rootninja

I just saw a recent article describing some simple ssh attacks that looked a little funny to me. So I figured I’ll test them out. The one that smelled funny was using local and remote port forwarding on itself, localhost. It just doesn’t work on modern linux hosts. I tried it on a fresh gentoo install, a new fedora 10 install, and an old fedora 8 workhorse. You just can’t open more than 1024 descriptors by default in all cases, hmm except maybe as root, but that’s not the point here. Linux says “Sign’s point to ye…yeah NO.” But this article was from January 2009. So wtf? Banging away on old FreeBSD servers long forgotten in someones closet or something?

I was originally poking around at getting by /bin/false or /bin/nologin because I was wondering what happened if you just replaced the bin file with a copy of a working shell and then set a password for the account. Some good accounts that came to mind would be ldap, sshd, and postmaster :) But it looks like there’s already group restrictions set up BY DEFAULT.

no dice…

security dos, old, port forwarding, ssh

Accessing the hidden VMware ESXi service console was supposed to be done only while working directly with a VMware technician, but it’s just so darn handy when you’re a command line junkie, that how can you resist right?

1. From the ESXi console summary screen hit ALT-F1.
2. Type the word “unsupported†(without the quotes of course, and you won’t see anything on the screen…)
3. Enter your root password at the prompt.

Voila. You should see a big fat red warning that will either scare you off or just tickle a little bit.

Now you can navigate around and edit your configs using vi. While you’re here, why not enable ssh? Just uncomment it from your /etc/inetd.conf

Now that you know how, don’t do it. Or at least, don’t blame me when things break.

ooo! Shiny... esxi, hidden console, root, ssh, vmware

[user@localhost ~]$  cat ~/.ssh/id_rsa.pub ~/.ssh/id_dsa.pub | ssh user@remotehost ’sh -c “cat - >> ~/.ssh/authorized_keys”‘

You’ll be prompted for the password just this one last time.  This is perfect for running a script that runs several remote commands through ssh.  Here’s a script that checks for your keys and adds them if they’re not there.  You’ll get prompted for a password twice if the keys didn’t already exist, and then no more.

Another way around the password prompting issue from running a bunch of ssh commands is to branch the script and have one branch check your hostname to make sure you’re not the remote host and then start running all your commands.  When you get to the stuff you want to do remotely, echo the script across your ssh tunnel and execute it.  Now in the script, go into the 2nd branch that only runs if the hostname check matches the remote host, and it will skip down to this part on the remote run.  This gets around having a 2nd script with all your remote commands in it.  It might not be elegant, but it works!

Linux authorized_keys, bash, ssh

Create some new directories:

Create a startup script for the random number generator in /etc/init.d

Create a startup script for sshd in /etc/init.d

Don’t forget to link them both in /etc/rc2.d so they’ll start automatically.  I used 50 and 99 to try to make sure that prngd starts before sshd fires up.

Create ssh public key pairs.  Don’t change these output names, the daemon expects them to be named like this and if you change them, you’ll see an error like no key found, ssh v1 not starting.  But who really cares, right?

Start the daemons and you should be good to go.  If you’re getting PRNGD not seeded errors, go take care of some other stuff, it will eventually stop as long as you installed prngd properly and started it up.  Generating the keys will probably take forever if you’re on an old Ultra 1 like me, give them a minute or two.  Entropy will take forever+1.  You can fill the seed files with garbage data if you want to speed it up.  If you’re still getting PRNGD errors an hour later, you could try the kernel patch to add /dev/random /dev/urandom support directly to the kernel.  (Sun patch 112438-03) I chose not to because I didn’t want to risk something going terribly wrong with this machine.  It’s unique in my environment and been shoved in a corner and forgotten about for a long time until now!

I also installed bash and top.  Bash was a no brainer!  I hate old ksh shells with broken backspaces, arrow keys, and lack of a command history.  They were both installed with pkgadd -d, no additional script writing or directory creating necessary.  If you have library issues after installed, run ldd on the binaries and do a google search to find what libraries packages you need.

Uncategorized ancient, bash, egd, gcc, popt, prngd, rsync, solaris, ssh, ssl, sun, sunfreeware, sunos, top, zlib