Hacker News Reader

Hacker News

Comment by direwolf20 | Hacker News Reader

Parent Full thread

direwolf20

Literally how else is a remote login daemon supposed to work though?

View on HN

1. Start with root to bind the port below 1024.

2. give up root because you don't need it any further.

3. Only accept non-root logins

4. when a user creates a session, if they need root within the session they can obtain it via sudo or su.

That still needs a way to change users, and OpenSSH already has privilege separation. That hardens the process somewhat to reduce the amount of code running in the process which can change the uid for a session but fundamentally something needs permission to call setuid() or the equivalent.

Yes, but changing users is a function of the shell (or maybe more specifically /usr/bin/login), not the SSH daemon.

Yea, but then we’ve recreated this CVE which is caused by calling login(1) unsafely. The point was that the person I was replying to misunderstood the problem and largely seemed to be conflating telnetd with OpenSSH.

I'm not sure that you need root because of the port - I think login itself needs to run as root, otherwise it cant login to anything other than the account its running under.

You still need to have privileges to become the userid of the user logging in. Openssh does do privsep, but you still need a privileged daemon.

Congratulations, you've created a server that lets people have shells running as the user running telnetd.

You presumably want them to run as any (non root) user. The capability you need for that, to impersonate arbitrary (non-root) users on the system, is pretty damn close to being root.

Well obviously each user just needs to run their own telnet daemon, on their own port of course.

The remote daemon has its own account and is given a privilege that allows it to connect a network socket to a pseudo terminal.

Any breach of the daemon will still give access to a system that can approve/deny user logins. Breaching the daemon therefore allows permission escalation, because you can simply jump to an account. Chain with any local vuln of your choice to completely own the box.

It doesn't matter what user it is running as.

If this was so easy to deal with, someone would have done it. Instead, we get endless HN comments about people that act like they can do better but never submit a PR.

Breaching the daemon only allows for the attacker to get access to the login. User accounts should still be secured requiring authentication.

>If this was so easy to deal with, someone would have done it.

Sadly this is not the case. There is a lot of inertia towards solutions like ssh or sudo. It may be easy to delete them, but actually getting such a changed accepted is no trivial task.

> Breaching the daemon only allows for the attacker to get access to the login

Yes, but potentially any login. See the problem? If you compromise the gatekeeper, you are now the keymaster. Or whatever :)

I'll admit it is still problematic. But at least there is only 1 gatekeeper instead of 2.

How is that better?

You can focus all of your energy into strengthening and testing a single point of the system instead of having to do it for many.

You're grasping for straws a bit here. This is already done for ssh as the defacto remote access mechanism for a very long time.

Those are already unprivileged operations, but how does it start the initial process in that terminal with the correct privileges for a different user?

The kernel could authenticate the user before starting it.

How does it do that?

There are many ways from passkeys to SAML. Though for complex methods we may want a dedicated services outside the kernel.

How does that service get launched with the privilege to switch to any user?

The kernel can start a process with any user it wants. The user doesn't have to switch during the process's life.

Yes, but that has to happen somewhere. OpenSSH already uses privilege separation to limit the scope of the code which requests the kernel set the user for the process for the session. Can you say where precisely you think that should happen instead? If you’re saying it should delegate to login(1) it would be useful to discuss in detail what you see OpenSSH doing which is weaker because otherwise that seems like it’s just recreating chances for this CVE without meaningfully improving a hardened implementation.

Reply on news.ycombinator.com