[PATCH 2/3] enable "StrictModes" for OpenSSH

[PATCH 2/3] enable "StrictModes" for OpenSSH

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 1558 bytes --]

Always make sure permissions of .ssh/authorized_keys
are checked. This prevents word-writeable keyfiles from
being processed, reducing attack surface after misconfiguration.

Partially addresses #11538 and depends on patch 1/3.

Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
---
 config/rootfiles/core/121/update.sh | 3 ++-
 lfs/openssh                         | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh
index 5b8f2c86e..3ec251292 100644
--- a/config/rootfiles/core/121/update.sh
+++ b/config/rootfiles/core/121/update.sh
@@ -59,7 +59,8 @@ rm -rvf \
 # Update SSH configuration
 sed -i /etc/ssh/sshd_config \
 	-e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \
-	-e 's/^#LogLevel INFO$/LogLevel INFO/'
+	-e 's/^#LogLevel INFO$/LogLevel INFO/' \
+	-e 's/^#StrictModes .*$/StrictModes yes/'
 
 # Start services
 /etc/init.d/sshd restart
diff --git a/lfs/openssh b/lfs/openssh
index 46561953d..7e8468ac9 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -95,6 +95,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		-e 's/^#LogLevel INFO$/LogLevel INFO/' \
 		-e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \
 		-e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \
+		-e 's/^#StrictModes .*$/StrictModes yes/' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \
 		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
-- 
2.13.6


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH 2/3] enable "StrictModes" for OpenSSH

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 2530 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Acked.

On Tue, 2018-05-01 at 14:43 +0200, Peter Müller wrote:
> Always make sure permissions of .ssh/authorized_keys
> are checked. This prevents word-writeable keyfiles from
> being processed, reducing attack surface after misconfiguration.
> 
> Partially addresses #11538 and depends on patch 1/3.
> 
> Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
> ---
>  config/rootfiles/core/121/update.sh | 3 ++-
>  lfs/openssh                         | 1 +
>  2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/config/rootfiles/core/121/update.sh
> b/config/rootfiles/core/121/update.sh
> index 5b8f2c86e..3ec251292 100644
> --- a/config/rootfiles/core/121/update.sh
> +++ b/config/rootfiles/core/121/update.sh
> @@ -59,7 +59,8 @@ rm -rvf \
>  # Update SSH configuration
>  sed -i /etc/ssh/sshd_config \
>  	-e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \
> -	-e 's/^#LogLevel INFO$/LogLevel INFO/'
> +	-e 's/^#LogLevel INFO$/LogLevel INFO/' \
> +	-e 's/^#StrictModes .*$/StrictModes yes/'
>  
>  # Start services
>  /etc/init.d/sshd restart
> diff --git a/lfs/openssh b/lfs/openssh
> index 46561953d..7e8468ac9 100644
> --- a/lfs/openssh
> +++ b/lfs/openssh
> @@ -95,6 +95,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>  		-e 's/^#LogLevel INFO$/LogLevel INFO/' \
>  		-e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \
>  		-e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \
> +		-e 's/^#StrictModes .*$/StrictModes yes/' \
>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \
>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \
>  		-e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \
-----BEGIN PGP SIGNATURE-----

iQIyBAEBCgAdFiEE5/rW5l3GGe2ypktxgHnw/2+QCQcFAlsOix8ACgkQgHnw/2+Q
CQeRCA/1Fig9mXCSrLVkHLRxFEV6h+HDAFDO+vWAZXc6w7HarRGVCcA2bd/tGcYq
/IGkEEAi8h3q3PBfML5c40QyV0Pjl7S1zWW4zElSM3RtRnUfvTNMMTL/UfqWGSgt
JF9aBCI/luaAyKtOYhBMzgRsvO6J5ZzJUJfXw9OSVXS7QHsGKdLdaHGRvmG7+LyO
qsRTWn84IOHVff013VSyw9hYtpO4ykJn0Z6FdLhql6DUgT8I2HaQW+Bosb1osqYJ
ZTCfSGzhARETjhg6JxALSritm+2sdJ1TKqLgvDO7MfHZSLT8MQoqur5ikbW5qAFk
xxgCIkTf+boATAl7j1igscyDghvwjl/fQtK7qJDqO5Y/vcotPeEW/LLXLd9UaXeY
9O4BQL1/xNniHvKDyGuCDYiW53VljMw4ilAP06RgAot40qp/vwupf44+GWcIcWit
j8SAADHAlNYEkANvuYSnLu8ywdnkGOf5sWtNJW/LCBbbFhZGruWJvf4KRai5BHF9
oiL2BEjtyMXQ7RFmItXBbJO64C8Qwh74VvPIZ7QFCdPUA2LaCEgc00tnUhQTABsj
lyVbvOL0HNPiKkXwzd9mBI0RdmQRYAJe7b8hzW3CA6r2WbbngARJY7OFia7n8NUA
QHH1bIgsgPbYjHeLhNEazxOABfc5zKlGRktIBy3lNZVSbdrkAg==
=ILbC
-----END PGP SIGNATURE-----