Live data from Hacker News

OpenSSH user enumeration

openwall.com

31–40 of 89 posts

Re: OpenSSH user enumeration

#31

Earlier quoted context omitted.

What do you mean? The email was sent from a a security research group.

To hazard a guess: it should be standard practice to use public key authentication for ssh (>= 2048 bits rsa or ecdsa), so this attack shouldn't make compromising a system any easier. Better yet, use a Yubikey or equivalent. Other commenters have mentioned this attack getting information on hosted services on the system. But, usually you can get that from a straightforward nmap or other recon tool anyway.

Without suggesting anybody should use less than 2048-bit RSA in 2018, the security margin for even 1024-bit SSH RSA user authentication is pretty good.

In SSH first every connection is encrypted (before either side knows who the other is, encryption is used already, this is the same approach taken in TLS 1.3), then the server has to authenticate to the client, and then the client authenticates to the server on behalf of a specific user.

User public key authentication is a multi-phase protocol. This would be too awkward for something like HTTP where round trip times may be appalling, but SSH is rarely used at long distances.

In phase 1 the client proposes that it can authenticate for some public key Pn, it sends this proposal to the server, and the server can either say OK, go ahead, or reject this authentication without seeing it done, on the basis that it doesn't trust Pn anyway. It can keep trying different Pn until either it runs out or the server grows tired of this nonsense and disconnects it.

Once it has an OK, in phase 2 the client signs a nonce with the private key corresponding to Pn, which the server can now verify. If the signature checks out, the authentication was successful.

This means an adversary who knows your SSH username but has nothing else would need to literally _guess_ your hypothetical 1024-bit RSA key, not just (already hard but plausibly within the grasp of a resourceful adversary) break a 1024-bit RSA public key to find the associated private key, as your client only tells authenticated servers even the _public_ key.

Aside: One thing I'm surprised I haven't seen done with this part of the SSH design is user TOFU [Trust On First Use]. Lots of home or small / non-security business SSH setups do TOFU for server authentication, sometimes with a fig leaf ("Ask Jerry in IT to tell you the SSH keys" or "The SSH server keys are pasted into this Wiki page"). But I've never seen people do TOFU for the user authentication. In a similarly lax environment why not set up new users, and then when they first connnect just accept whichever public key they offer as "their" key, set that as trusted, and from then on insist on the same key for that user ? I feel like password auth is often left enabled because people are using it for an "initial" authentication step when first setting up without yet trusting any keys - and then never remove it. With "User TOFU" they'd have no incentive to enable password authentication at all.

Re: OpenSSH user enumeration

#32
post #11

Earlier quoted context omitted.

there is an "ubuntu" user on most of my systems. I hope you find this information useful.

I know you're being facetious but, yes, I would find that information useful. Now I've just IDed the distribution I'm targeting.

This is usually in the OpenSSH version string anyway, e.g. "OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)". Guess what distro that server is running?

Re: OpenSSH user enumeration

#33

Earlier quoted context omitted.

I know you're being facetious but, yes, I would find that information useful. Now I've just IDed the distribution I'm targeting.

This is usually in the OpenSSH version string anyway, e.g. "OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)". Guess what distro that server is running?

I believe only Debian does that, out of vanity (I presume).

Re: OpenSSH user enumeration

#34
post #7
post #2

Usernames are not a secret, passwords are a secret.

Does anyone still use password authentication on servers that actually matter? I mean, I'm just a hobbyist, and I switched to keys several years ago. Basically, I just use root and user, because anything else unnecessarily adds information.

Yes. Large corporate networks often still have (some) production systems that allow password-based authentication. I don't know how widespread it still is, but I still encounter it frequently at clients (which may be a skewed sample).

Just to be sure: PasswordAuthentication does not need to be enabled for the PoC to work, and username testing can also be used for software enumeration by testing for common/default non-SSH users, .g. "_tor", "debian-tor", etc. (I apologize for repeating here what I also stated in other comments in this thread, but this aspect should not be overlooked.)

Re: OpenSSH user enumeration

#35
post #29
post #6

Earlier quoted context omitted.

Are you willing to send me a list of all your usernames on all your systems?

List of all users allowed to use SSH on my systems: - root - user - ansible_conf_daemon_user End of List. It's all containers so IDGAF and I use pubkey authentication on each user.

For non trivial environments with audit requirements this is not an option.

Running all software under the same uid is also usually best avoided, you'll always have data at rest somewhere (which needs to be backed up, access controlled, and so on).

Re: OpenSSH user enumeration

#37
post #35
post #29

Earlier quoted context omitted.

List of all users allowed to use SSH on my systems: - root - user - ansible_conf_daemon_user End of List. It's all containers so IDGAF and I use pubkey authentication on each user.

For non trivial environments with audit requirements this is not an option. Running all software under the same uid is also usually best avoided, you'll always have data at rest somewhere (which needs to be backed up, access controlled, and so on).

Of course there is other users but they aren't configured for SSH via AllowUser.

Additionally most of those are containers where running it all as the same UID isn't a problem.

Re: OpenSSH user enumeration

#38
post #5

Earlier quoted context omitted.

They are useful though. If you check a bunch of usernames from a person leak and find matches, you got a password to try.

A correct sshd_config includes: PasswordAuthentication no

To disable logging in with password you also need:

  ChallengeResponseAuthentication no

Re: OpenSSH user enumeration

#39
post #7
post #2

Usernames are not a secret, passwords are a secret.

Does anyone still use password authentication on servers that actually matter? I mean, I'm just a hobbyist, and I switched to keys several years ago. Basically, I just use root and user, because anything else unnecessarily adds information.

Can somebody please explain to me why exactly using good passwords and allowing root login is bad security? Every SSH security tutorial mentions those but they never mention the reasons.

If somebody hacked into my password manager and managed to steal the root user's password then they could do the same with my private key. Where is the difference?

Also, if somebody hacked into a non-root administrative account, they can just use sudo to elevate. What makes disabling root login more secure?

Re: OpenSSH user enumeration

#40
post #7

Earlier quoted context omitted.

Does anyone still use password authentication on servers that actually matter? I mean, I'm just a hobbyist, and I switched to keys several years ago. Basically, I just use root and user, because anything else unnecessarily adds information.

Can somebody please explain to me why exactly using good passwords and allowing root login is bad security? Every SSH security tutorial mentions those but they never mention the reasons. If somebody hacked into my password manager and managed to steal the root user's password then they could do the same with my private key. Where is the difference? Also, if somebody hacked into a non-root administrative account, they…

1. A "good" key safe for the forseeable future would have around 256 effective security bits. To get a key that strong, your password would have to be (speaking VERY generously here) 40 characters long and truly random.

2. When using real password authentication, connecting to a compromised server results in a disclosure of your password. When using challenge-response authentication, it does not. Note that correctly-configured OpenSSH uses challenge-response even for password-based methods. Incorrectly configured SSH will send passwords over the wire.

Post reply on HN