Stories
Slash Boxes
Comments

SoylentNews is people

posted by CoolHand on Monday July 27 2015, @01:22AM   Printer-friendly
from the ten-thousand-attempts dept.

Peter N. M. Hansteen writes about a bug that occurs when Pluggable Authentication Modules (PAM) are used in conjunction with OpenSSH set to keyboard-interactive. The bug first blogged about back on the 16th, which showed a way to bypass MaxAuthTries limits for certain configurations. When the bug is exploited it allows virtually unlimited tries at password authentication, good enough for brute-force password guessing. One easy way to mitigate this is to disable password authentication all together and use only keys with OpenSSH.

Mr. Hansteen tested several various systems on OpenBSD, Linux, and FreeBSD, and could only find issue with the FreeBSD box, as the others apparently had default configurations which did not allow this. The original blog does have a simple one line ssh command to test if your system is vulnerable. Fail2ban should help stop this, but may not completely mitigate depending on firewall rule setup.

Here is some more interesting info on the subject from the OpenBSD mailing list. Most comments seem to indicate that while this may be concerning it probably isn't world-shattering. Still it is something to keep in mind when hardening systems.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Interesting) by FatPhil on Monday July 27 2015, @11:34AM

    by FatPhil (863) <pc-soylentNO@SPAMasdf.fi> on Monday July 27 2015, @11:34AM (#214237) Homepage
    The unforgiveability of this is that of trusting input from an external source. Never trust any input; for openssh to have forgotten that is astounding, and amateurish. The mark-as-already-seen fix (apart from the fact that it should probably have used 1u<<i rather than 1<<i in order to access bits in an unsigned mask) should have been there right at the outset. Did noone ever think that someone might include the same string more than once, and decide what semantics that should have? Has noone ever fuzzed this code?
    --
    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
    Starting Score:    1  point
    Moderation   +1  
       Interesting=1, Total=1
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3