On ti, 02 touko 2017, Alexey Kamenskiy wrote:
>
> OpenSSH bases its decision on the length of a hostname in utmp record,
with a catch. At least on Linux, UT_HOSTSIZE is 256 but MAXHOSTNAMELEN
> in kernel is set to 64. OpenSSH uses the latter, not the former. So if
> your hostname is shorter than 64 characters, it will be canonicalized
> and provided to PAM stack as rhost. If not, your IP address will be
> provided.
AFAIK (correct me if I am wrong here) in case of OpenSSH it depends on
whether UseDNS is on or off. If off then connecting IP address is passed as
rhost, if on then it attempts to get rDNS for it and (if successful) pass
it further, these length limitations you mention apply already after this.
If UseDNS
is on, it resolves the name, if it can, but if that is
failing, you'd get string 'UNKNOWN' as your remote hostname. Otherwise
you'd get IP address as as string.
This is really badly done if you want to base your decisions on rhost.
> On the other hand to even spoof a remote host attacker needs to
know which
>> host/IP is allowed to access and also which form is entered into LDAP.
>>
> It just need to be able to connect to your system multiple times, that's
> all.
Can you please elaborate on this one? Not sure I understand exactly what
you meant.
If you have no connection throttling in place, attacker can
theoretically connect ad infinitum spoofing your IP address space and DNS.
The mere fact that you can do that to eventually hit a hole in your
access control is enough. Connect this to a social engineering to reduce
a search space and you'd see how fast it would be exploited.
Since access controls rules will be in LDAP, they will be readable for
most authenticated users, including machines. Ability to use a machine
account to do LDAP lookup pretty much makes impossible to keep
information about the access control rules private.
Sure, this is not a single step attack but nothing is so easy either these
days.
--
/ Alexander Bokovoy