Does a known security issue allow ssh login via system accounts?

Stuart Henderson stu at spacehopper.org
Tue Mar 8 03:37:07 AEDT 2022


On 2022/03/07 11:14, Whit Blauvelt wrote:
> On Tue, 03/01/22, 2022 at 09:45:04AM +1100, Damien Miller wrote:
> 
> > It sounds like you have already verified that your PAM configuration was
> > not tampered with, so that removes one possibility. Reviewing the Ubuntu
> > PAM configurations and the patches they apply to sshd seem to be prudent
> > next steps.
> 
> Found the culprit: me. I was stupid enough to install and configure for
> libpam-google-auth, given a company mandate to 2FA all connections with
> admin access, where it wasn't in scope to add 2FA to all client accounts. If
> there's existing documentation anywhere on how dangerous this is, it's not
> in libpam-google-auth's own docs, nor in the recipes scattered across the
> net.
> 
> I've found no way yet to tweak it to be safe that I can be sure of, short of
> running a separate sshd on another port for it. Has there been consideration
> of adding 2FA to OpenSSH that doesn't require enabling PAM? Public keys and

Already possible:

AuthenticationMethods "publickey,password"

Depending on what you are allowed to use as a second factor and what
clients you use, the key allowed by "publickey" could be a key from a
traditional id_XXX file, or it could be a key handle for a U2F token.



More information about the openssh-unix-dev mailing list