Date: Wed, 28 Feb 2001 19:09:49 -0700 From: Aaron D.Gifford <agifford@infowest.com> To: freebsd-security@freebsd.org Subject: RE: ssh tricks (was Re: ssh -t <host> /bin/sh trick (was Re: ftp Message-ID: <01022819094900.04839@jardan.infowest.com>
next in thread | raw e-mail | index | archive | help
Since the topic strayed to SSH tricks, here's another to keep your eyes open for: Assuming that /sbin/ftponly is a hard link to /sbin/nologin and /sbin/ftponly is in /etc/shells on a FreeBSD 4.2-STABLE as of Jan. or Feb. 2001 system running FTP and SSH services (the built-in ones that are a part of FreeBSD), consider the following: user:password.:101:101::0:0:Some FTP User:/home/ftponly/user:/sbin/ftponly If this user attempts to log in using SSH to a shell, he/she will see the FreeBSD MOTD banner, then the line "This account is currently not available." after which the connection is terminated. With regard to the mentioned "ssh -t" trick, on my 4.2-STABLE box it does not work, giving the user just the single line message that the account is not available. So you think you're completely safe. Maybe you are... BUT... Are you aware that the FreeBSD SSH installation by default has TCP forwarding enabled? Are you completely aware of the implications? Smart admin. that you are, you completely understand that this FTP-only user can still do fun stuff like: ssh -l user your.ftp.server.host -L 7777:some.smtp.relay:25 -N The user then uses this forwarding to send spam via your FTP server, which spam looks like it came from your FTP server (it did, via the SSH forwarded TCP connection). And your logging might not catch it (depending on your how you have configured sshd logging) since utmp/wtmp won't show a thing. All sorts of other interesting possibilities exist too. Just another SSH trick/feature to be aware of when limiting shell access for accounts (like FTP-only, or chrsh). If there's anything I'm missing in the above, additional tricks I (and others) should watch out for, etc., please let me know. I love to learn new things. Aaron out. -- www.aarongifford.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?01022819094900.04839>