[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <42bf95dbef6e44d416c030ff6dad7b6806f54cbf.camel@sec.16bits.net>
Date: Mon, 08 Apr 2024 02:31:38 +0200
From: Ángel <oss-security@....16bits.net>
To: oss-security@...ts.openwall.com
Subject: Re: xz backdoor prevention using hosts.deny?
On 2024-04-03 at 03:31 +0000, Nick Sal wrote:
> Hi,
>
> Assume we filter SSH access only to a public domain subnet using the
> files hosts.{deny,allow} as seen below.
> Would this prevent an attack if a malicious payload was *not* sent
> from the allowed subnet?
> Trying to figure out if an attack like this was still possible, for
> the few days in March the backdoor was active and undetected in
> rolling distros (e..g. debian testing).
>
> /etc/hosts.deny: sshd: ALL
> /etc/hosts.allow: sshd: "a_subnet"
If your sshd uses libwrap, blocking access except from that subnet
(I would check it is indeed doing what you expect, by trying from an
external ip) then yes, it would protect from that.
The libwrap filtering happens before the exchange identification.
>
> Moreover, allowing only public-key authentication for SSH does not
> help, isn't this right?
Right. It doesn't help in this case, since the backdoor happens at the
preauth phase, when it would be validating the provided public key
(certificate).
Regards
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
