190
*sshole is a banger of a name (feddit.nl)
submitted 2 days ago by to c/lemmyshitpost@lemmy.world
17 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 2 days ago (9 children)

Ok, but what's a certicate?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] [S] 3 points 2 days ago (2 children)

    Overly basically, it's a file based way to prove you can log into an account

    There is information in file that the computer can verify that you created the certificate on this computer while already having access to this account, therefore you are allowed access.

    In most contexts, digital certificates are considered more secure than a password for authentication, so in creating one, it's a pretty typical thing to disable being able to log in with a password. However, this bug allows account access with a garbage password.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 days ago (4 children)

    I think they meant certificate, and are perhaps referencing the eMudhra incident?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 2 days ago* (3 children)

    No, there was an SSH vulnerability discovered a day or two ago, which allows anyone to bypass the certificate check during authentication. So if your SSH is configured to only use a certificate, (not cert and password) then anyone can log into your shit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 2 days ago (1 child)

    Huh, I must have missed that one. Alpine/musl as well then? Got a ref?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 days ago*

    Yes, it specifically affects the OpenSSH/Alpine/musl interaction. It’s a vulnerability in how Alpine/OpenSSH interfaces with musl, and allows anyone who can reach your SSH port to instantly log into a passwordless account by entering over 256 characters into the password field.

    The vuln is nicknamed *sshole, if you want to search it. Because it only works on passwordless accounts, (meaning it has a * in the password field). And the most common use-case for passwordless accounts is because you’re using cert-based authentication instead. Thus the warnings that if you’re using cert-only SSH, you’re most likely vulnerable.

  • permalink
  • fedilink
  • source
  • parent