4

There are some man in the middle tools for ssh, which can be used to intercept ssh sessions:

The OpenSSH fork has some problems with publickey authentication accoring to an issue ticket.

Reading the documentation of the SSH-MITM project (https://docs.ssh-mitm.at/quickstart.html) the author wrote it's possible to detect if a user wants to use publickey authentication or password authentication:

SSH-MITM is able to verify, if a user is able to login with publickey authentication on the remote server. If publickey authentication is not possible, SSH-MITM falls back to password authentication. This step does not require a forwarded agent.

For a full login on the remote server agent forwarding is still required. When no agent was forwarded, SSH-MITM can redirect the connection to a honeypot.

There is an attack explained, which is called trivial authentication. It seems this attack is related to the authentication part. In chapter about the trivial authentication attack, I found a paragraph with some relevant information:

As described in the Man in the Middle attack on public key authentication chapter, it is necessary to check all public keys against the actual target server. This is necessary to find out which key would have been used for the login.

Why are the public keys checked against the target server? Is this an error in the documentation? In my understanding, the private key is necessary to login to the server and not the publickey. Knowing the publickey does not grant access to a server.

It's also explained it should be possible to find more valuable targets:

Once the key is known, potentially better targets can be searched for.

So I have some questions:

  • How is it possible to know if a user is allowed to login on a remote server with publickey authentication?
  • How to get the authentication method, which will be used by the intercepted user?
  • Is it really possible to find more valuable targets during a man in the middle attack and how does this attack work?
Improve this question
2

1 Answer 1

Reset to default
6

If an attacker knows a user's username and public key, it is possible for the attacker to determine whether an SSH server will allow the user to authenticate with this username and public key - without the attacker knowing the user's private key.

See RFC 4252, section 7.

After establishing a session with the SSH server, the attacker sends a SSH_MSG_USERAUTH_REQUEST, containing the user's username and the user's public key.

The server then responds with either SSH_MSG_USERAUTH_PK_OK (indicating that the server will allow authentication to proceed with public key authentication using this username and public key), or SSH_MSG_USERAUTH_FAILURE.

Of course, actual authentication is not possible without the user's private key. If the server responds with SSH_MSG_USERAUTH_PK_OK, then the client proceeds with authentication, by sending another SSH_MSG_USERAUTH_REQUEST request, containing a signature over the session id, made using the private key.

Improve this answer
6
  • 1
    Thanks for the RFC. So the SSH_MSG_USERAUTH_REQUEST is a kind of user enumeration, which allows to query if a user is known by a server. But how does this help the mitm server to know if a intercepted user wants to login with publickey or with password authentication. And how can a mitm attacker find more valuable targets with this information?
    – herbert-m
    Jun 13 at 11:46
  • 1
    WRT how does this help the mitm server to know if a intercepted user wants to login with publickey or with password authentication - Remember that authentication takes place after the session has been established. If the attacker has successfully MITM'd the session, then attacker can intercept everything that the client sends to the server. Therefore, attacker will see a SSH_MSG_USERAUTH_REQUEST request like that of section 8 in the RFC, indicating that the user is attempting to login using password authentication. Not only this, but the attacker will see password as well.
    – mti2935
    Jun 13 at 13:54
  • 2
    WRT, how can a mitm attacker find more valuable targets with this information - The attacker does not need an MITM position to do this. The attacker can simply probe servers that the user have have access to, by sending a SSH_MSG_USERAUTH_REQUEST containing the user's username and the user's public key. If the server responds with SSH_MSG_USERAUTH_PK_OK, then this means the user has access to this server, using this public key to authenticate.
    – mti2935
    Jun 13 at 13:59
  • @mti2935 your description of the workflow is correct but your comments should be part of the answer to be complete. most people does not read comments to find the full answer
    – Manfred Kaiser
    Jun 14 at 11:25
  • 1
    @ManfredKaiser Thanks for your suggestion. It seems that the use case for comments as compared with the use case for answers is somewhat of a grey area on this site. But, I find that posting comments seems to lead to more fluidity during any ensuing back-and-forth with the OP, so when in doubt, I tend to prefer comments. I hope that anyone interested in digging deep into this subject will read the comments following the answer.
    – mti2935
    Jun 14 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.