oss-security - xz backdoor prevention using hosts.deny?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <loqt-RGEN6MMP_6J6pm7KJN3UgHgOBQ3NLoF3NsdmxQhyJrFIS0XYItBeLNZeSMliq69Lw8ogw3rnIW3BZEqCIHQQSFq307cqsyIt7dcocE=@proton.me>
Date: Wed, 03 Apr 2024 03:31:15 +0000
From: Nick Sal <specialroumpa@...ton.me>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: xz backdoor prevention using hosts.deny?

Hi,

Assume we filter SSH access only to a public domain subnet using the files hosts.{deny,allow} as seen below.
Would this prevent an attack if a malicious payload was *not* sent from the allowed subnet?
Trying to figure out if an attack like this was still possible, for the few days in March the backdoor was active and undetected in rolling distros (e.g. debian testing).

/etc/hosts.deny:  sshd: ALL
/etc/hosts.allow: sshd: "a_subnet"

Moreover, allowing only public-key authentication for SSH does not help, isn't this right?

Regards,
Nick

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.