SSH passwords should not have been enabled for login over the Internet. Although the Infrastructure Team had attempted to configure the sshd daemon to disable password-based logins, having
UsePAM yesset meant that password-based logins were still possible.
I take this to mean that they set this in
UsePAM yes(the default)
I found a relevant question where the answer cites the following from the sshd config file:
# Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM yes
- So an attacker can bypass
- Is that what probably happened here, or am I misunderstanding what the Apache blog describes?
- What is the point of disabling
without-passwordthen? I mean, in what scenario does it make sense to use these if it can be bypassed?
- Can one test if
ChallengeResponseAuthenticationis set on a server without valid credentials? Can external attackers tell that a server is a juicy target if they don't have credentials to try with?