Live data from Hacker News

Abusing Ubuntu 24.04 features for root privilege escalation

snyk.io

61–70 of 83 posts

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#61
post #39

Earlier quoted context omitted.

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

I'd prefer they make it the default to not install it. I don't need to print from Linux. I don't print from Windows nor MacOS much either. Less than once a year. But I particularly don't print from Linux. I suspect that true for most people. cups shouldn't be a default install IMO

> I don't print from Windows nor MacOS much either. Less than once a year.

Many Linux users and developers don't run anything else. If they're to print at all it'll be from Linux.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#62
post #20

Earlier quoted context omitted.

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

Using modern tools and standards? So build with node.js, runs like a pig, only supports the three models made by the sponsoring company?

You honestly think you can do it without Electron?

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#63
post #38

Earlier quoted context omitted.

What if you don't need cups because you don't print anything? Just sudo apt remove cups right? No, because cups is a dependency of the entire graphical subsystem, just removing cups also removes everything from the Nautilus file manager to Firefox to ubuntu-desktop itself.

Any idea why that is?!

If it's printable...? Perhaps?

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#64

24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181

It is Ubuntu issue, it is cloud-init issue. You can get the same result on other distros provisioned by cloud-init.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#65

Earlier quoted context omitted.

Actually ubuntu and/or some cloud integrator is violating principle of least suprise, which predates by even more decades and applies everywhere not just in a computer operating system. Having /etc/ssh/sshd_config not do what it appears to do is inexcusable, however that comes about. Even if the fix is no more than structuring the file a little differently so there are parts both before and after the .d loading, and…

That's just not how it works, and it never has. One of the main purposes of the .d files is to avoid modifying the distro's sshd_config file, so you don't have to resolve conflicts during an OS upgrade. Commenting your overrides in the sshd_config? That's backwards. Downstream distros sometimes want to override the default settings. That's what .d is for. It doesn't violate the dogma "principle of least surprise", es…

[flagged]

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#66

24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181

Is this true for Ubuntu Server 24 as well? Was thinking of upgrading but not if I can’t configure SSH to be key only

You can still configure it to be key only, you just need to put your own override as a file in /etc/ssh/sshd_config.d/ rather than /etc/ssh/sshd_config. The files are read ins order, so your filename needs to sort after the 50-cloud-init.conf file.

This would work: echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/60-password-auth.conf

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#67

24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181

The proposed solution is bad, the file will be restored by the package manager at some point. Always prefix your override files with '99-' or 'zz-', this would have prevented the problem.

For OpenSSH configuration the first directive controls, not the last. So if you want to set an option make sure your include filename comes lexically earlier, not later. This is why the Include directive is at the top of distro-installed /etc/ssh/sshd_config. You can verify your server configuration using `sshd -T`, and a client configuration using `ssh -G`; they dump the resolved configuration to stdout.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#68

Earlier quoted context omitted.

Honestly, sudo’s value is really sanity, not security. The first time you use certain flavors of sudo, you get a nice little message which reminds you why sudo exists: We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. Realistically,…

Sudo is so commonly used especially on developer machines that I think it is used reflexively without any thought at at all. It should not be, but that's a different issue. It amazes me the amount of open-source projects that want to be installed with "sudo" when there is no reason they should not be able to be built and used entirely from within the developer's home directory. I know more than one person who starts…

I wonder if this comes from the how some developers view ops knowledge and tasks as merely ancillary to their interests and work.

For me, Linux was a hobby prior to and separately from programming. In the tutorials and documentation I read, every command was explained in detail and it was emphasized to me that I should never run a command that I don't fully understand. All instructions to elevate privileges were accompanied with advice about being careful running commands as root because root's privileges are especially dangerous. I was interested in those warnings, and took them seriously, because I wanted to master what I was learning. What I was learning, though, explicitly included Linux/Unix norms like security 'best practices'.

Developer documentation doesn't usually concern itself with Linux/Unix norms the way that tutorials for Linux hobbyists and novice sysadmins do. At the same time, the developers reading it might be perfectly dedicated to mastery, but just not really see what is considered proper usage by sysadmins (let alone the considerations that inform the boundaries of such propriety) to on-topic for what they're studying/exploring/playing with. Diving into those details might not be 'patt of the fun' for them.

What such a developer learns about sudo is mostly going to come from shallow pattern recognition: sudo is a button to slap when something doesn't work the first time, and maybe it has something to do with permissions.

But I think that comes from the mode of engagement, especially at the time of learning sudo, more than the mere frequency of use. I use sudo several times every day (including sometimes interactive sessions like you mention, with -i or -s), but I am careful to limit my usage to cases where it's really required. I'm not perfect about that; occasionally I run `sudo du` when `du` would suffice because I pulled something out of my shell history when I happened to be running it from / or whatever. But I certainly don't run it reflexively or thoughtlessly.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#69

24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181

omg I just disabled this on a major server that was just upgraded to 24.04.

Had to check my other VMs. Luckily most of them are debian or 22.04 (for now).

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#70
post #61
post #39

Earlier quoted context omitted.

I'd prefer they make it the default to not install it. I don't need to print from Linux. I don't print from Windows nor MacOS much either. Less than once a year. But I particularly don't print from Linux. I suspect that true for most people. cups shouldn't be a default install IMO

> I don't print from Windows nor MacOS much either. Less than once a year. Many Linux users and developers don't run anything else. If they're to print at all it'll be from Linux.

that's fine. They can install it. I suspect the actual number of computers running linux that need to able to print be less than 1 of 20.
Post reply on HN