* [PATCH 1/2] openssh: package sshd PAM config inside openssh-sshd package
@ 2013-10-11 13:37 Koen Kooi
2013-10-11 13:37 ` [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well Koen Kooi
0 siblings, 1 reply; 9+ messages in thread
From: Koen Kooi @ 2013-10-11 13:37 UTC (permalink / raw)
To: openembedded-core
Without this PAM integration is broken after installing openssh-sshd
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
meta/recipes-connectivity/openssh/openssh_6.2p2.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-connectivity/openssh/openssh_6.2p2.bb b/meta/recipes-connectivity/openssh/openssh_6.2p2.bb
index bb5c79e..4b44bf4 100644
--- a/meta/recipes-connectivity/openssh/openssh_6.2p2.bb
+++ b/meta/recipes-connectivity/openssh/openssh_6.2p2.bb
@@ -120,7 +120,7 @@ PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc $
FILES_${PN}-scp = "${bindir}/scp.${BPN}"
FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd"
-FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd"
+FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
FILES_${PN}-sftp = "${bindir}/sftp"
FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
--
1.8.3.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-11 13:37 [PATCH 1/2] openssh: package sshd PAM config inside openssh-sshd package Koen Kooi
@ 2013-10-11 13:37 ` Koen Kooi
2013-10-12 8:37 ` Richard Purdie
0 siblings, 1 reply; 9+ messages in thread
From: Koen Kooi @ 2013-10-11 13:37 UTC (permalink / raw)
To: openembedded-core
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
index 4f9b626..175e8f3 100644
--- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
+++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
@@ -59,7 +59,7 @@ Protocol 2
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
-#PermitEmptyPasswords no
+PermitEmptyPasswords yes
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
--
1.8.3.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-11 13:37 ` [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well Koen Kooi
@ 2013-10-12 8:37 ` Richard Purdie
2013-10-13 10:01 ` Koen Kooi
0 siblings, 1 reply; 9+ messages in thread
From: Richard Purdie @ 2013-10-12 8:37 UTC (permalink / raw)
To: Koen Kooi; +Cc: openembedded-core
On Fri, 2013-10-11 at 15:37 +0200, Koen Kooi wrote:
> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
> ---
> meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> index 4f9b626..175e8f3 100644
> --- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> +++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> @@ -59,7 +59,7 @@ Protocol 2
>
> # To disable tunneled clear text passwords, change to no here!
> #PasswordAuthentication yes
> -#PermitEmptyPasswords no
> +PermitEmptyPasswords yes
>
> # Change to no to disable s/key passwords
> #ChallengeResponseAuthentication yes
I'm struggling to connect the "if PAM allows it as well" part of the
shortlog to this change? How is this conditional on PAM?
Cheers,
Richard
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-12 8:37 ` Richard Purdie
@ 2013-10-13 10:01 ` Koen Kooi
2013-10-13 13:39 ` Richard Purdie
0 siblings, 1 reply; 9+ messages in thread
From: Koen Kooi @ 2013-10-13 10:01 UTC (permalink / raw)
To: Richard Purdie; +Cc: openembedded-core
Op 12 okt. 2013, om 10:37 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
> On Fri, 2013-10-11 at 15:37 +0200, Koen Kooi wrote:
>> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
>> ---
>> meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>> index 4f9b626..175e8f3 100644
>> --- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>> +++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>> @@ -59,7 +59,7 @@ Protocol 2
>>
>> # To disable tunneled clear text passwords, change to no here!
>> #PasswordAuthentication yes
>> -#PermitEmptyPasswords no
>> +PermitEmptyPasswords yes
>>
>> # Change to no to disable s/key passwords
>> #ChallengeResponseAuthentication yes
>
> I'm struggling to connect the "if PAM allows it as well" part of the
> shortlog to this change? How is this conditional on PAM?
If PAM disallows empty passwords this option doesn't do anything. The PAM rules run before the openssh config options get applied.
regards,
Koen
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-13 10:01 ` Koen Kooi
@ 2013-10-13 13:39 ` Richard Purdie
2013-10-13 15:30 ` Koen Kooi
0 siblings, 1 reply; 9+ messages in thread
From: Richard Purdie @ 2013-10-13 13:39 UTC (permalink / raw)
To: Koen Kooi; +Cc: openembedded-core
On Sun, 2013-10-13 at 12:01 +0200, Koen Kooi wrote:
> Op 12 okt. 2013, om 10:37 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
>
> > On Fri, 2013-10-11 at 15:37 +0200, Koen Kooi wrote:
> >> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
> >> ---
> >> meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >> index 4f9b626..175e8f3 100644
> >> --- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >> +++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >> @@ -59,7 +59,7 @@ Protocol 2
> >>
> >> # To disable tunneled clear text passwords, change to no here!
> >> #PasswordAuthentication yes
> >> -#PermitEmptyPasswords no
> >> +PermitEmptyPasswords yes
> >>
> >> # Change to no to disable s/key passwords
> >> #ChallengeResponseAuthentication yes
> >
> > I'm struggling to connect the "if PAM allows it as well" part of the
> > shortlog to this change? How is this conditional on PAM?
>
> If PAM disallows empty passwords this option doesn't do anything. The
> PAM rules run before the openssh config options get applied.
What if PAM isn't being used?
Cheers,
Richard
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-13 13:39 ` Richard Purdie
@ 2013-10-13 15:30 ` Koen Kooi
2013-10-14 8:25 ` Richard Purdie
0 siblings, 1 reply; 9+ messages in thread
From: Koen Kooi @ 2013-10-13 15:30 UTC (permalink / raw)
To: Richard Purdie; +Cc: openembedded-core
Op 13 okt. 2013, om 15:39 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
> On Sun, 2013-10-13 at 12:01 +0200, Koen Kooi wrote:
>> Op 12 okt. 2013, om 10:37 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
>>
>>> On Fri, 2013-10-11 at 15:37 +0200, Koen Kooi wrote:
>>>> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
>>>> ---
>>>> meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
>>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>>
>>>> diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>>>> index 4f9b626..175e8f3 100644
>>>> --- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>>>> +++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>>>> @@ -59,7 +59,7 @@ Protocol 2
>>>>
>>>> # To disable tunneled clear text passwords, change to no here!
>>>> #PasswordAuthentication yes
>>>> -#PermitEmptyPasswords no
>>>> +PermitEmptyPasswords yes
>>>>
>>>> # Change to no to disable s/key passwords
>>>> #ChallengeResponseAuthentication yes
>>>
>>> I'm struggling to connect the "if PAM allows it as well" part of the
>>> shortlog to this change? How is this conditional on PAM?
>>
>> If PAM disallows empty passwords this option doesn't do anything. The
>> PAM rules run before the openssh config options get applied.
>
> What if PAM isn't being used?
I haven't tested that, but I suspect it will only allow empty passwords if you set it to 'yes'.
regards,
Koen
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-13 15:30 ` Koen Kooi
@ 2013-10-14 8:25 ` Richard Purdie
2013-10-14 8:51 ` Koen Kooi
0 siblings, 1 reply; 9+ messages in thread
From: Richard Purdie @ 2013-10-14 8:25 UTC (permalink / raw)
To: Koen Kooi; +Cc: openembedded-core
On Sun, 2013-10-13 at 17:30 +0200, Koen Kooi wrote:
> Op 13 okt. 2013, om 15:39 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
>
> > On Sun, 2013-10-13 at 12:01 +0200, Koen Kooi wrote:
> >> Op 12 okt. 2013, om 10:37 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
> >>
> >>> On Fri, 2013-10-11 at 15:37 +0200, Koen Kooi wrote:
> >>>> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
> >>>> ---
> >>>> meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
> >>>> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>>>
> >>>> diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >>>> index 4f9b626..175e8f3 100644
> >>>> --- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >>>> +++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >>>> @@ -59,7 +59,7 @@ Protocol 2
> >>>>
> >>>> # To disable tunneled clear text passwords, change to no here!
> >>>> #PasswordAuthentication yes
> >>>> -#PermitEmptyPasswords no
> >>>> +PermitEmptyPasswords yes
> >>>>
> >>>> # Change to no to disable s/key passwords
> >>>> #ChallengeResponseAuthentication yes
> >>>
> >>> I'm struggling to connect the "if PAM allows it as well" part of the
> >>> shortlog to this change? How is this conditional on PAM?
> >>
> >> If PAM disallows empty passwords this option doesn't do anything. The
> >> PAM rules run before the openssh config options get applied.
> >
> > What if PAM isn't being used?
>
> I haven't tested that, but I suspect it will only allow empty passwords if you set it to 'yes'.
Let me put this a different way. I think this commit allows empty
passwords for users both using PAM and those who are not. I think the
commit message needs to clearly say that as its a fairly serious
security change for both cases.
I'm not actually sure this makes sense as a default and it may be better
off being configurable, defaulting to off...
Cheers,
Richard
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-14 8:25 ` Richard Purdie
@ 2013-10-14 8:51 ` Koen Kooi
2013-10-14 9:32 ` Richard Purdie
0 siblings, 1 reply; 9+ messages in thread
From: Koen Kooi @ 2013-10-14 8:51 UTC (permalink / raw)
To: Richard Purdie; +Cc: openembedded-core
Op 14 okt. 2013, om 10:25 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
> On Sun, 2013-10-13 at 17:30 +0200, Koen Kooi wrote:
>> Op 13 okt. 2013, om 15:39 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
>>
>>> On Sun, 2013-10-13 at 12:01 +0200, Koen Kooi wrote:
>>>> Op 12 okt. 2013, om 10:37 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
>>>>
>>>>> On Fri, 2013-10-11 at 15:37 +0200, Koen Kooi wrote:
>>>>>> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
>>>>>> ---
>>>>>> meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
>>>>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>>
>>>>>> diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>>>>>> index 4f9b626..175e8f3 100644
>>>>>> --- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>>>>>> +++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
>>>>>> @@ -59,7 +59,7 @@ Protocol 2
>>>>>>
>>>>>> # To disable tunneled clear text passwords, change to no here!
>>>>>> #PasswordAuthentication yes
>>>>>> -#PermitEmptyPasswords no
>>>>>> +PermitEmptyPasswords yes
>>>>>>
>>>>>> # Change to no to disable s/key passwords
>>>>>> #ChallengeResponseAuthentication yes
>>>>>
>>>>> I'm struggling to connect the "if PAM allows it as well" part of the
>>>>> shortlog to this change? How is this conditional on PAM?
>>>>
>>>> If PAM disallows empty passwords this option doesn't do anything. The
>>>> PAM rules run before the openssh config options get applied.
>>>
>>> What if PAM isn't being used?
>>
>> I haven't tested that, but I suspect it will only allow empty passwords if you set it to 'yes'.
>
> Let me put this a different way. I think this commit allows empty
> passwords for users both using PAM and those who are not.
Right
> I think the
> commit message needs to clearly say that as its a fairly serious
> security change for both cases.
Right again.
> I'm not actually sure this makes sense as a default and it may be better
> off being configurable, defaulting to off...
Allowing passwordless (well, null passwords to be exact) logins is the current default for both PAM and dropbear, openssh is the odd one out. I don't really care what the default should be, just that all 3 should use the same :)
So should I resubmit this patch with an amended commit message or rework it and change the defaults in PAM and dropbear as well?
regards,
Koen
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well
2013-10-14 8:51 ` Koen Kooi
@ 2013-10-14 9:32 ` Richard Purdie
0 siblings, 0 replies; 9+ messages in thread
From: Richard Purdie @ 2013-10-14 9:32 UTC (permalink / raw)
To: Koen Kooi; +Cc: openembedded-core
On Mon, 2013-10-14 at 10:51 +0200, Koen Kooi wrote:
> Op 14 okt. 2013, om 10:25 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
>
> > On Sun, 2013-10-13 at 17:30 +0200, Koen Kooi wrote:
> >> Op 13 okt. 2013, om 15:39 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
> >>
> >>> On Sun, 2013-10-13 at 12:01 +0200, Koen Kooi wrote:
> >>>> Op 12 okt. 2013, om 10:37 heeft Richard Purdie <richard.purdie@linuxfoundation.org> het volgende geschreven:
> >>>>
> >>>>> On Fri, 2013-10-11 at 15:37 +0200, Koen Kooi wrote:
> >>>>>> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
> >>>>>> ---
> >>>>>> meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config | 2 +-
> >>>>>> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>>>>>
> >>>>>> diff --git a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >>>>>> index 4f9b626..175e8f3 100644
> >>>>>> --- a/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >>>>>> +++ b/meta/recipes-connectivity/openssh/openssh-6.2p2/sshd_config
> >>>>>> @@ -59,7 +59,7 @@ Protocol 2
> >>>>>>
> >>>>>> # To disable tunneled clear text passwords, change to no here!
> >>>>>> #PasswordAuthentication yes
> >>>>>> -#PermitEmptyPasswords no
> >>>>>> +PermitEmptyPasswords yes
> >>>>>>
> >>>>>> # Change to no to disable s/key passwords
> >>>>>> #ChallengeResponseAuthentication yes
> >>>>>
> >>>>> I'm struggling to connect the "if PAM allows it as well" part of the
> >>>>> shortlog to this change? How is this conditional on PAM?
> >>>>
> >>>> If PAM disallows empty passwords this option doesn't do anything. The
> >>>> PAM rules run before the openssh config options get applied.
> >>>
> >>> What if PAM isn't being used?
> >>
> >> I haven't tested that, but I suspect it will only allow empty passwords if you set it to 'yes'.
> >
> > Let me put this a different way. I think this commit allows empty
> > passwords for users both using PAM and those who are not.
>
> Right
>
> > I think the
> > commit message needs to clearly say that as its a fairly serious
> > security change for both cases.
>
> Right again.
>
> > I'm not actually sure this makes sense as a default and it may be better
> > off being configurable, defaulting to off...
>
> Allowing passwordless (well, null passwords to be exact) logins is the
> current default for both PAM and dropbear, openssh is the odd one out.
> I don't really care what the default should be, just that all 3 should
> use the same :)
Agreed, and I wish you'd said that in the original commit message as it
does make a difference ;-).
> So should I resubmit this patch with an amended commit message or
> rework it and change the defaults in PAM and dropbear as well?
I'd resend with a revised commit message including the above
justification. I'm not guaranteeing I'll take it, I'm hoping we'll get
some further discussion on the subject.
I think ultimately we need to have a config option for this which pam,
dropbear and openssh all honour. Could you add an enhancement request to
the Yocto bugzilla to that end please? That way people can clearly opt
in to specific configurations. I think its important to get security
details like this right.
Cheers,
Richard
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2013-10-14 9:32 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-11 13:37 [PATCH 1/2] openssh: package sshd PAM config inside openssh-sshd package Koen Kooi
2013-10-11 13:37 ` [PATCH 2/2] openssh: allow empty passwords if PAM allows it as well Koen Kooi
2013-10-12 8:37 ` Richard Purdie
2013-10-13 10:01 ` Koen Kooi
2013-10-13 13:39 ` Richard Purdie
2013-10-13 15:30 ` Koen Kooi
2013-10-14 8:25 ` Richard Purdie
2013-10-14 8:51 ` Koen Kooi
2013-10-14 9:32 ` Richard Purdie
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox