#44808 - Default to allowing password authentication on leaves users vulnerable

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #73 received at 44808@debbugs.gnu.org (full text, mbox, reply):

Received: (at 44808) by debbugs.gnu.org; 9 Dec 2020 01:32:15 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue Dec 08 20:32:15 2020
Received: from localhost ([127.0.0.1]:60320 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1kmoL1-0007tF-7L
	for submit@debbugs.gnu.org; Tue, 08 Dec 2020 20:32:15 -0500
Received: from world.peace.net ([64.112.178.59]:47250)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mhw@netris.org>) id 1kmoKz-0007sz-GR
 for 44808@debbugs.gnu.org; Tue, 08 Dec 2020 20:32:14 -0500
Received: from mhw by world.peace.net with esmtpsa
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92)
 (envelope-from <mhw@netris.org>)
 id 1kmoKt-0005NK-Ke; Tue, 08 Dec 2020 20:32:07 -0500
From: Mark H Weaver <mhw@netris.org>
To: Ludovic Courtès <ludo@gnu.org>
Subject: Re: bug#44808: Default to allowing password authentication on
 leaves users vulnerable
In-Reply-To: <87wnxswpmk.fsf@gnu.org>
References: <878sat3rnn.fsf@dustycloud.org> <874klgybbs.fsf@zancanaro.id.au>
 <87im9w2gjt.fsf@dustycloud.org> <87im9nmr5u.fsf@gmail.com>
 <87eek45lpg.fsf@gnu.org> <87k0twkt9c.fsf@dustycloud.org>
 <87sg8hzvdx.fsf@gnu.org> <87a6upepwb.fsf@web.de>
 <87sg8hlfyu.fsf@dustycloud.org> <871rg1e6js.fsf@web.de>
 <87im9ddy0r.fsf@netris.org> <87wnxswpmk.fsf@gnu.org>
Date: Tue, 08 Dec 2020 20:31:16 -0500
Message-ID: <87lfe7ydc0.fsf@netris.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 44808
Cc: Christopher Lemmer Webber <cwebber@dustycloud.org>,
 "Dr. Arne Babenhauserheide" <arne_bab@web.de>, maxim.cournoyer@gmail.com,
 44808@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi Ludovic,

Ludovic Courtès <ludo@gnu.org> writes:

> Mark H Weaver <mhw@netris.org> skribis:
>
>> "Dr. Arne Babenhauserheide" <arne_bab@web.de> writes:
>>> To nudge them to secure their system, guix system reconfigure could emit
>>> a warning that this is a potential security risk that requires setting
>>> an explicit value (password yes or no) to silence.
>>
>> I think this is a good idea.  Likewise, in the Guix installer, I would
>> favor asking the user whether or not to enable password authentication,
>> after warning them that it is a security risk.
>>
>> I agree with Chris that password authentication is a significant
>> security risk, but I also worry that if we simply disable it, it will
>> catch some users by surprise and they may be quite unhappy about it.
>
> What do you think of the approach in
> <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=aecd2a13cbd8301d0fdeafcacbf69e12cc3f6138>?

One problem, which I just discovered, is that it warns users even if
they don't have an 'openssh-service' in their system configuration.
(For that reason, I just reverted this commit on my private branch).

> The default is unchanged but the warning could be kept say until the
> next release, at which point we’d change the default.
>
> Or are you suggesting keeping the default unchanged?

I don't feel strongly about what the default setting should be, as long
as we ensure that users are somehow made aware of the change before it
happens, and are given the opportunity (and preferably easy instructions
on how) to keep password authentication enabled if they wish.

I also think that the installer should explicitly ask the user what the
setting should be, so that we do not catch new users off guard who
expected to be able to ssh in to their newly-installed systems using
only a password.

If the plan is to change the default setting and issue warnings in the
meantime, it should be easy to silence those warnings, especially for
those of us who don't even use openssh-service :)

What do you think?

      Regards,
        Mark

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 02:34:48 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#44808 Default to allowing password authentication on leaves users vulnerable