The release of OpenSSH 9.8 has been published, an open implementation of the client and server for working with SSH 2.0 and SFTP protocols. In addition to addressing a separately announced critical vulnerability (CVE-2024-6387), which allows for remote code execution with root privileges before authentication, the new version also fixes another less dangerous vulnerability and offers several significant changes aimed at enhancing security.
The second vulnerability allows bypassing the protection against side-channel attacks added in OpenSSH 9.5, which analyze delays between keystrokes on the keyboard to reconstruct input. This vulnerability enables distinguishing packets that generate background activity through simulated keystrokes from those sent during real keystrokes, reducing the effectiveness of the mechanism that conceals the characteristics of interactive input in SSH traffic. Information about keystrokes enables attacks that reconstruct input based on analyzing delays between key presses while typing, which depend on the keyboard layout (for example, the reaction time for entering the letter 'F' is faster than for entering 'Q' or 'X', as it requires fewer finger movements).
Additionally, it was found that the implemented algorithm for sending packets with real and fake keystrokes reduced the reliability of another method of protection against side-channel attacks. Starting with the release of
OpenSSH 2.9.9 server packets with fake keystrokes were sent for console input in echo-off mode, used, for example, when entering passwords in su or sudo. The new logic for sending fake packets allowed for identifying packets with real keystrokes in echo-off mode during passive traffic analysis for separate analysis. However, the accuracy of the timing information about key presses is limited since after input, packets are sent not immediately, but after fixed time intervals (by default 20 ms).
Other changes in OpenSSH 9.8:
- By default, support for digital signatures based on the DSA algorithm is disabled during the assembly phase. In early 2025, the implementation of DSA will be removed from the codebase. The reason for this removal is its inadequate level of security in accordance with modern requirements. The costs associated with maintaining the insecure DSA algorithm are not justified, and its removal will encourage the discontinuation of DSA support in other SSH implementations and cryptographic libraries.
- To provide additional protection against exploitation methods that require a large number of connections to sshd, a new protection mode has been implemented and is enabled by default. This mode also helps block automated attacks that attempt to guess user passwords by testing various common combinations. The protection is implemented through banning (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community., which records a large number of failed connection attempts — sshd monitors the status of child process completions, determining when authentication has failed or when a process was terminated due to a crash. When a certain threshold is exceeded, it begins to block requests from problematic IPs or subnets. For configuring the blocking threshold, the blocked subnet mask, and the exemption list, the parameters PerSourcePenalties, PerSourceNetBlockSize, and PerSourcePenaltyExemptList have been suggested.
- The sshd has been split into several separate executable files. The sshd-session process has been separated to handle session-related tasks. The sshd process retains functions related to accepting network connections, checking configurations, loading host keys, and managing processes based on the MaxStartups parameter. Thus, the sshd executable file now contains the minimal functionality necessary for accepting a new network connection and launching sshd-session to handle the session.
- The text of some error messages logged has changed. In particular, several messages are now sent on behalf of the 'sshd-session' process instead of 'sshd'.
- In the ssh-keyscan utility, protocol version information and the hostname are now output to the standard stream instead of STDERR. An option '-q' is provided to suppress this output.
- In SSH, the ability to disable the use of the host key certificate in favor of plain host keys has been implemented through the HostkeyAlgorithms directive.
- In the portable version of sshd, the use of argv[0] to determine the PAM service name has been discontinued. A new directive 'PAMServiceName' has been added in sshd_config to specify the PAM service name, which defaults to 'sshd'.
- The portable version of sshd retains automatically generated files (configure script, config.h.in, etc.) in a Git branch with releases (e.g., V_9_8), allowing synchronization between the contents of digitally signed tar archives and branches in Git.
- In the portable version of ssh and ssh-agent, setting the mode
SSH_ASKPASS is provided when the WAYLAND_DISPLAY environment variable is present, similar to how it was handled for X11 with the DISPLAY environment variable. - In the portable version of sshd, support for sending notifications to systemd upon creating a listening network socket or restarting has been added, using separate code that does not call the libsystemd library.
Source: opennet.ru
