2

Scenario

One of my customers has some Debian based boxes directly accessible on the Internet with no firewalling on the ssh port. Those boxes are configured for an "instant" mail notification when a remote ssh user succesfully logs in:

me@server:~$ sudo cat /etc/ssh/sshrc

ip=`echo $SSH_CONNECTION | cut -d " " -f 1`
logger -t ssh-wrapper $USER login from $ip
echo "User $USER just logged in to $(hostname) from $ip" | mail -s "SSH Login" -- security@customer.dom &

I was wondering if this can actually be considered a (good) security notification, as the user who logs in is executing this command, and thus a malicious user might have control over such an event. It obviously happens milliseconds after login, so it should be very hard for an attacker to catch it, but I'm still not sure that a remote user can't circumvent this server side global sshrc.

For instance, I've been working for them for months and didn't even noticed it, but they received such a notification each time I logged in. They pointed my attention on it, because they said they changed something in one of their scripts, that is now generating much more connections than before, and thus they asked me to prevent this user from generating the notification in order to prevent the mailbox to be flooded.

As I'm an instinctive guy, I promptly added an if to match the user that shouldn't generate the notification, and that did the trick, but I think that this makes this measure even weaker than what it already looked like.

I don't know if it's possible, I tried many different searches that didn't returned anything relevant, but if a user on the client side may be able to specify a different path for the sshrc, for instance, this measure would miserably fail. If the MTA has a full queue and the user is able to elevate it might easily dequeue/delay the mail, that's why I'd swap the mail with an SMS service at least.

That's just some of my doubts, and that's why I'm planning to talk to the customer's CIO about this weakness, and would like to have your opinion about that. Of course, he will ask me "what do you think a most secure and still free solution would be?" Cash is always The King.

Honestly I have not yet an answer for such question, but I think that if they want to keep this "logic", at least, root should watch the log and notify when each user logs in. No every minute crontab as they want such notifications to be instant. So I think I might script something with fileschanged and tail, and either use SMS or keep the mail as the customer prefers. That would be executed by root and thus won't be under the user's control.

Questions

-Is it possible for a remote unprivileged user to disable server's sshrc client-side?

-The customer wants to keep this kind of notification, so good or bad, do you consider this way to get it a good way?

-Is there any other free way to be promptly notified on an ssh login, in a non circumventable manner?

-Don't you think it would be more secure switching from email to SMS?

  • I don't think the answer replies to some points, about the opportunity to "watch the logs as root" as well as "Is it possible for a remote unprivileged user to disable server's sshrc from the client side". – Marco Sep 4 '17 at 15:37
  • Well, what should I answer here? You know that your file watch is possible, and told you already it's ot necessary (because PAM). And a user that knows some bug (that is not yet publicly known) could be able to circumveit sshrc, but that's true for all things. – user155462 Sep 5 '17 at 7:38
3

About the insecurity, imho, you're thinking in the wrong direction.
What bad things do you think this system is preventing? Absolutely nothing, and that's why it cant fail to prevent it. On the opposite, it's added security; because if someone gains unauthorized access, there's at least a chance that he didn't know about (or couldn't prevent) the mail.

The only thing to remember the customer is that relying on the mails too much isn't good. As alert, fine, as single source of truth ("we are not hacked because there's no mail"), no. There are too many ways emails can fail, and too many ways to get hacked without proper SSH login.

About the firewall, if someone blocks incomding SSH connections then nobody can login anymore. That's probably not helpful.

About a method that doesn't rely on the user and shell, PAM can do it too. See https://serverfault.com/questions/395393/email-notification-about-each-ssh-connection-to-linux-server
There is even an option to deny login if the command failed, but in this case, that's not really helpful (no login because the mailserver is down or whatever, and successfully sending it to the server doesn't mean that it arrived at the receiver).

About SMS, no, they are not more secure than emails.

  • "...with no firewalling on the ssh port..." I meant that IP based ACLs or GEOIP based ACLs may help too. Thanks for your contribution. – Marco Sep 4 '17 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.