Comment on Update all your stuff, NOW - again.

tapdattl@lemmy.world ⁨1⁩ ⁨hour⁩ ago

• HelloRoot@lemy.lol ⁨1⁩ ⁨hour⁩ ago

  Yep

  original

  • smiletolerantly@awful.systems ⁨1⁩ ⁨hour⁩ ago

    NO! Exactly the opposite, that is the problem. Key-only is a prerequisite for this.

    original

    • HelloRoot@lemy.lol ⁨24⁩ ⁨minutes⁩ ago

      Bottom of the page says what to do and gives 2 options to mitigate:

      # update. openssh 10.6p2 fixes it.
      $ apk upgrade openssh
      
      # can't update yet? turn password logins off.
      $ echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/00-no-passwords.conf
      $ rc-service sshd restart
      

      So if you disable password auth and only allow key auth, then you are unaffected (safe).

      The introis a bit confusing but it means that if you have password auth on - then even if your regular ssh login requires a key, you are not safe.

      original

      • smiletolerantly@awful.systems ⁨7⁩ ⁨minutes⁩ ago

        Ah. Thanks for the correction. The intro + where I originally learned this from made me overreact a bit, it seems.

        original
• smiletolerantly@awful.systems ⁨1⁩ ⁨hour⁩ ago

  NO! Exactly the opposite, that is the problem. Key-only is a prerequisite for this.

  original

  • cecilkorik@piefed.ca ⁨46⁩ ⁨minutes⁩ ago

    I think there is some confusion and potential for misinformation here. SSH in key-only mode (common configuration) protects you from this problem, because it never accepts or even attempts any passwords at all, regardless of length. SSH in password-allowed mode with at least one user who might be a key-only USER by merit of having a password hash of “*” (not a valid password hash) is a prerequisite for this. That is a very different and very common thing, as most systems come with at least one key-only user by default. But gaining access to that user with an incorrect, invalid password still requires having passwords enabled at all.

    To be clear: Password access enabled is a prerequisite, and by extension, password access disabled (key-only) prevents this.

    The website you linked clearly defines that all of these conditions must be true for you to be vulnerable, and as far as I can tell, it is exactly correct:

    is your sshd running on musl? (alpine, openwrt, buildroot, yocto)
    is it not using pam? alpine’s openssh-server doesn’t by default, or maybe you set UsePAM no
    are password logins still on? they are by default
    is there an account with just * as its password? key-only users, ldap users, root on alpine
    and some other account with a real password?

    then that * account takes any password between 257 and 1024 characters

    The * account which they suggest potentially being “key only” is the prerequisite you are talking about, but having SSH itself key-only (which is best practice anyway) prevents the attack entirely.

    original

    • smiletolerantly@awful.systems ⁨6⁩ ⁨minutes⁩ ago

      Ah. Thanks for the correction. The intro + where I originally learned this from made me overreact a bit, it seems.

      original
  • DrakiaXYZ@lemmy.ca ⁨41⁩ ⁨minutes⁩ ago

    The linked article literally says you need password login enabled at the ssh level. The account however needs to not have a password set

    original

    • smiletolerantly@awful.systems ⁨6⁩ ⁨minutes⁩ ago

      Ah. Thanks for the correction. The intro + where I originally learned this from made me overreact a bit, it seems.

      original