OpenSSH patch

Steve Grubb sgrubb at redhat.com
Thu Aug 20 15:01:38 UTC 2015


On Monday, August 17, 2015 12:18:44 PM Shawn Wells wrote:
> On 8/14/15 3:33 PM, Steve Grubb wrote:
> > On Friday, August 14, 2015 01:47:49 PM Ron Colvin wrote:
> >> >A patch for the SSH bug that bypassed the MaxAuthTries limit was just
> >> >patched. Has MaxAuthTries been considered as a control in the security
> >> >guide?
> > 
> > The default value for this is set to "no". We set UsePam to "yes". Some
> > platforms do not have PAM and openssh replicates some of that
> > functionality in their code. If you want to control the maximum number of
> > login attempts, you should use the pam_faillock module. It is an
> > improvement over pam_tally2 in that it tracks login attempts per user.
> > Pam_tally2 is global. Both are hooked into the audit system while
> > openssh's  MaxAuthTries is not.
> 
> While we configure PAM controls, and assume SSH is using them via
> "UsePam yes", there isn't a validation check for "UsePam." Should there be?

In this particular case, it might be good to have in place. There could also 
be legitimate uses with it being no. The reason I go along with the check is 
because other checks are predicated with pam being in use,

That said, are there checks that /etc/pam.d/sshd is in the correct 
configuration? :-)

-Steve


More information about the scap-security-guide mailing list