RE: security issue with sshd on cygwin
"Don Beusee" <[email protected]> Fri, 22 Aug 2008 03:41:08 -0700
| Newsgroups | gmane.network.ssh.windows |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. ------=_NextPart_000_0C0F_01C90408.EA7E8760 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I have new motivation to fix this issue... I don't have a complete Cygwin install on here (sshwindows provides the minimum required), but I did turn on priv separation. It doesn't fix the issue. Pls advise. -Don _____ Try configuring sshd to use privilege separation. If you have a standard Cygwin install, backup your existing configuration files and run ssh-host-config. If you're an admin, it will do the right things. Don't know if this is your problem, but this configuration is working for me. -ME _____ From: Don Beusee [mailto:[email protected]] Sent: Friday, July 14, 2006 12:05 AM To: '[email protected]' Subject: security issue with sshd on cygwin I am running sshd (from openssh version 4.3p2) in passwordless mode (using ssh keys) and I noticed my cvs checkins using ssh are made by SYSTEM instead of my own userid. I first noticed this using the latest version available at http://sshwindows.sourceforge.net (which is older). This shows a definite security issue, as I am executing (partially at least) as SYSTEM (whoami still reported my username, mysteriously, but other utilities (like id from MKS Toolkit) did not - I didn't try cygwin's id command). Anyway, after some debugging and research, I realized the issue is because permanently_set_uid() in uidswap.c needs to do something like the following (before all the set* calls - I put this at the top before the first debug() call): #ifdef HAVE_CYGWIN HANDLE hToken = cygwin_logon_user(pw, pw->pw_passwd); if (hToken == INVALID_HANDLE_VALUE) fatal("User logon failed - verify etc/passwd matches the windows password for user %s", pw->pw_name); cygwin_set_impersonation_token(hToken); #endif Obviously this is not a great solution, as it requires etc/passwd to have clear-text passwords, but the cygwin calls are necessary, and it solves the issue for now. MKS has an sshd, but I am not using it because it is limited to a single connection (they want more money for unlimited). Anyway, I think their sshd daemon uses window's LSA database and calls to store (their rsetup program stores it) and retrieve the passwords. Maybe you can do that or come up with your own approach to store the windows password in some file securely (encrypted) that can be retrieved and unencrypted for the above call. Don Beusee <http://www.projectp.com/> ------=_NextPart_000_0C0F_01C90408.EA7E8760 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.6000.16705" name=3DGENERATOR></HEAD> <BODY> <DIV dir=3Dltr align=3Dleft><SPAN class=3D890293110-22082008><FONT = color=3D#0000ff>I=20 have new motivation to fix this issue...</FONT></SPAN></DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D890293110-22082008><FONT=20 color=3D#0000ff></FONT></SPAN> </DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D890293110-22082008><FONT = color=3D#0000ff>I=20 don't have a complete Cygwin install on here (sshwindows provides the = minimum=20 required), but I did turn on priv separation. It doesn't fix the=20 issue. Pls advise.</FONT></SPAN></DIV> <DIV> </DIV> <DIV align=3Dleft>-Don</DIV> <DIV align=3Dleft><FONT color=3D#0000ff></FONT> </DIV> <DIV> </DIV><BR> <BLOCKQUOTE dir=3Dltr=20 style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px = solid; MARGIN-RIGHT: 0px"> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft> <HR tabIndex=3D-1> </DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft> </DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><PRE style=3D"MARGIN: 0em">Try configuring sshd to use = privilege separation. </PRE></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><TT>If you have=20 a standard Cygwin install, backup your existing </TT><TT>configuration = files=20 and run ssh-host-config. If you're an admin, it </TT><TT>will do the = right=20 things. </TT></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><PRE style=3D"MARGIN: 0em"></PRE></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><TT>Don't know=20 if this is your problem, but this configuration is working = </TT><TT>for me.=20 </TT></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><PRE style=3D"MARGIN: 0em">-ME</PRE></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><SPAN=20 class=3D890293110-22082008><FONT = color=3D#0000ff> </FONT></SPAN></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><SPAN=20 class=3D890293110-22082008> </SPAN></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft> <HR tabIndex=3D-1> </DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><FONT=20 face=3DTahoma size=3D2><B>From:</B> Don Beusee = [mailto:[email protected]]=20 <BR><B>Sent:</B> Friday, July 14, 2006 12:05 AM<BR><B>To:</B>=20 '[email protected]'<BR><B>Subject:</B> security issue with sshd on=20 cygwin<BR></FONT><BR></DIV> <DIV></DIV> <DIV><SPAN class=3D718324901-14072006><FONT color=3D#0000ff>I am = running sshd=20 (from openssh version 4.3p2) in passwordless mode (using ssh keys) and = I=20 noticed my cvs checkins using ssh are made by SYSTEM instead of my own = userid. I first noticed this using the latest version available = at <A=20 = href=3D"http://sshwindows.sourceforge.net">http://sshwindows.sourceforge.= net</A> (which=20 is older). This shows a definite security issue, as I am = executing=20 (partially at least) as SYSTEM (whoami still reported my username,=20 mysteriously, but other utilities (like id from MKS Toolkit) did not - = I=20 didn't try cygwin's id command).</FONT></SPAN></DIV> <DIV><SPAN class=3D718324901-14072006><FONT=20 color=3D#0000ff></FONT></SPAN> </DIV> <DIV><SPAN class=3D718324901-14072006><FONT = color=3D#0000ff>Anyway, after=20 some debugging and research, I realized the issue is because=20 permanently_set_uid() in uidswap.c needs to do something like the = following (before all the set* calls - I put this at the top before = the=20 first debug() call):</FONT></SPAN></DIV> <DIV><SPAN class=3D718324901-14072006><FONT=20 color=3D#0000ff></FONT></SPAN> </DIV> <DIV><SPAN class=3D718324901-14072006><FONT color=3D#0000ff>#ifdef=20 HAVE_CYGWIN<BR> HANDLE = hToken =3D=20 cygwin_logon_user(pw,=20 pw->pw_passwd);<BR> if = (hToken =3D=3D=20 = INVALID_HANDLE_VALUE)<BR> = =20 fatal("User logon failed - verify etc/passwd matches the windows = password for=20 user %s", = pw->pw_name);<BR> =20 cygwin_set_impersonation_token(hToken);<BR>#endif</FONT></SPAN></DIV> <DIV> </DIV> <DIV><SPAN class=3D718324901-14072006><FONT color=3D#0000ff>Obviously = this is not=20 a great solution, as it requires etc/passwd to have clear-text = passwords, but=20 the cygwin calls are necessary, and it solves the issue for now. = MKS has=20 an sshd, but I am not using it because it is limited to a single = connection=20 (they want more money for unlimited). Anyway, I think their sshd = daemon=20 uses window's LSA database and calls to store (their rsetup program = stores it)=20 and retrieve the passwords. Maybe you can do that or come up = with your=20 own approach to store the windows password in some file securely = (encrypted)=20 that can be retrieved and unencrypted for the above = call.</FONT></SPAN></DIV> <DIV><FONT color=3D#0000ff></FONT> </DIV> <DIV align=3Dleft>Don Beusee</DIV> <DIV align=3Dleft> <DIV align=3Dleft><FONT color=3D#0000ff><A=20 href=3D"http://www.projectp.com/"></A></FONT></DIV><FONT=20 color=3D#0000ff></FONT></DIV> <DIV> </DIV></BLOCKQUOTE></BODY></HTML> ------=_NextPart_000_0C0F_01C90408.EA7E8760-- -- List Info: http://erdelynet.com/ssh-l/ List Archives: http://erdelynet.com/archive/ssh-l/ To Unsubscribe: Mail mailto:[email protected] If you are having trouble unsubscribing, visit the List Info page for help.