1

When deleting a user on a Linux system, if you lock their password and kill all their processes, a logged in user disconnects and can't log in with his password anymore.

But if they still have an authorized SSH key, they will be able to reconnect before I delete the key along with their home directory.

No problem here, but it got me thinking. Which other ways does a user have to log in? I know that they could create cronjobs etc. And that if they have a reverse shell they could come back. But the shell should be gone after the home directory is deleted and the user's processes are killed.

What kinds of backdoors can a user leave to be able to comeback after user deletion?

Are there any exotic login methods which can be abused?

2
  • "exotic login methods" - basically anything. If a privileged process or the kernel is compromised/backdoored any network packet could be used to provide access - see for example the TCP/32764 backdoor. Or a web shell can be left if there is a web server on the system. And many other ways. Commented Aug 4, 2022 at 13:30
  • @SteffenUllrich ouch, the router exploit.. Thanks for the answer! Yeah after the kernel is compromised it's game over. But I'm not considering this scenario at the moment. Just thinking of techniques to circumvent user deletion and stay connected by abusing a multitude of authentification mecanisms.
    – lolz
    Commented Aug 5, 2022 at 6:38

2 Answers 2

1

It depends on the OpenSSH server configuration. By default, it will only support standard password authentication, keyboard-interactive authentication (i.e. anything supported by login.conf(5)) and public key authentication. It supports many exotic authentication methods, and because it supports PAM, it can support nearly anything. If you kill all their processes and remove their account, there is not much they can do unless they have compromised another account.

Note that you can require the user to pass multiple authentication methods to be let in. For example, you can require that they both possess the right key as well as enter a password. Removing any one of those authentication mechanisms will lock the user out.

2
  • Thanks for the answer! Yeah I know that with PAM you could plug anything in. But I wonder if there is any PAM's that are actually popular enough to a point of being somewhat often seen on systems and thus leaving another option to connect.
    – lolz
    Commented Aug 5, 2022 at 6:31
  • @lolz Generally, no. Not on common shell servers.
    – forest
    Commented Aug 5, 2022 at 20:31
0

Any of these in /etc/ssh/sshd_config provides potentially another way to authenticate to sshd:

TrustedUserCAKeys /etc/ssh/path_to_ca_key
RhostsAuthentication Yes
RhostsRSAAuthentication
IgnoreRhosts no
PermitRootLogin yes
PermitEmptyPassword yes
KerberosAuthentication yes
GSAPIAuthentication yes
UsePAM yes
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .