate warnings should it try to connect to an sshd without MitM attack going on. I'm kinda confused here -- is the possibility of such trick-playing not considered a big deal?

zdw 12y ago
I think the point here is changing from older RSA and DSA keys to newer ECDSA and ED25519 keys. Most of the issue you're bringing up a prerequisite of obtaining and/or compromising the the target host's private keys, at which point most of the other attacks have little value - what's the point of MitM-ing a host if the SSH host keys only apply to that specific host, and you already have root on it? The only issue would be if you could take advantage of a flaw in the ssh client and put arbitrary content in their ~/.ssh/known_hosts file, but I'm betting this would be pretty easy to mitigate.

by cnst 12y ago

zdw 12y ago

I think the point here is changing from older RSA and DSA keys to newer ECDSA and ED25519 keys. Most of the issue you're bringing up a prerequisite of obtaining and/or compromising the the target host's private keys, at which point most of the other attacks have little value - what's the point of MitM-ing a host if the SSH host keys only apply to that specific host, and you already have root on it? The only issue would be if you could take advantage of a flaw in the ssh client and put arbitrary content in their ~/.ssh/known_hosts file, but I'm betting this would be pretty easy to mitigate.