this post was submitted on 01 Jul 2024
244 points (98.8% liked)

Linux

5212 readers
34 users here now

A community for everything relating to the linux operating system

Also check out !linux_memes@programming.dev

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 1 year ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
244
'Critical' vulnerability in OpenSSH uncovered, affects almost all Linux systems (www.computing.co.uk)
submitted 4 months ago by Blaze@lemmy.zip to c/linux@programming.dev
39 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] possiblylinux127@lemmy.zip -1 points 4 months ago* (last edited 4 months ago) (3 children)

Maybe it is time to move to something new

Also why does sshd run as root. I deal like ssh could use some least privilege

[–] frezik@midwest.social 10 points 4 months ago* (last edited 4 months ago) (1 children)

When you log in to an ssh terminal for a shell, it has to launch the shell process as the desired user. Needs to be root to do that.

SSH has been around a long time. It's not perfect, but it's mostly validated. Anything new won't have that history.

[–] possiblylinux127@lemmy.zip 1 points 4 months ago (1 children)

Can't it use built in OS mechanisms for that? Surely you could figure out a way to only give it permissions it needs. Maybe break it up into two separate processes.

[–] Sethayy@sh.itjust.works 1 points 4 months ago

That just sounds like root with extra steps (trying to implement OS security policies in a remote terminal utility)

[–] noxy@yiffit.net 9 points 4 months ago* (last edited 4 months ago)

Preliminary note: OpenSSH is one of the most secure software in the world; this vulnerability is one slip-up in an otherwise near-flawless implementation. Its defense-in-depth design and code are a model and an inspiration, and we thank OpenSSH's developers for their exemplary work.

[–] Mio@feddit.nu 1 points 4 months ago

Root because it use port 22. I think anything lower than port 1024 requires it. But if this is true, then you can try change the port it is listening to something higher than that.