Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH as a Sudo Replacement

whynothugo.nl

Post reply on HN
Print view View original

71–80 of 114 posts

Re: SSH as a Sudo Replacement

#71

Post by dns_snek »

mmh0000 wrote: post #11
aaaronic wrote: post #7

Earlier quoted context omitted.

I can agree with that, though admit to being guilty of using sudo bash far more often than I should. I honestly thought they’d be using ssh that way (single command at a time), though I’m still not sure to what security end.

If ‘sudo’ is properly configured running bash or anything that allows command execution (vim, eMacs, etc) is disallowed. Also, may I introduce you to the ‘sudo -i’ option.

> If ‘sudo’ is properly configured running bash or anything that allows command execution (vim, eMacs, etc) is disallowed.

Keep in mind that this is borderline impossible to enforce unless your goal is just to stop the most common ways of accidentally breaking the policy. A list of commands that allows breaking out into a full shell includes: less, apt, man, nano, wget & many more.

https://gtfobins.github.io/#+shell

Re: SSH as a Sudo Replacement

#72

Post by acka »

mmh0000 wrote: post #11
aaaronic wrote: post #7

Earlier quoted context omitted.

I can agree with that, though admit to being guilty of using sudo bash far more often than I should. I honestly thought they’d be using ssh that way (single command at a time), though I’m still not sure to what security end.

If ‘sudo’ is properly configured running bash or anything that allows command execution (vim, eMacs, etc) is disallowed. Also, may I introduce you to the ‘sudo -i’ option.

> eMacs

This made me chuckle. Apple influencing the way Emacs is capitalized (pun intended) versus RMS's stance on Free Software couldn't be further apart I think.

Re: SSH as a Sudo Replacement

#73

Post by dmw_ng »

op00to wrote: post #6
aaaronic wrote: post #2

Am I missing something? How is logging into ssh (sshd) AS root more secure than using sudo? I honestly don’t even know how dangerous that is because I’ve always been told to never allow it. I see here thought goes into preventing that for a remote user, so I’m not talking about that aspect of security here. Maybe it has to do with #3 in the sudo limitations — I certainly don’t see any benefits vis-a-vis #1. I totally…

A big part of sudo is that you should be running individual commands using sudo to increase auditability rather than simply running sudo bash or whatever.

It's comical to see the sudo codebase mentioned in the same breath as increasing auditability here

Re: SSH as a Sudo Replacement

#75

Post by tankenmate »

One issue I see with this is Single User Mode (aka recovery mode in grub (or similar) boot loader). Now you can't login as root to recover from init (systemd) configuration issues without having alternate boot media to get you access. I know it might sound pedantic but I used just this feature two days ago while upgrading a machine to a newer Linux release (the upgrade introduced an issue with the systemd / netplan config that got systemd into a loop due to deprecated keywords in the netplan config).

Re: SSH as a Sudo Replacement

#76

Post by tankenmate »

kelnos wrote: post #34

My main objection to this is just the added complexity. Instead of a single suid binary that reads a config file and calls exec(), now you have one binary that runs as root and listens on a UNIX socket, and another that talks to a UNIX socket; both of them have to do asymmetric crypto stuff. It seems like the main argument against sudo/doas being presented is that you have a suid binary accessible to any user, and if…

Personally I use etckeeper[0] to make sure all changes to /etc are tracked, either by software installs / upgrades, or done by humans. It's also great when needing to upgrade a machine to a newer release as you can create a patch file with all your local changes and apply that patch to a clean install and do a three way merge that will highlight all conflicts and keep you up to date and any changes required from one release to the next without having to research everything just in case.

[0] https://etckeeper.branchable.com/

Re: SSH as a Sudo Replacement

#77

Post by fsniper »

aaaronic wrote: post #2

Am I missing something? How is logging into ssh (sshd) AS root more secure than using sudo? I honestly don’t even know how dangerous that is because I’ve always been told to never allow it. I see here thought goes into preventing that for a remote user, so I’m not talking about that aspect of security here. Maybe it has to do with #3 in the sudo limitations — I certainly don’t see any benefits vis-a-vis #1. I totally…

The approach is comparing - Theoretical configuration errors, or theoretical vulnerabilities that may or may not be there with - Having a new daemon running (a new attack surface) which - may also have configuration errors, or vulnerabilities as such - and also removes a few layers of user based authorisation with a single root level

This approach is somehow considered more secure.

And in a rational way, and of course for any rational security perspective this can't be considered more secure, just different.

Re: SSH as a Sudo Replacement

#78

Post by irusensei »

aaaronic wrote: post #2

Am I missing something? How is logging into ssh (sshd) AS root more secure than using sudo? I honestly don’t even know how dangerous that is because I’ve always been told to never allow it. I see here thought goes into preventing that for a remote user, so I’m not talking about that aspect of security here. Maybe it has to do with #3 in the sudo limitations — I certainly don’t see any benefits vis-a-vis #1. I totally…

> How is logging into ssh (sshd) AS root more secure than using sudo?

Article describes an additional SSH server listening on an Unix socket. The usual threat model about exposing root logins from the internet may not apply here.

Re: SSH as a Sudo Replacement

#79

Post by irusensei »

xfitm3 wrote: post #16

Fixing things that aren't broken. Changing things just because they can be changed. Sometimes boring and stagnant is good.

I wouldn’t go as far to say sudo is broken but have you considered why would people create things such as doas and run0 if sudo is good enough?

Re: SSH as a Sudo Replacement

#80

Post by the8472 »

One of the issues with ssh is that spawning processes isn't part of the protocol. And it's a remote protocol, so it can't pass local resources to the child. So you can't pass a null-separated array of arguments, pass extra file descriptors or specify an executable. Instead it just passes a string to a server-configured shell. So you need to shell-escape things and know which shell is running on the server side.

To use SSH as a proper sudo replacement it'd need something closer to posix_spawn as an extension.

Post reply on HN