Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 Apr 2024 09:38:08 -0400
From: Stephen John Smoogen <>
Subject: Re: xz backdoor prevention using hosts.deny?

On Wed, 3 Apr 2024 at 09:07, Nick Sal <> wrote:

> Hi,
> Assume we filter SSH access only to a public domain subnet using the files
> hosts.{deny,allow} as seen below.
> Would this prevent an attack if a malicious payload was *not* sent from
> the allowed subnet?
> Trying to figure out if an attack like this was still possible, for the
> few days in March the backdoor was active and undetected in rolling distros
> (e.g. debian testing).
> /etc/hosts.deny:  sshd: ALL
> /etc/hosts.allow: sshd: "a_subnet"

Does Debian still link hosts.allow/hosts.deny libwrapper with sshd? [or
does sshd pull it in from another source?] I know some distributions no
longer use this method to limit controls.

> Moreover, allowing only public-key authentication for SSH does not help,
> isn't this right?
Most likely not because the code is looking for a specific publickey to
unlock its payload.

> Regards,
> Nick

Stephen J Smoogen.
Let us be kind to one another, for most of us are fighting a hard battle.
-- Ian MacClaren

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.