Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Ubuntu 24.04 features for root privilege escalation

snyk.io

Post reply on HN
Print view View original

71–80 of 83 posts

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#71

Post by HumanOstrich »

Brian_K_White wrote: post #65
HumanOstrich wrote: post #59

Earlier quoted context omitted.

That's just not how it works, and it never has. One of the main purposes of the .d files is to avoid modifying the distro's sshd_config file, so you don't have to resolve conflicts during an OS upgrade. Commenting your overrides in the sshd_config? That's backwards. Downstream distros sometimes want to override the default settings. That's what .d is for. It doesn't violate the dogma "principle of least surprise", es…

[flagged]

Child? Do you condescend based on principle or dogma? ¯\_(ツ)_/¯

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#72

Post by sylware »

It is time to stop that: there is no "security", this is a fantasy which does not exist. Nowadays, anybody saying otherwise is trying to sell you something.

The only real security is to protect basic users from themselves, namely breaking their systems. That's it. (rm -Rf /)

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#73

Post by jbarrs »

normie3000 wrote: post #43
panarky wrote: post #38

Earlier quoted context omitted.

What if you don't need cups because you don't print anything? Just sudo apt remove cups right? No, because cups is a dependency of the entire graphical subsystem, just removing cups also removes everything from the Nautilus file manager to Firefox to ubuntu-desktop itself.

Any idea why that is?!

This might be wrong, but based on my own experience of Ubuntu effectively uninstalling itself when I tried to remove a single package.

I think most of the default software gets installed as one large package group, rather than as individual pieces of software. Only the group is marked as manually installed, but the individual programs pulled in by that group are marked as automatically installed. If you try to apt install something you already have as part of the default distro software, you'll usually see a message saying something like "marked as manually installed."

When you go to uninstall one program from the group, that one program is uninstalled as requested, but the group itself has to be marked as uninstalled, since you've removed one of that group's "dependencies" and thus can no longer satisfy that group's installation requirements. You now have a load of software that was automatically installed as dependencies of another package, but are no longer dependencies of any manually-installed packages. The next time you run apt autoremove, it'll remove all of those automatically-installed components and leave you with an almost bare system.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#75

Post by speleding »

lathiat wrote: post #66
charliebwrites wrote: post #46

Earlier quoted context omitted.

Is this true for Ubuntu Server 24 as well? Was thinking of upgrading but not if I can’t configure SSH to be key only

You can still configure it to be key only, you just need to put your own override as a file in /etc/ssh/sshd_config.d/ rather than /etc/ssh/sshd_config. The files are read ins order, so your filename needs to sort after the 50-cloud-init.conf file. This would work: echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/60-password-auth.conf

With sshd configuration the first option is the one that sticks, so you need to make sure it sorts BEFORE the 50-cloud-init.conf file.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#76

Post by Vilian »

nneonneo wrote: post #31
sheerun wrote: post #26

The only feedback I get when installing d-spy is "Uses System Services", and "Uses Session Services", which means nothing to me as a user, and yet it allows program to enumerate all programs I use and as it turns out even hack my computer. Other platforms solved this with something like "developer mode", iOS, Android, Meta, etc. I shouldn't be able to install this app without confirming developer-mode-only permission…

You’re running desktop Linux - your whole system is permanently in “developer mode”. That’s kind of the point? Windows and macOS don’t have “developer mode” either, at least not to the extent seen in the mobile OSes. They’re very different models of computing.

The only way to not be in "developer mode" is to install something like fedora atomic, then everything is harder lol

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#77

Post by trod1234 »

Not surprising, Ubuntu has suffered a wide array of issues going all the way back to their releases following 18.04 LTS.

D-BUS has long been targeted by attackers for the exact reasons the author goes into (its fairly common knowledge in some circles). Not just because of the difference in security contexts but also because of the lack of visibility on these channels with OOB configurations for logging/monitoring.

D-BUS Activation has also been targeted before, many times for its ability to effectively re-parent a process under different pids/names/users, and hiding that process is usually not that hard using a simple mount bind on the associated /proc/pid and mounts directory post exploitation.

With the poisoning of the Ubuntu repository (with fixup scripts to re-enable snap), their security posture became untenable, but has only gotten worse over time.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#78

Post by HumanOstrich »

Brian_K_White wrote: post #74
HumanOstrich wrote: post #71

Earlier quoted context omitted.

Child? Do you condescend based on principle or dogma? ¯\_(ツ)_/¯

[flagged]

There isn't a comment specifically saying that including more config files can override values, so I'll give you that. However, it does have comments explaining exactly how to override default values. It looks like what the OP of this thread is attempting should work unless they messed up something else.

I'm looking at a couple sshd_config files on my servers, and the Include directive for the overrides is the first non-comment line in the file.

Having that Include be first means that changing any settings in the sshd_config file will override anything set by sshd_config.d/* files.

What in the heck are these people doing to break their config? There really is no legitimate issue here.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#79

Post by Fire-Dragon-DoL »

HumanOstrich wrote: post #42
samlinnfer wrote: post #15

24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181

A better practice is to use the `.d/` convention as intended - so you can have overrides and customizations without having to edit the OS-managed /etc/ssh/sshd_config file and fight it if an OS upgrade changes it. Edit: It's not really a mistake on Ubuntu's part, and is common in other distros for overriding upstream defaults[1]. [1]: https://askubuntu.com/a/1516347

There is a bug with that where you cannot "redefine" the ftp command used (I think it was that, or the group declaration), so in the end I had to edit the configuration manually either way

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#80

Post by MrResearcher »

gazunklenut wrote: post #22
MortyWaves wrote: post #21

Earlier quoted context omitted.

Now I definitely feel glad that I decided on moving back to Debian for servers.

Pretty sure this exists on Debian too

Damn, you really got me scared there for a second. Just re-checked by Debian 12 systems on AWS, I don't have any files residing in *.d directories. So I confirm that if you used the official AWS Debian image, you wouldn't get it.

And if you downloaded and installed the authentic Debian 12 image from debian.org, you don't get it either. Must be a Ubuntu thingy.

Post reply on HN