Ticket #1853 (closed enhancement: fixed)

Opened 10 years ago

Last modified 21 months ago

Enhancement: improve dropbear security by listening only on usb0 by default

Reported by: RuiSeabra Owned by: julian_chu
Priority: normal Milestone:
Component: Distro Version:
Severity: blocker Keywords: dropbear security haspatch HasPatch
Cc: julian_chu@… Blocked By:
Blocking: Estimated Completion (week):
HasPatchForReview: PatchReviewResult:
Reproducible: always

Description

Letting ssh listen on 0.0.0.0:22 may be hazardous if you connect to wifi links, and seldom will you need to access dropbear from wifi unless you know what you're doing.

If you know what you're doing, you can easily change dropbear to go back to an insecure default.

A clever usage of awk in the init script will dynamically fetch usb0's address thus reducing the risk of the default.

Attachments

secure_listen.patch (278 bytes) - added by RuiSeabra 10 years ago.
patch to reduce dropbear default ssh listening address

Change History

Changed 10 years ago by RuiSeabra

patch to reduce dropbear default ssh listening address

comment:1 Changed 10 years ago by RuiSeabra

I'm sorry if I'm not clear enough, that's a patch for /etc/init.d/dropbear

comment:2 Changed 10 years ago by RuiSeabra

This will probably also save a tiny amount of battery by reducing the interfaces it has to poll.

comment:3 Changed 10 years ago by zecke

  • Cc julian_chu@… added
  • Keywords HasPatch added

Julian please take a look and maybe even move these config values to /etc/default/dropbear and mark that file as conffile.

comment:4 Changed 10 years ago by zecke

  • Owner changed from openmoko-kernel to julian_chu
  • Component changed from System Software to Distro

comment:5 Changed 10 years ago by john_lee

  • Status changed from new to in_testing

make it conffile /etc/default/dropbear for openmoko distro
commited as 5eb58fb8930b17f4327d64c220c5b23e4912a4a7

comment:6 Changed 10 years ago by zecke

  • Resolution set to fixed

QA is not going over these kind of bugs. netstat -ln looks sane for dropbear. thanks john and julian!

comment:7 Changed 10 years ago by zecke

  • Status changed from in_testing to closed

Next attempt to close them with the batch modify. (status and resolution needs to be set)

comment:8 Changed 21 months ago by RoberMync

Cefotaxime <a href=http://viag1.xyz/viagra-alternative.php>Viagra Alternative</a> Zithromax Z Pak Dosage Propecia Paginas Amarillas <a href=http://cial5mg.xyz/cialis-buy-online.php>Cialis Buy Online</a> Priligy Donde Comprar Finasteride Costi Propecia <a href=http://zol1.xyz/zoloft-online.php>Zoloft Online</a> Cialis O Viagra Dove Comprare Free Viagra Samples By Mail <a href=http://zol1.xyz/zoloft-cheap.php>Zoloft Cheap</a> Mrsa Cephalexin Vente Cialis 5 Mg <a href=http://cial1.xyz/viagra-cialis.php>Viagra Cialis</a> Il Viagra Funziona Buying Antibiotics Online <a href=http://viag1.xyz/price-generic-viagra.php>Price Generic Viagra</a> Secure Drugshop Cafergot Tablets No Rx <a href=http://cial1.xyz/order-cialis-online.php>Order Cialis Online</a> Cialis Hipertension Buspar Online <a href=http://zol1.xyz/cheap-zoloft-online.php>Cheap Zoloft Online</a> Allergic Reaction To Cephalexin Can I Take Amoxicillin With Citalopram <a href=http://kama1.xyz/kamagra-gel-oral.php>Kamagra Gel Oral</a> Ou Trouver Du Misoprostol Propecia En Parafarmacias <a href=http://cial5mg.xyz/cheap-generic-cialis.php>Cheap Generic Cialis</a> How Much Is Viagra In Mexico Levitra Medications <a href=http://cial1.xyz/buy-generic-cialis.php>Buy Generic Cialis</a> Doctor Who Prescribe Cialis Online Amoxicillin Ph <a href=http://kama1.xyz/buy-kamagra-oral-jelly.php>Buy Kamagra Oral Jelly</a> Canadian Pharcharmies Amoxicilina Medication Quick Shipping <a href=http://zol1.xyz/cheap-zoloft-generic.php>Cheap Zoloft Generic</a> Canadian Drug Plans Propecia Completo <a href=http://viag1.xyz/generic-viagra-sales.php>Generic Viagra Sales</a> Levitra Prix Paris Viagra Preis Osterreich <a href=http://cial5mg.xyz/brand-cialis-online.php>Brand Cialis Online</a> Conecta Propecia

Note: See TracTickets for help on using tickets.