41–50 of 83 posts
24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181
Edit: It's not really a mistake on Ubuntu's part, and is common in other distros for overriding upstream defaults[1].
Earlier quoted context omitted.
Well it's your lucky day, they're working on rearchitecting cups to be, among other things, more secure. See https://ftp.pwg.org/pub/pwg/liaison/openprinting/presentatio...
What if you don't need cups because you don't print anything? Just sudo apt remove cups right? No, because cups is a dependency of the entire graphical subsystem, just removing cups also removes everything from the Nautilus file manager to Firefox to ubuntu-desktop itself.
Earlier quoted context omitted.
Great, now you can start putting your customizations in that directory instead of the OS-managed /etc/ssh/sshd_config blob. That's why the `.d/` convention exists.
What does .d imply?
Earlier quoted context omitted.
Now I definitely feel glad that I decided on moving back to Debian for servers.
Does anyone know how to turn off auto updates on Ubuntu 22? I thought I fixed it, but apparently not. It is driving me crazy.
24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181
Was thinking of upgrading but not if I can’t configure SSH to be key only
24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181
Is this true for Ubuntu Server 24 as well? Was thinking of upgrading but not if I can’t configure SSH to be key only
24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181
Now I definitely feel glad that I decided on moving back to Debian for servers.
On top of that, this issue doesn't even "ship with 24.04". GP probably chose to enable password auth in SSH during installation, or they used a cloud provider that provisions instances with passwords and overrides the default.
Earlier quoted context omitted.
They can execute anything they like as root... by entering their password. This post shows a way that clever code can execute anything it likes as root without knowing the user's password. That seems pretty significant to me.
Using print server vulnerabilities to gain local privilege escalation is reminiscent of Windows 95. The year of "Linux on the Desktop," I guess.
Earlier quoted context omitted.
Now I definitely feel glad that I decided on moving back to Debian for servers.
Err, why? Nothing is actually broken with Ubuntu 24.04. The issue GP is describing is just a lack of understanding of how config files have worked on Linux for decades. On top of that, this issue doesn't even "ship with 24.04". GP probably chose to enable password auth in SSH during installation, or they used a cloud provider that provisions instances with passwords and overrides the default.
You shouldn't need to edit an undocumented file that's force enabling an insecure authentication method in the first place.
"You're using it wrong" doesn't change the fact that the defaults are poor and likely to ultimately cause more devices to be improperly configured than if it was left as sysadmins and end-users expect.