To avoid this, there seem to be two approaches:
- remove those dependancies (see below)
- confine the impact of those dependancies, as proposed
by some developpers, in having those dependancies confined
(not examined here)
To solve this, I could use a Bastion host with a limited, non Debian,
OS, or I could recompile the OpenSSH package on Debian with options
disabled.
What do you think about this approach?
To solve this, I could use a Bastion host with a limited, non Debian,
OS, or I could recompile the OpenSSH package on Debian with options
disabled.
systemd dependancies that are activated on a Debian system imply a lot
of library injections into sshd, much more than the stock OpenBSD ssh.
To avoid this, there seem to be two approaches:
- remove those dependancies (see below)
- confine the impact of those dependancies, as proposed
by some developpers, in having those dependancies confined
(not examined here)
To solve this, I could use a Bastion host with a limited, non Debian,
OS, or I could recompile the OpenSSH package on Debian with options
disabled.
What do you think about this approach?
Hi,
On Fri, Apr 11, 2025 at 08:12:14PM +0200, Marc SCHAEFER wrote:
systemd dependancies that are activated on a Debian system imply a lot
of library injections into sshd, much more than the stock OpenBSD ssh.
What do you think about this approach?
I think you're wasting your time and should not have sshd listen on the public Internet at all, instead VPN in to your network and only have
sshd available on the inside.
On 12/4/25 13:24, [email protected] wrote:
So, share your wisdom with us: what makes ssh less secure than
"a VPN"?
It's quite simple. If you have a VPN exposed to the internet and an ssh service then you have two attack surfaces in parallel. Breach either one and you breach the system
- you didn't explain how "a VPN's" mechanism is inherently more
secure than sshd's, given that their mechanisms are all pretty
similar.
- Your category "a VPN" is hopelessly too broad (that's why I
put it in quotes). What do you mean? IPSec? OpenVPN? Wireguard?
CIPE? Some proprietary thing (there are loads of them)?
Since security depends critically on implementation details and
the dedication of the group behind the software, the above is quite
relevant.
Hello,
Jumping into your interesting ssh vs VPN discussion:
I do not assume those kernel codes are unsafe, I am pretty sure they
have audited them. It just makes the attack surface much bigger.
sometimes, yes, I think [VPNs] are overblown compared to a "simple"
ssh server.
Wireguard, for example, is mostly kernel-side BTW.
I do not assume those kernel codes are unsafe, I am pretty sure they
have audited them. It just makes the attack surface much bigger.
On Sat, Apr 12, 2025 at 1:44 AM tomas wrote:
On Sat, Apr 12, 2025 at 01:32:06PM +0800, jeremy ardley wrote:
On 12/4/25 13:24, tomas wrote:
So, share your wisdom with us: what makes ssh less secure than
"a VPN"?
It's quite simple. If you have a VPN exposed to the internet and an ssh service then you have two attack surfaces in parallel. Breach either one and
you breach the system
What if you don't even need the VPN (as is often the case)?
Is port 22 the only thing you've got open? What does
sudo ss -anltup
show?
I've got a lot more than SSH/22 open, so if I was going to put this
machine on the internet I'd want most of those ports turned off.
would you be open to using another implementation of an ssh server?
If so, it would be a third approach:
My laptop has one to two handful of these, depending on what I'mI taking a class at the local library; my laptop has avahi and cups
currently playing with.
ports open .. which I'm not thrilled about but I like the zero-conf
printing ability.
I taking a class at the local library; my laptop has avahi and cups
ports open .. which I'm not thrilled about but I like the zero-conf
printing ability.
My laptop has one to two handful of these, depending on what I'mI taking a class at the local library; my laptop has avahi and cups
currently playing with.
ports open .. which I'm not thrilled about but I like the zero-conf printing ability.
Why do you need cups ports open to print?
I understand you need the cups port to be open on the side of the
printer (or print-server), but not on the side of the machine that sends
the print job.
Am I missing something?
If you
sudo systemctl disable cups # and maybe others
didier@hp-notebook14:~$ ldd /usr/sbin/tinysshd
linux-vdso.so.1 (0x00007ffdb29f7000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f54a996c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f54a9c2e000)
that seems to me pretty minimal ;-)
I wrote:
If you
sudo systemctl disable cups # and maybe others
Actually, if you follow the discussion, the CUPS Bonjour auto-discovery
- it presumably handled by the cups-browsed package
(you can uninstall it, or systemctl disable it,
if you don't want printer auto-detection on your
network)
- it could also be handled by mDNS (?)
please take all that precedes with a grain of salt: I do not install and set up ssh servers :-)
Hello,
systemd dependancies that are activated on a Debian system imply a lot
of library injections into sshd, much more than the stock OpenBSD ssh.
To avoid this, there seem to be two approaches:
- remove those dependancies (see below)
- confine the impact of those dependancies, as proposed
by some developpers, in having those dependancies confined
(not examined here)
To solve this, I could use a Bastion host with a limited, non Debian,
OS, or I could recompile the OpenSSH package on Debian with options
disabled.
Doing the latter, I have much more dependancies (**)
4d3
< libcom_err.so.2
9,18d7
< libgcrypt.so.20
< libgpg-error.so.0
< libgssapi_krb5.so.2
< libk5crypto.so.3
< libkeyutils.so.1
< libkrb5.so.3
< libkrb5support.so.0
< liblz4.so.1
< liblzma.so.5
< libnsl.so.2
22,23d10
< libresolv.so.2
< librt.so.1
25,26d11
< libsystemd.so.0
< libtirpc.so.3
28d12
< libwrap.so.0
30d13
< libzstd.so.1
What do you think about this approach?
Thank you for your comments.
(*) on Debian bullseye:
mkdir /tmp/tt
cd /tmp/tt
apt-get source openssh
cd openssh-8.4p1/
# openbsd-doc does not apply cleanly after
sed -i '/^systemd-readiness.patch/d;/^restore-tcp-wrappers.patch/d;/^openbsd-docs.patch/d' debian/patches/series
rm debian/patches/{systemd-readiness.patch,restore-tcp-wrappers.patch,openbsd-docs.patch}
patch debian/rules <<'EOF'
schaefer@reliant:/tmp/tt/openssh-8.4p1$ diff -uP debian/rules.ORIG debian/rules
--- debian/rules.ORIG 2025-04-11 19:35:13.568132105 +0200
+++ debian/rules 2025-04-11 19:37:01.355078815 +0200
@@ -73,20 +73,16 @@
confflags_udeb := $(confflags)
# Options specific to the deb build.
-confflags += --with-tcp-wrappers
confflags += --with-pam
confflags += --with-libedit
-confflags += --with-kerberos5=/usr
confflags += --with-ssl-engine
ifeq ($(DEB_HOST_ARCH_OS),linux)
confflags += --with-selinux
confflags += --with-audit=linux
-confflags += --with-systemd
confflags += --with-security-key-builtin
endif
-# The deb build wants xauth; the udeb build doesn't.
-confflags += --with-xauth=/usr/bin/xauth
+confflags += --without-xauth
confflags_udeb += --without-xauth
# Default paths. The udeb build has /usr/games removed.
EOF
# -b: avoid source package creation, changelog, etc
dpkg-buildpackage -b -rfakeroot -us -uc
(**) demo:
mkdir /tmp/tt2
cd /tmp/tt2
dpkg-deb -x ../tt/openssh-server_*.deb .
diff <(ldd /usr/sbin/sshd | awk '{print $1;}' | sort) <(ldd usr/sbin/sshd | awk '{print $1;}' | sort)
What systemd dependencies? :-)
If I turn the cups service back on I can print:
$ sudo systemctl start cups.service
$ lp -d Canon_MG3600_series check-for-updates.sh
request id is Canon_MG3600_series-4 (1 file(s))
On Mon, Apr 14, 2025 at 10:27 AM Dan Purgert wrote:
On Apr 14, 2025, Marc SCHAEFER wrote:
I wrote:
If you
sudo systemctl disable cups # and maybe others
Actually, if you follow the discussion, the CUPS Bonjour auto-discovery
- it presumably handled by the cups-browsed package
(you can uninstall it, or systemctl disable it,
if you don't want printer auto-detection on your
network)
- it could also be handled by mDNS (?)
Yep, 'cups-browsed' is the mDNS listener service (plugin for avahi?) so that cups can find printers announcing themselves via mDNS.
I'm not sure I understand, but
$ sudo systemctl stop cups.service
$ lp -d Canon_MG3600_series check-for-updates.sh
lp: Bad file descriptor
On Wed, Apr 16, 2025 at 03:16:29AM CEST, Lee <[email protected]> said:
On Mon, Apr 14, 2025 at 10:27 AM Dan Purgert wrote:You stopped cups (ie the whole printing system), not cups-browsed (the mDNS listener to get printers of the local
On Apr 14, 2025, Marc SCHAEFER wrote:I'm not sure I understand, but
I wrote:Yep, 'cups-browsed' is the mDNS listener service (plugin for avahi?) so
If youActually, if you follow the discussion, the CUPS Bonjour auto-discovery >>>>
sudo systemctl disable cups # and maybe others
- it presumably handled by the cups-browsed package
(you can uninstall it, or systemctl disable it,
if you don't want printer auto-detection on your
network)
- it could also be handled by mDNS (?)
that cups can find printers announcing themselves via mDNS.
$ sudo systemctl stop cups.service
$ lp -d Canon_MG3600_series check-for-updates.sh
lp: Bad file descriptor
network announcing themselves by Zeroconf)
Hi Gene,
This is probably off topic for the subject of the thread above but -
You always claim that stuff is grossly broken: in this instance, CUPS
is probably *not* broken. The problem is that the free drivers - which
are essentially all that Debian can ship - are less functional than the proprietary drivers shipped by Brother.
On 4/16/25 03:14, Erwan David wrote:
On Wed, Apr 16, 2025 at 03:16:29AM CEST, Lee <[email protected]> said:
On Mon, Apr 14, 2025 at 10:27 AM Dan Purgert wrote:
On Apr 14, 2025, Marc SCHAEFER wrote:
Which brings up the fact that if cups-browsed is present, it disables the factory drivers which run my 2 brother printers flawlessly, every feature listed on the boxes Just Works, with the cups flavor of cups drivers which are grossly broken and have been for a decade or more. I lose tray choice, color is weak and afu on my color inkjet and my B&W laser loses duplex and doesn't properly respond to a formfeed.
Cheers, Gene Heskett, CET.
--
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author, 1940)
If we desire respect for the law, we must first make the law respectable.
- Louis D. Brandeis
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 715 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 154:58:17 |
| Calls: | 12,092 |
| Files: | 15,000 |
| Messages: | 6,517,690 |