Hacker News Reader

> If you need ammunition to encourage your corporate IT to allow you to run the proper ssh-agent service to do your job instead of increasing your attack surface by installing PuTTY/Pageant, you could collect a list of vulnerabilities such as the one posted here...

This made me laugh :-) Grandparent is probably happy to just fly under the radar. The suggested conversation would probably play out thusly:

> IT! You idiots! Your dumb policies are forcing me to use this insecure software! Look how many vulnerabilities it has had over the years!

>> Hold up. Rewind. What's this software that you've installed?

> It's called PuTTY. And if you just change this policy I could...

>> And how insecure is it?

> Just check out all these vulnerabilities! It's probably not worse than the average, but it's unnecessary extra attack surface area that...

>> I'm going to need you to uninstall that. Now. And I'll need confirmation via email that you have done so by EOB, with your boss and the CISO on CC.

> But if you just change this boneheaded policy...

>> Now, please. We have a security incident on our hands. We can discuss policy another time. Is there anything else installed on your laptop that I should be aware of?

Actually, the corporate software repository is still pushing 0.67 or so.

I need newer PuTTY to have a capable agent.

So the rationale you can't move to Windows SSH is because you can't run ssh-agent, but you can't run a useful version anyway?

I have my own copy of putty, which I use in preference to what is offered by corporate. I upgraded it to 0.81 today.

Let me just explain my situation.

We were directed to use our new corporate SFTP instead of direct communication with our vendors and customers.

I tried direct ssh on the second account they gave us, got a shell, pulled /etc/passed, and my manager mailed it to corporate security.

We had a long talk about configuring ssh. I don't know if it helped.

> some mistakenly bad corporate policy trying to micro-manage which Windows services are allowed to run.

Actually, I'd say that's a good corporate policy.

...and this is why PAGEANT.EXE is required for Microsoft OpenSSH.

And it’s why shadow IT exists and shadow IT is why companies don’t fall apart.

It’s also why web apps are so popular and why the blackberry failed.

That bad part is on the how it is tried to be micro-managed not the idea of allowlisting Windows Services in general. There are good reasons to allowlist things like Windows Services, sure. How you micro-manage that allowlist can be bad.

Specific to this case, `ssh-agent` is a Windows Service shipped with Windows and signed by Microsoft. If your allowlist doesn't include built-in Windows services maybe your allowlist is deficient. Further specifically in this case, if you are using ssh (and/or sftp) as business tools and expecting some users to have those tools in their job workflows and processes, it really doesn't make sense not to allowlist the `ssh-agent` service so that those jobs can be performed, at least for those users doing those tasks. That should be obvious to any IT person that has used SSH ever before that having access to a reliable SSH agent is important. If your micro-management processes don't have good processes for making the right exceptions you teach your users to instead rely on the wrong loopholes, that's bad corporate policy.

(Seriously, why would you encourage users to use an out-of-date program with known vulnerabilities, a tiny bus factor, existing known fakes that are malware vectors in the wild, when you can just quickly allowlist a single Windows service, shipped by Windows, and signed by Microsoft? How can you call any such corporate policy anything but bad in this specific example?)

> If your allowlist doesn't include built-in Windows services maybe your allowlist is deficient.

Maybe. Or maybe as a matter of corporate policy you don't want your users connecting to other machines via SSH.