[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANnLRdgMaDewcaKVq9OdiNBq-AsF-JchQsMLY0xuY033P6j=rw@mail.gmail.com>
Date: Wed, 3 Apr 2024 09:38:08 -0400
From: Stephen John Smoogen <smooge@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: xz backdoor prevention using hosts.deny?
On Wed, 3 Apr 2024 at 09:07, Nick Sal <specialroumpa@...ton.me> wrote:
> Hi,
>
> Assume we filter SSH access only to a public domain subnet using the files
> hosts.{deny,allow} as seen below.
> Would this prevent an attack if a malicious payload was *not* sent from
> the allowed subnet?
> Trying to figure out if an attack like this was still possible, for the
> few days in March the backdoor was active and undetected in rolling distros
> (e.g. debian testing).
>
> /etc/hosts.deny: sshd: ALL
> /etc/hosts.allow: sshd: "a_subnet"
>
>
Does Debian still link hosts.allow/hosts.deny libwrapper with sshd? [or
does sshd pull it in from another source?] I know some distributions no
longer use this method to limit controls.
> Moreover, allowing only public-key authentication for SSH does not help,
> isn't this right?
>
>
Most likely not because the code is looking for a specific publickey to
unlock its payload.
> Regards,
> Nick
>
>
--
Stephen J Smoogen.
Let us be kind to one another, for most of us are fighting a hard battle.
-- Ian MacClaren
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
