#44808 - Default to allowing password authentication on leaves users vulnerable

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #17 received at submit@debbugs.gnu.org (full text, mbox, reply):

Received: (at submit) by debbugs.gnu.org; 23 Nov 2020 16:16:17 +0000
From debbugs-submit-bounces@debbugs.gnu.org Mon Nov 23 11:16:17 2020
Received: from localhost ([127.0.0.1]:50830 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1khEVl-0005Ch-8u
	for submit@debbugs.gnu.org; Mon, 23 Nov 2020 11:16:17 -0500
Received: from lists.gnu.org ([209.51.188.17]:36760)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <cwebber@dustycloud.org>) id 1khEVj-0005CY-1V
 for submit@debbugs.gnu.org; Mon, 23 Nov 2020 11:16:15 -0500
Received: from eggs.gnu.org ([2001:470:142:3::10]:43222)
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <cwebber@dustycloud.org>)
 id 1khEVi-0006nZ-SX
 for bug-guix@gnu.org; Mon, 23 Nov 2020 11:16:14 -0500
Received: from dustycloud.org ([2600:3c02::f03c:91ff:feae:cb51]:33816)
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <cwebber@dustycloud.org>)
 id 1khEVh-000336-4p
 for bug-guix@gnu.org; Mon, 23 Nov 2020 11:16:14 -0500
Received: from twig (localhost [127.0.0.1])
 by dustycloud.org (Postfix) with ESMTPS id A2D4C266EC;
 Mon, 23 Nov 2020 11:15:47 -0500 (EST)
References: <878sat3rnn.fsf@dustycloud.org>
 <4383f179-8e3a-7ce6-0fc0-f4cefeaf613e@gmail.com>
 <20201123044615.13cc0898@riseup.net>
User-agent: mu4e 1.4.13; emacs 27.1
From: Christopher Lemmer Webber <cwebber@dustycloud.org>
To: raingloom <raingloom@riseup.net>
Subject: Re: bug#44808: Default to allowing password authentication on
 leaves users vulnerable
In-reply-to: <20201123044615.13cc0898@riseup.net>
Date: Mon, 23 Nov 2020 11:15:18 -0500
Message-ID: <87r1ok2go9.fsf@dustycloud.org>
MIME-Version: 1.0
Content-Type: text/plain
Received-SPF: pass client-ip=2600:3c02::f03c:91ff:feae:cb51;
 envelope-from=cwebber@dustycloud.org; helo=dustycloud.org
X-Spam_score_int: -18
X-Spam_score: -1.9
X-Spam_bar: -
X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_PASS=-0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-Debbugs-Envelope-To: submit
Cc: bug-guix@gnu.org, 44808@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -2.3 (--)

raingloom writes:

> On Mon, 23 Nov 2020 03:32:08 +0100
> Taylan Kammer <taylan.kammer@gmail.com> wrote:
>
>> On 23.11.2020 00:20, Christopher Lemmer Webber wrote:
>> > Okay, I just realized I left a friend vulnerable by guiding them
>> > through a Guix graphical install and telling them it would give
>> > them a decent setup.  They turned on openssh support.
>> > 
>> > Then I realized their config had password-authentication? on.
>> > 
>> > That's unacceptable.  We need to change this default.  This is
>> > known to leave users open to attack, and selecting a password
>> > secure enough against brute forcing is fairly difficult, much more
>> > difficult than only allowing entry by keys.  Plus, few
>> > distributions do what we're doing anymore, precisely because of
>> > wanting to be secure by default.
>> > 
>> > Yes, I know some people want password authentication on as part of a
>> > bootstrapping process.  Fine... those users know to put it on.
>> > Let's not leave our users open to attack by default though.
>> > 
>> > Happy to produce a patch and change the documentation, but I'd like
>> > to hear that we have consensus to make this change.  But we should,
>> > because otherwise else I think we're going to hurt users.  
>> 
>> I think most ideal would be if the user is asked the following two 
>> questions, with a short explanation of what each means:
>> 
>> - Allow root login via SSH?
>> 
>> - Allow password authentication in SSH?
>> 
>> (I think Debian does this.)
>> 
>> Because as you say, on one hand password authentication in SSH can be
>> a security risk.  But on the other hand many machines never have
>> their SSH port exposed to the Internet, and the intranet is assumed
>> to be safe. In those cases it would be an annoyance to have to enable
>> it manually.
>> 
>> Both points apply to direct root login as well I think.
>> 
>> Allowing password authentication but disabling root login might also
>> be considered safe enough on machines exposed to the Internet,
>> because the attacker needs to guess the username as well.  Only
>> presents a small increase in complexity for the attacker though.
>> 
>> 
>> - Taylan
>> 
>> 
>> 
>
> Most people won't know why allowing password authentication is
> unsecure. Either it should be worded differently, have a warning, or
> not be an option.
>
> Same goes doubly so for allowing root login.

Agreed on both counts.

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 02:29:15 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#44808 Default to allowing password authentication on leaves users vulnerable