Jump to content

  • [6.11.5] SSH Port 22 Accessible Before System Configuration is Loaded. (Possible Other Services Likewise Affected)

    Ryonez

    By Ryonez

      • Urgent

    Hi there.

    I had to reboot my server recently, and I received a `Possible Hack Attempt` notification from a plugin called `Fix Common Problems'.
    image.thumb.png.0a24366a95a312b543ad9570f4caa7e5.png

     

    Looking into this, I think I've found a bug/security issue. The server's SSH port should be configured to port `1122`. However while the system is booting up, SSH is started before the set configuration is read, leading to port 22 being exposed.
    Now, I have port 22 forwarded to the server for a service running `Forgejo`, a code repository service. The reason port 22 is being used is to lessen client configuration, and to make it simpler for users.

    The bug here is unRaid is loading SSH with default values for a time, and later restarting with the correct config. This creates a window for attackers to attempt to access the system through something that isn't meant to be exposed.

    Steps to reproduce:
    1. Set a different port for SSH through unjRaid's web UI.
    2. Reboot the server.
    3. There is now a windows of opportunity to attack the server via the default SSH port as it starts. Plugins extend this window.

    Some of the Logs:
    SSH being started with port 22:
    image.png.8eef11cb0a2e6ee9e6802bdf1ca6e85b.png

     

    SSH login attempts being made during this window of opportunity:
    image.thumb.png.8d6d8fc25cee5c946b9ec6ab295ee224.png

    image.thumb.png.9a42164b73657655b814d80081001ab2.png

    There's more than just those.

    SSH being restarted with the correct configuration:
    image.thumb.png.11441bf60bebcf07c9b5aab005e88920.png

     

     

     

    I'll also make a quick note it looks like smbd is having the same treatment, it's loaded with defaults, then restarted with the proper configs later. So it appears there might be several system services being started like this when they shouldn't.

    Will make this as urgent, though I'll admit I'm not 100% if SSH will accept the correct password. This server runs a chat service, so uptime is import for me, and testing would interrupt that. Please adjust the urgency as needed if it's not as bad as I think it might be.

    atlantis-diagnostics-20230227-0254.zip

    Go to reports Stable Releases

    User Feedback

    Recommended Comments

    trurl

    Just changing the SSH port is not a way to secure this. Bots will just find whatever other port you configure. You need a VPN or proxy

     

    Also, Diagnostics REQUIRED for bug reports.

    Link to comment
    Ryonez
    1 hour ago, trurl said:

    Just changing the SSH port is not a way to secure this. Bots will just find whatever other port you configure. You need a VPN or proxy

     

    Also, Diagnostics REQUIRED for bug reports.


    Changing the port was not done to secure it. It was done so a docker container could use it.
    Only specific ports are exposed, wireguard is used to connect when out of network for management, as management ports are not meant to be exposed. 

    The issue is unRaid starts it with default configs, creating a window of attack until it restarts services with the correct configs. This is not expected behaviour.

    Diagnostics have been added to the main post.

    Link to comment


    Join the conversation

    You can post now and register later. If you have an account, sign in now to post with your account.
    Note: Your post will require moderator approval before it will be visible.

    Guest
    Add a comment...

    ×   Pasted as rich text.   Restore formatting

      Only 75 emoji are allowed.

    ×   Your link has been automatically embedded.   Display as a link instead

    ×   Your previous content has been restored.   Clear editor

    ×   You cannot paste images directly. Upload or insert images from URL.

    ×

  • Status Definitions

     

    Open = Under consideration.

     

    Solved = The issue has been resolved.

     

    Solved version = The issue has been resolved in the indicated release version.

     

    Closed = Feedback or opinion better posted on our forum for discussion. Also for reports we cannot reproduce or need more information. In this case just add a comment and we will review it again.

     

    Retest = Please retest in latest release.

    Priority Definitions

     

    Minor = Something not working correctly.

     

    Urgent = Server crash, data loss, or other showstopper.

     

    Annoyance = Doesn't affect functionality but should be fixed.

     

    Other = Announcement or other non-issue.

×
×
  • Create New...