#44808 - Default to allowing password authentication on leaves users vulnerable

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #40 received at submit@debbugs.gnu.org (full text, mbox, reply):

Received: (at submit) by debbugs.gnu.org; 7 Dec 2020 12:57:00 +0000
From debbugs-submit-bounces@debbugs.gnu.org Mon Dec 07 07:57:00 2020
Received: from localhost ([127.0.0.1]:52845 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1kmG4Z-00083E-Lv
	for submit@debbugs.gnu.org; Mon, 07 Dec 2020 07:56:59 -0500
Received: from lists.gnu.org ([209.51.188.17]:57072)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <arne_bab@web.de>) id 1kmG4U-000832-6s
 for submit@debbugs.gnu.org; Mon, 07 Dec 2020 07:56:58 -0500
Received: from eggs.gnu.org ([2001:470:142:3::10]:58762)
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <arne_bab@web.de>) id 1kmG4T-0003rP-P6
 for bug-guix@gnu.org; Mon, 07 Dec 2020 07:56:53 -0500
Received: from mout.web.de ([212.227.15.4]:57743)
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <arne_bab@web.de>)
 id 1kmG40-00045H-Nn; Mon, 07 Dec 2020 07:56:53 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=web.de;
 s=dbaedf251592; t=1607345767;
 bh=BxlAxmAPY6PBCvEUZ/Ni5KxNO2bC1FCD+DiPpImkEaY=;
 h=X-UI-Sender-Class:References:From:To:Cc:Subject:In-reply-to:Date;
 b=cuj4cXu3rY8LFXCwx/lki2yfKZktYJnKo6kC382/7z7se+EW4aQvWx1GW8qMbu6DC
 OjmcIaJYdzemNfuh2TqFdX/LckTgoSHHohDS6Hj9EJwmmxcwH7ki4bLpXPRfu5O4Yz
 y7qyo2DZtQFqkvTrfo4hzUs/guwLBc4X1fG5EOow=
X-UI-Sender-Class: c548c8c5-30a9-4db5-a2e7-cb6cb037b8f9
Received: from fluss ([84.149.87.37]) by smtp.web.de (mrweb002
 [213.165.67.108]) with ESMTPSA (Nemesis) id 0M8zdd-1ks0HT3TeX-00CUBV; Mon, 07
 Dec 2020 13:56:06 +0100
References: <878sat3rnn.fsf@dustycloud.org> <874klgybbs.fsf@zancanaro.id.au>
 <87im9w2gjt.fsf@dustycloud.org> <87im9nmr5u.fsf@gmail.com>
 <87eek45lpg.fsf@gnu.org> <87k0twkt9c.fsf@dustycloud.org>
 <87sg8hzvdx.fsf@gnu.org>
User-agent: mu4e 1.4.13; emacs 27.1
From: "Dr. Arne Babenhauserheide" <arne_bab@web.de>
To: Ludovic Courtès <ludo@gnu.org>
Subject: Re: bug#44808: Default to allowing password authentication on
 leaves users vulnerable
In-reply-to: <87sg8hzvdx.fsf@gnu.org>
Date: Mon, 07 Dec 2020 13:56:04 +0100
Message-ID: <87a6upepwb.fsf@web.de>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha256; protocol="application/pgp-signature"
X-Provags-ID: V03:K1:JIxta9xU1k3ipYvHmYRxogn5+dxsQ3nxTNoNvQ/+Ptdf1iiZyH1
 g/kn+XMM0GKFEyZQlk11zhEXxwgW06QV83YnTdySO5n2wCaINx+v9JGPJJLXvjd/5/rDyyM
 yKKDyOnbmj6c6yCOWhICfOE2X2ocPWosyxWKStxFoX3P5WHjnRrykLo7yz1AB7bFw0oESjd
 BFvaSvmtDvPO15EtTPMIg==
X-Spam-Flag: NO
X-UI-Out-Filterresults: notjunk:1;V03:K0:EEkqUNcVJ1M=:m/2AQAfqHpSGbkJVWnXeHH
 +nv9OBW2fsDGznuQS9Ew+RGNvmKVLt1Buqu0Gd6qvqgze5lqpZivKiX0wkg+MORdZcP0hRg+6
 JJgAzaXk8Yy49lHjr3uR/JbtvxKF0lgxe1GroXo046K3BryJD9Ls9bKs2m7SUVUhx4e37x/mW
 oGJg46lveFjMlxP9wwpmnsPZzXWKUtfh7oIMME1n8mpH4S++cTXUxIN2q+t8Agf+NVw3allgm
 4IydCgbqHRj9jzXJsraqvYblsU6wCFGq5lAWXjKNbF3trOwITCT7dw0x6jFnte+vUT6+1T26a
 ap5xlCPArBWhXwI9DtwzI14xrrhdqj9mq8cglxgmtLv5kEuXfQ4bZF7q0x89t9fCEF6WAoMez
 vCg0L9iSfXnufJY4nZrck62AcsTdAriK60LlhoFpV0UtX6f7Amh6wKKDXhdau4V26OYAbu/Al
 /c4ft/bSUol+Z5KFmhrbjbJScsyvy0kVhCr57AsHFRD76pymn1D2wASwcYtfABNnTsykH8ZWX
 Kx0feW11ldLGfMOqFdeR0OxBveO2WsUkj81pWcJkgch2A2jN4r2gur/5bLpjmmav6/Tg03iRZ
 CmHvIMzKCpotLPhnK2j3+KVc/kVVw/RkDINSw2dzIO88a3idM57N8E0Q5z9fQXrK8cu6pFSvX
 5ONonBuAy0yOeAQv1WhZGwyS3jASALp8MCps5YjnplH8t/UCuXjDrBN4MTRjIfI8hn9foD4eo
 ICasogEaZxt8uNO2lB03rldxU3GG8q15Z+od0bY5ErdOfU5UZw9zxlGQkOkvh1/QmdVDweVCw
 kvq2uOtdDspjEREq+DBRC8ZV2bDzfw3ob/TXFebOdZkf+JfKG/0Fv5vlotFx+7wBoyCGW+jdT
 fylAChq3SVfD11P4rslQ==
Received-SPF: pass client-ip=212.227.15.4; envelope-from=arne_bab@web.de;
 helo=mout.web.de
X-Spam_score_int: -27
X-Spam_score: -2.8
X-Spam_bar: --
X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001,
 SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -2.3 (--)
X-Debbugs-Envelope-To: submit
Cc: Christopher Lemmer Webber <cwebber@dustycloud.org>, bug-guix@gnu.org,
 Maxim Cournoyer <maxim.cournoyer@gmail.com>, 44808@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -2.4 (--)

[Message part 1 (text/plain, inline)]

Ludovic Courtès <ludo@gnu.org> writes:

>>> #2 is more thorough but also more risky: people could find themselves
>>> locked out of their server after reconfiguration, though this could be
>>> mitigated by a news entry.
>>>
>>> Thoughts?

My thoughts are that there is no mitigation for being locked out of a
pre-existing server. Keep in mind that that server might not actually be
accessible in any other way — it might be with a cheap hoster whose
support is practically non-existent, or it might be in a sealed
measurement container that can only be accessed via SSH without
disassembly.

>> We could also do a combination of the above, as a transitional plan:
>> do #1 for now, but try to advertise that in the future, the default will
>> be changing... please explicitly set password access to #t if you need
>> this!  Then in the *following* release, change the default.

This sounds like trying to retroactively fixing a problem at the wrong
place: If the installer creates a configuration which prevents
password-authentication, there is no problem for new systems and new
users who need password-authentication will explicitly see in the
config, that they have to change it, otherwise it won’t work. All the
while old systems will keep working.

I do need to access my system via password+ssh from time to time,
because I don’t want to have a key that can access my system on a
presentation-laptop that (due to being moved regularly) is much less
secure than the fixed system. If someone gets access to the laptop and
compromises my keys, they can run much more efficient attacks against
its ssh-keys' password than the attacks people can use to attack ssh via
internet.

Changing a default (an invisible setting) in a way that prevents access
is a serious disruption.

In short: please don’t break running systems on update.

Best wishes,
Arne
-- 
Unpolitisch sein
heißt politisch sein
ohne es zu merken

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:57:07 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#44808 Default to allowing password authentication on leaves users vulnerable