sshd.install.risks.txt

`Date: Mon, 10 May 1999 22:26:19 +0200  
>From: "GWDVMS::MOELLER" <[email protected]>  
Subject: Risks of upgrading a UNIX system  
  
When was the last time you rebuilt all privileged (`suid root') applications  
when upgrading a unix system, just in case?  
  
I'm pretty sure one can find `small print' that demands this, however I'm  
equally sure that hardly any system manager does so, since problems seem to  
occur _very_ rarely. Here's a neat one:  
  
Some time prior to the upgrade, system manager (S.M.) was asked to install  
`sshd' on a not-so-common platform (nothing really security-relevant,  
machine used for raw speed only, users just being accustomed to that sort of  
login). Said platform (featuring a particularly elaborate user data base)  
requires some special calls (simple calling sequences) to be done during  
`login' - no problem, `sshd' knows about them, although not explicitly aware  
of the particular hardware. Cautiously, S.M. configures `sshd' to not allow  
`root' logins from the outside. What other harm could it possibly do?  
  
Upgrade has to occur somewhat in a hurry, release documentation isn't  
on-site, but procedures are known well enough. S.M. asks the manufacturer's  
support representative if special precautions have to be taken, "errr, not  
that I'd think so". S.M. installs new version, all fine & dandy, even  
remembers to check out `sshd' afterwards and finds it to work the same as  
before.  
  
A couple of days later, S.M. logs in via `sshd' himself, and for the first  
time enters `su'. Gets very amazed at the new system's intelligence, as it  
knows to not ask him for a password. Minutes later, S.M. recognizes that  
`su' would never ask for a password, when the parent process had been  
created via `sshd' ... in spite of no other visible peculiarities with that  
process.  
  
A re-build (pretty likely boiling down to nothing but a re-link) of `sshd'  
fixed the problem.  
  
Quite a few years ago, when I saw the first mention of `ssh', I commented   
"If you're a bank, you don't buy your safe at a flea market;   
if you're not, you might be better off without a safe".   
Maybe there's _some_ truth in it, after all.  
  
Dr. Wolfgang J. "s."Moeller, Tel. +49 551 2011510, GWDG, D-37077 Goettingen,  
F.R.Germany <[email protected]> <[email protected]>  
  
P.S. re "software bloat":   
Imagine uSoft going open source, and no-one going to have a look at it...  
  
  
[from Risks Digest 20.39]  
`