Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
1–10 of 62 posts
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#2As per the well known XZ-utils backdoor, we decided to take a step further and drop libsystemd dependency altogether by implementing the missing bits with few small patches (one upstream, the other to be forwarded).
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#3As per the well known XZ-utils backdoor, we decided to take a step further and drop libsystemd dependency altogether by implementing the missing bits with few small patches (one upstream, the other to be forwarded).
A back door in the same library is not likely. It drew attention and many looked into it.
What could be done to prevent supply chain attacks more broadly?
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#4As per the well known XZ-utils backdoor, we decided to take a step further and drop libsystemd dependency altogether by implementing the missing bits with few small patches (one upstream, the other to be forwarded).
A back door in the same library is not likely. It drew attention and many looked into it. What could be done to prevent supply chain attacks more broadly?
One way to reduce supply chain risks would be to reduce the supply chain. Less dependencies results in less risk.
For example, dropping the libsystemd dependency.
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#5As per the well known XZ-utils backdoor, we decided to take a step further and drop libsystemd dependency altogether by implementing the missing bits with few small patches (one upstream, the other to be forwarded).
A back door in the same library is not likely. It drew attention and many looked into it. What could be done to prevent supply chain attacks more broadly?
> A back door in the same library is not likely.
But libsystemd is not linked to xz only. By removing it, sshd is free of many other potential risks.
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#6Earlier quoted context omitted.
A back door in the same library is not likely. It drew attention and many looked into it. What could be done to prevent supply chain attacks more broadly?
> A back door in the same library is not likely. But libsystemd is not linked to xz only. By removing it, sshd is free of many other potential risks.
Correct, I misread.
Still the question remains: what technology could be implemented to mitigate this type of attack (beyond sshd)?
For example, Linux sandboxing is poor, and SeLinux is not usually enforced.
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#7I thought Ubuntu is a downstream of Debian, did I take it wrong?
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#8Earlier quoted context omitted.
A back door in the same library is not likely. It drew attention and many looked into it. What could be done to prevent supply chain attacks more broadly?
> A back door in the same library is not likely. But libsystemd is not linked to xz only. By removing it, sshd is free of many other potential risks.
I pointed out this weakness the other day on the internet. I got attacked by open source software armies.
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#9libsystem is such a bizarre abstraction covering far too much surface area. The name alone is a code smell. Why is the same library used for both internal service management and for services implementing on-demand launches and notifications?
Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies
#10libsystem is such a bizarre abstraction covering far too much surface area. The name alone is a code smell. Why is the same library used for both internal service management and for services implementing on-demand launches and notifications?
That is the systemd way, and what many of us have pointed out for years as a major risk of the approach.