oss-security - Re: OpenSSH key blacklisting

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Sat, 17 May 2008 16:46:30 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: Solar Designer <solar@...nwall.com>
Subject: Re: OpenSSH key blacklisting

On Friday 16 May 2008, Solar Designer wrote:
> Thanks for the "bug" reference.  FWIW, the shell script in this
> comment is vulnerable itself, in more than one way:
>
> 	http://bugs.gentoo.org/show_bug.cgi?id=221759#c9
>
> For example, it lets a user have any other user's or root's
> authorized_keys removed, by replacing .ssh with a symlink to someone
> else's .ssh directory.  

Do you mean the race condition between finding and removing the key? 
Otherwise, I cannot see how to have someone else's removed.


> > I assume whichever version has the acceptance of the OpenSSH
> > upstream is what most of us would be willing to go with. Did you
> > discuss either blacklist format with them already?
>
> Yes, very briefly.  They don't intend to implement key blacklisting.

That's not too helpful for our case.
Do you have a patch to propose, implementing your idea? There has been 
approval of your idea inside Gentoo's hardened team.


Robert


[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.