Usernames are not a secret, passwords are a secret.
Are you willing to send me a list of all your usernames on all your systems?
there is an "ubuntu" user on most of my systems. I hope you find this information useful.
OpenSSH user enumeration
11–20 of 89 posts
Re: OpenSSH user enumeration
#12Re: OpenSSH user enumeration
#13Usernames are not a secret, passwords are a secret.
[deleted]
Re: OpenSSH user enumeration
#14Usernames are not a secret, passwords are a secret.
I don't know, judging by my SSH logs it seems a lot of the automated malicious login attempts are looking for common software used to deploy code. Knowing that a target machine has a username used by some popular software might be valuable information in an attack. But on the subject of passwords, best practice for SSH for a long time has been to disable password based login entirely and rely on keys.
Exactly - it also works for non-SSH accounts, thus allowing software enumeration by testing for default/common/known default service users.
For instance, an OpenBSD box running Tor may have a user "_tor", a Debian-based box (e.g. Ubuntu) may have a user "debian-tor", and so on (depending on how Tor was installed, in my case via pkg_add & apt-get; usernames might vary for different OS/repo versions). I have tested this using the PoC against some of my own systems (the ones that have PasswordAuthentication still enabled) and it works for those.
Re: OpenSSH user enumeration
#15If you're a startup and this matters to you, you're doing it very wrong.
Sorry, can you explain what you mean by this? I didn’t follow.
Re: OpenSSH user enumeration
#16Earlier quoted context omitted.
Are you willing to send me a list of all your usernames on all your systems?
there is an "ubuntu" user on most of my systems. I hope you find this information useful.
I know you're being facetious but, yes, I would find that information useful. Now I've just IDed the distribution I'm targeting.
Re: OpenSSH user enumeration
#17If you're a startup and this matters to you, you're doing it very wrong.
What do you mean? The email was sent from a a security research group.
Re: OpenSSH user enumeration
#18If you're a startup and this matters to you, you're doing it very wrong.
Sorry, can you explain what you mean by this? I didn’t follow.
I think he’s saying:
a) Why are you using bleeding edge software in production, and especially so unreleased versions of OpenSSH?
b) Why are your SSH servers exposed to public traffic?
c) User enumeration is useful for finding accounts with weak passwords. Why do you have personal accounts on prod servers? Why do you have _any_ accounts not using public key authentication at all?
Re: OpenSSH user enumeration
#19If you're a startup and this matters to you, you're doing it very wrong.
What do you mean? The email was sent from a a security research group.
To hazard a guess: it should be standard practice to use public key authentication for ssh (>= 2048 bits rsa or ecdsa), so this attack shouldn't make compromising a system any easier. Better yet, use a Yubikey or equivalent.
Other commenters have mentioned this attack getting information on hosted services on the system. But, usually you can get that from a straightforward nmap or other recon tool anyway.
Re: OpenSSH user enumeration
#20Earlier quoted context omitted.
Sorry, can you explain what you mean by this? I didn’t follow.
I think he’s saying: a) Why are you using bleeding edge software in production, and especially so unreleased versions of OpenSSH? b) Why are your SSH servers exposed to public traffic? c) User enumeration is useful for finding accounts with weak passwords. Why do you have personal accounts on prod servers? Why do you have _any_ accounts not using public key authentication at all?
FWIW, regarding a),
> We believe that this issue warrants a CVE; it affects all operating systems, all OpenSSH versions (we went back as far as OpenSSH 2.3.0, released in November 2000), and is easier to exploit than previous OpenSSH username enumerations...
As for b) and c), I 100% agree.
In fact: if you're using KVM-based virtualization, and you have VNC or serial access to your node (GCP gives you serial access, via web UI or an SSH-based proxy), you could completely _disable_ standard network-based login. (Writing an admin tool that connects to the serial console, gets a usable shell, and enables your sshd for when you need it, is an exercise for the inspired sysadmin. :P)
But this fun little trick is going to break a lot of stuff.