Bug 2223693 - SSH login is allowed with MACs which is not present in /etc/ssh/sshd_config file [openssh]
Summary: SSH login is allowed with MACs which is not present in /etc/ssh/sshd_config f...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: openssh
Version: 8.8
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Dmitry Belyavskiy
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-07-18 14:14 UTC by Dushyant
Modified: 2023-08-01 12:52 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-08-01 12:52:13 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker CRYPTO-11254 0 None None None 2023-07-24 15:53:41 UTC
Red Hat Issue Tracker RHELPLAN-162613 0 None None None 2023-07-18 14:17:47 UTC

Description Dushyant 2023-07-18 14:14:52 UTC
Description of problem:

SSH login is allowed with MACs which is not present in /etc/ssh/sshd_config file on openssh server.

Version-Release number of selected component (if applicable):
kernel -> 4.18.0-477.15.1.el8_8.x86_64
openssh version -> openssh-8.0p1-17.el8_7.x86_64

How reproducible:

Openssh Server:
--------------
~]# ip addr | grep inet | grep enp0s8
    inet 192.168.56.118/24 brd 192.168.56.255 scope global dynamic noprefixroute enp0s8

~]# grep CRYPTO_POLICY /etc/sysconfig/sshd
CRYPTO_POLICY=

~]# update-crypto-policies --show
DEFAULT

~]# egrep MACs /etc/ssh/sshd_config 
MACs umac-128-etm,hmac-sha2-256-etm,hmac-sha2-512-etm,hmac-sha1-etm,umac-128,hmac-sha2-256,hmac-sha2-512,hmac-sha1

~]# sshd -T | grep macs
macs umac-128-etm,hmac-sha2-256-etm,hmac-sha2-512-etm,hmac-sha1-etm,umac-128,hmac-sha2-256,hmac-sha2-512,hmac-sha1

~]# ps -ef | grep sshd
root       10613   10609  0 08:21 ?        00:00:00 sshd: root@pts/1
root       11304       1  0 09:58 ?        00:00:00 /usr/sbin/sshd -D

~]# systemctl status sshd
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2023-07-18 09:58:41 EDT; 10min ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 11304 (sshd)
    Tasks: 1 (limit: 11132)
   Memory: 2.7M
   CGroup: /system.slice/sshd.service
           └─11304 /usr/sbin/sshd -D

Jul 18 09:58:41 myhostname.redhat.com systemd[1]: Starting OpenSSH server daemon...
Jul 18 09:58:41 myhostname.redhat.com sshd[11304]: Server listening on 0.0.0.0 port 22.
Jul 18 09:58:41 myhostname.redhat.com sshd[11304]: Server listening on :: port 22.
Jul 18 09:58:41 myhostname.redhat.com systemd[1]: Started OpenSSH server daemon.
Jul 18 10:02:46 myhostname.redhat.com sshd[11333]: Accepted password for root from 192.168.56.1 port 58234 ssh2
Jul 18 10:02:46 myhostname.redhat.com sshd[11333]: pam_unix(sshd:session): session opened for user root by (uid=0

Login from client system:
------------------------
[dushyant@uge ~]$ ssh -oMACs=umac-64-etm root.56.118
root.56.118's password: 
Last login: Tue Jul 18 09:54:43 2023 from 192.168.56.1
[root@myhostname ~]# 


Actual results:

Event if the MACs is not present in /etc/ssh/sshd_config file the ssh login is possible.

Expected results:
SSH login with the particular MAC should not be allowed, if that MACs is not present in openssh server's /etc/ssh/sshd_config file.

Comment 1 Dmitry Belyavskiy 2023-07-31 10:03:51 UTC
Could you please provide the session log?

If we use AEAD cipher establishing the session, we use an implicit MAC and so the check is bypassed.


Note You need to log in before you can comment on or make changes to this bug.