Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by tptacek | Hacker News Reader

Parent Full thread

tptacek·

Yes.

View on HN

No.

How? Show me how can I, remotely:

- Login with no SSH account

- Enable SSH

- Change PF rules

- Change the smtpd config

- Enable radiusd/ldapd without being root

- Running Xenocara's xlock when is not available on servers and I have no permissions

This is an extremely silly set of conditions to attach to "remote hole". You can litigate it, and maybe win the argument, but you're just bold-facing the asterisk that was already next to that already-tortured claim.

You mean, overriding defaults as conditions to get a remote hole?

Can you exploit a bare OpenBSD install by default remotely, yes or not?

Everything else is bullshit.

This is a bit like whether Magneto can escape the Plastic Prison (yes or no) without Logan traveling back in time and altering the timeline.

Or Trunks killing Cell.

Security is not Boolean

By default you can only set two service settings: Enabling sshd, or not.

And sshd is, by default:

- not exploitable by this bug

- PF rules are not set for incoming connections

The X issue. By default:

- PF doesn't accept any connection to X ports to

anything not coming from lo0, localhost interface

Smtpd. By default:

- it just listens on localhost

- there is no forwarding

- PF rules aren't enabled

Show me, as the owner of the openbsd server, how to change the default configuration to suit a purpose that exceeds the very limited set of services enabled.

Reply on news.ycombinator.com