Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Harvesting SSH Credentials: Insights from My Honeypot Network

uphillsecurity.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: Harvesting SSH Credentials: Insights from My Honeypot Network

#11

Post by inigyou »

0cf8612b2e1e wrote: post #7

Do most installations create a git user account with login permissions?

There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git.

This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.

Re: Harvesting SSH Credentials: Insights from My Honeypot Network

#13

Post by 0cf8612b2e1e »

inigyou wrote: post #11
0cf8612b2e1e wrote: post #7

Do most installations create a git user account with login permissions?

There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git. This…

I suppose /usr/sbin/nologin is not a thing?

https://www.man7.org/linux/man-pages/man8/nologin.8.html

Re: Harvesting SSH Credentials: Insights from My Honeypot Network

#14

Post by tuetuopay »

inigyou wrote: post #11
0cf8612b2e1e wrote: post #7

Do most installations create a git user account with login permissions?

There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git. This…

SSH bastions would like a word I guess. You can authenticate, but you definitely can’t login (which is also the case for git over SSH).

Re: Harvesting SSH Credentials: Insights from My Honeypot Network

#15

Post by merpkz »

PyWoody wrote: post #9
asveikau wrote: post #4

Earlier quoted context omitted.

I've used unix-like OS's for 28 years and I don't remember coming across it as a password. It is a common username (see: https://en.wikipedia.org/wiki/Toor_(Unix) ), the machine I am typing this on has it.

It was the default password for the root user in Kali Linux for a while.

Back when it was called Backtrack if my memory serves right. I remember being puzzled that it was not the case anymore one day and they even switched to regular user around when Kali became a thing

Re: Harvesting SSH Credentials: Insights from My Honeypot Network

#16

Post by inigyou »

0cf8612b2e1e wrote: post #13
inigyou wrote: post #11

Earlier quoted context omitted.

There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git. This…

I suppose /usr/sbin/nologin is not a thing? https://www.man7.org/linux/man-pages/man8/nologin.8.html

That's a hack. It's a login shell that, once you have already logged in and run the shell, prints a message saying you can't log in or run a shell, and then exits.

It does not stop you from, say, logging in to SSH and then starting a port forward. Or running a command in a way that bypasses the login shell. ssh will always pass it to your login shell but other ways can be vulnerable.

Re: Harvesting SSH Credentials: Insights from My Honeypot Network

#20

Post by chaz6 »

ufmace wrote: post #18

I'd be more curious to know what these SSH scanner bots actually do if they manage to log in. Automated recon, install spambot/cryptominer/phishing site, something else?

The most common things I observe:-

- Installing a cryptominer or persistence tool

- Sending spam (smtp)

- Using pre-obtained credentials to log into various ecommerce/social media sites

Post reply on HN