Hello, I would like to initiate a discussion about the security implications of the default sshd_config file, created after an installation of the openssh-server package.
Currently, after installing openssh-server, anyone can gain access to any user's account on the system using only the corresponding user's password. As we know, people do not necessarily use the most secure of passwords. This will especially be the case if the user does not expect his computer to be accessible in any way from the outside. But wait, why would someone install openssh-server if he does not plan on having his account being accessible through a network? Well, there are several possible scenarios: - The user is unsure what package he should install to e.g. get access to an ssh client, and so installs several related looking packages. - The user installs it by mistake by using e.g. a regex sudo apt-get install ^openssh not knowing there is an openssh-server package. - The user installs it to perform a task temporarily, e.g. to make a backup via rsync, and forgets to remove it. - Someone maliciously instructs the user to install the package. The user thinks this is safe since the package is part of the official repository. - But the main cause will be all of openssh-server's reverse dependencies. They can be listed with apt-cache rdepends openssh-server The worse offender I can see is the 'ssh' package: many people wanting an ssh client will likely just do a sudo apt-get install ssh and unwittingly end up with the server as well. - And so on... In any case, I feel that the mere installation of a package should never expose the system to new vulnerabilities, save in the case of an unknown bug of course. Furthermore, it would be considered bad security practice by pretty much any competent system administrator to use password authentication for ssh anyway. Why do the debian packagers feel it is okay to have bad security be the default? I have found that even I –a reasonably seasoned debian user– have accidentally exposed some machines on my network. Indeed, the reason, I started writing this is that I very recently found an affected device on my home network using nmap. And I dearly hope I have not left such a gaping security hole in a family member or a friend's laptop on which I helped install Ubuntu, which has the same problem by the way. I believe the current behaviour to be extremely dangerous, and that it could be (and probably has been) used to attack laptops, especially on public wifi, employees' computers on corporate networks, and personal computers on home networks (especially with IPv6 and no or poorly configured firewall). I do not know if this is the best place to start this discussion, but hopefully some changes can come of it. -- mwnx GPG: AEC9 554B 07BD F60D 75A3 AF6A 44E8 E4D4 0312 C726