OpenSSH user enumeration • Hacker News Board

Re: OpenSSH user enumeration

#41

Post by jwilk » Sun, Aug 19, 2018, 10:13 AM UTC

Borealid wrote: post #40

jakobdabo wrote: post #39

Earlier quoted context omitted.

Can somebody please explain to me why exactly using good passwords and allowing root login is bad security? Every SSH security tutorial mentions those but they never mention the reasons. If somebody hacked into my password manager and managed to steal the root user's password then they could do the same with my private key. Where is the difference? Also, if somebody hacked into a non-root administrative account, they…

1. A "good" key safe for the forseeable future would have around 256 effective security bits. To get a key that strong, your password would have to be (speaking VERY generously here) 40 characters long and truly random. 2. When using real password authentication, connecting to a compromised server results in a disclosure of your password. When using challenge-response authentication, it does not. Note that correctly-…

> Incorrectly configured SSH will send passwords over the wire.

What do you mean?

Re: OpenSSH user enumeration

#42

Post by jwilk » Sun, Aug 19, 2018, 10:22 AM UTC

eahman00 wrote: post #33

blattimwind wrote: post #32

Earlier quoted context omitted.

This is usually in the OpenSSH version string anyway, e.g. "OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)". Guess what distro that server is running?

I believe only Debian does that, out of vanity (I presume).

https://salsa.debian.org/ssh-team/openssh/raw/master/debian/...

Subject: Include the Debian version in our identification

This makes it easier to audit networks for versions patched against security vulnerabilities. It has little detrimental effect, as attackers will generally just try attacks rather than bothering to scan for vulnerable-looking version strings. (However, see debian-banner.patch.)

Re: OpenSSH user enumeration

#43

Post by shpx » Sun, Aug 19, 2018, 10:25 AM UTC

thaumaturgy wrote: post #21

mackal wrote: post #5

Earlier quoted context omitted.

They are useful though. If you check a bunch of usernames from a person leak and find matches, you got a password to try.

A correct sshd_config includes: PasswordAuthentication no

You can also use https://tinyssh.org instead of the sshd from OpenSSH. It only implements key based authentication and newer encryption algorithms. It's available on Ubuntu:

    sudo apt install tinyssh
    wget https://github.com/yourusername.keys -O ~/.ssh/authorized_keys 
    sudo systemctl enable tinysshd.socket

but it's not widely used, which makes using it risky. To my knowledge there hasn't been a formal audit. Also it doesn't implement the scp protocol, but you can use rscync over ssh

    alias scp="rsync -e ssh --progress"

Re: OpenSSH user enumeration

#44

Post by daurnimator » Sun, Aug 19, 2018, 10:39 AM UTC

ddtaylor wrote: post #12

mirimir wrote: post #8

Earlier quoted context omitted.

Sure. It's root and user, on everything :)

Does that mean that `wc -l /etc/passwd` is just two?

No. There will be plenty of system user. But they do not have SSH access permitted.

Re: OpenSSH user enumeration

#45

Post by simias » Sun, Aug 19, 2018, 10:50 AM UTC

mirimir wrote: post #7

jarfil wrote: post #2

Usernames are not a secret, passwords are a secret.

Does anyone still use password authentication on servers that actually matter? I mean, I'm just a hobbyist, and I switched to keys several years ago. Basically, I just use root and user, because anything else unnecessarily adds information.

There are situations where using a password can be a little more convenient, for instance if you like to connect to the machine from random computers and you don't want to/can't carry your private key with you all the time. Obviously it's not the best security-wise, using a hardware token containing the key or even OTPs are probably a better solution.

Re: OpenSSH user enumeration

#46

Post by simias » Sun, Aug 19, 2018, 10:51 AM UTC

exikyut wrote: post #23

ronnier wrote: post #15

Earlier quoted context omitted.

Sorry, can you explain what you mean by this? I didn’t follow.

ChallengeResponseAuthentication no # \ PasswordAuthentication no # | nukes "Password: " UsePAM no # / PermitRootLogin no # (duh) PubkeyAuthentication yes # enables public keys; very important AllowUsers user1 user2 # maybe? combine with an obscure username...

If you're doing admin on the machine you might not want to disallow root login.

Re: OpenSSH user enumeration

#47

Post by mercer » Sun, Aug 19, 2018, 11:04 AM UTC

mirimir wrote: post #7

jarfil wrote: post #2

Usernames are not a secret, passwords are a secret.

Does anyone still use password authentication on servers that actually matter? I mean, I'm just a hobbyist, and I switched to keys several years ago. Basically, I just use root and user, because anything else unnecessarily adds information.

I had a server that used password authentication for the root user (on the standard port). After a few months of uptime it was hacked.

I suppose even minimal extra security would've helped (no root user, only allow x login attempts in y time, changing the port for ssh), but I was still surprised someone got in so soon by simply guessing a 20+ string of gibberish (I still wonder if maybe something else happened).

All that said, I've had servers running for years without any successful hack, and in all those cases using ssh keys instead of password logins probably made all the difference.

Re: OpenSSH user enumeration

#48

Post by protomyth » Sun, Aug 19, 2018, 11:11 AM UTC

mercer wrote: post #47

mirimir wrote: post #7

Earlier quoted context omitted.

Does anyone still use password authentication on servers that actually matter? I mean, I'm just a hobbyist, and I switched to keys several years ago. Basically, I just use root and user, because anything else unnecessarily adds information.

I had a server that used password authentication for the root user (on the standard port). After a few months of uptime it was hacked. I suppose even minimal extra security would've helped (no root user, only allow x login attempts in y time, changing the port for ssh), but I was still surprised someone got in so soon by simply guessing a 20+ string of gibberish (I still wonder if maybe something else happened). All…

The current version of OpenSSH doesn’t allow root login by default.

Re: OpenSSH user enumeration

#49

Post by cyphunk » Sun, Aug 19, 2018, 11:12 AM UTC

Stop letting attackers route to you. Put your ssh server behind an onion. Do the same if you have POP/IMAP and other servers that have no reason for being accessible through transparent routing.

Re: OpenSSH user enumeration

#50

Post by protomyth » Sun, Aug 19, 2018, 11:14 AM UTC

simias wrote: post #46

exikyut wrote: post #23

Earlier quoted context omitted.

ChallengeResponseAuthentication no # \ PasswordAuthentication no # | nukes "Password: " UsePAM no # / PermitRootLogin no # (duh) PubkeyAuthentication yes # enables public keys; very important AllowUsers user1 user2 # maybe? combine with an obscure username...

If you're doing admin on the machine you might not want to disallow root login.

Use sudo or doas.