Openssh use enumeration

[Selphie Keller]

yeah I like this idea, fixes the issue with blowfish hashes and non root
passwords, maybe random delay as the final fall back if no salts/passwords
are found. Seems rare, but I do have one box that I use ssh keys on and
none of the accounts have a hash set, but I also don't have password auth
enabled.

On 20 July 2016 at 21:18, Darren Tucker <dtucker at zip.com.au> wrote:

> On Wed, Jul 20, 2016 at 09:02:57PM -0600, Selphie Keller wrote:
> > I wonder if could be useful to set the fall back account to something
> user
> > defined to avoid suggesting people add passwords to root, though I do
> like
> > root since the account is always there,
>
> Since committing that diff I've heard of people running in production
> with no root password (ie *LK*, !! or similar).
>
> It's about the same amount of code to search for the first account with
> a valid salt, which would avoid this problem in the case where the root
> account doesn't have a real password.
>
> djm: what do you think?
>
> diff --git a/openbsd-compat/xcrypt.c b/openbsd-compat/xcrypt.c
> index 8913bb8..5385243 100644
> --- a/openbsd-compat/xcrypt.c
> +++ b/openbsd-compat/xcrypt.c
> @@ -78,14 +78,18 @@ pick_salt(void)
>         if (salt[0] != '\0')
>                 return salt;
>         strlcpy(salt, "xx", sizeof(salt));
> -       if ((pw = getpwuid(0)) == NULL)
> -               return salt;
> -       passwd = shadow_pw(pw);
> -       if (passwd[0] != '$' || (p = strrchr(passwd + 1, '$')) == NULL)
> -               return salt;  /* no $, DES */
> -       typelen = p - passwd + 1;
> -       strlcpy(salt, passwd, MIN(typelen, sizeof(salt)));
> -       explicit_bzero(passwd, strlen(passwd));
> +       setpwent();
> +       while ((pw = getpwent()) != NULL) {
> +               passwd = shadow_pw(pw);
> +               if (passwd[0] == '$' && (p = strrchr(passwd+1, '$')) !=
> NULL) {
> +                       typelen = p - passwd + 1;
> +                       strlcpy(salt, passwd, MIN(typelen, sizeof(salt)));
> +                       explicit_bzero(passwd, strlen(passwd));
> +                       goto out;
> +               }
> +       }
> + out:
> +       endpwent();
>         return salt;
>  }
>
>
> --
> Darren Tucker (dtucker at zip.com.au)
> GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.
>