Bug 3148

Created attachment 3376 [details]
/etc/ssh/sshd_config

Dear OpenSSH maintainers,

While I was answering a question in Unix & Linux Stack Exchange ( https://unix.stackexchange.com/a/579762/158359 ), I identified that OpenSSH is not able to perform host-based authentication as superuser if "IgnoreRhosts yes" is set in "/etc/ssh/sshd_config" file.

Although host-based authentication as superuser might sound unsafe, it may be useful in scenarios like the one described in my answer, where "AuthenticationMethods" parameter is set to "hostbased,publickey" because an administrator wants OpenSSH server to authenticate client hosts before allowing users connecting from those machines to authenticate themselves.

The problem can be reproduced with a couple of Arch Linux containers in Docker and terminal windows running concurrently. To do so, ensure that configuration files attached to this report have been saved into "/tmp" directory.

-------------------------------------------
----------- Terminal window #1 ------------

[root@workstation ~]# docker run --rm --tty --interactive --name ssh-client --hostname ssh-client --ip 172.17.0.4 --add-host ssh-server:172.17.0.5 --volume /tmp/ssh_config:/etc/ssh/ssh_config archlinux/base:latest

[root@ssh-client ~]# pacman -Sy --noconfirm openssh vim man less iproute2 iputils bind-tools grep psmisc

[root@ssh-client ~]# ssh-keygen -A

[root@ssh-client ~]# useradd -U -m sshuser

[root@ssh-client ~]# /usr/sbin/sshd -De

-------------------------------------------
----------- Terminal window #2 ------------

[root@workstation ~]# docker run --rm --tty --interactive --name ssh-server --hostname ssh-server --ip 172.17.0.5 --add-host ssh-client:172.17.0.4 --volume /tmp/sshd_config:/etc/ssh/sshd_config archlinux/base:latest

[root@ssh-server ~]# pacman -Sy --noconfirm openssh vim man less iproute2 iputils bind-tools grep psmisc

[root@ssh-server ~]# ssh-keygen -A

[root@ssh-server ~]# useradd -U -m sshuser

[root@ssh-server ~]# echo -e 'sshuser:sshpassword\nroot:sshpassword' | chpasswd

[root@ssh-server ~]# echo ssh-client > /etc/ssh/shosts.equiv

[root@ssh-server ~]# ssh-keyscan ssh-client > /etc/ssh/ssh_known_hosts

[root@ssh-server ~]# /usr/sbin/sshd -De

-------------------------------------------
----------- Terminal window #1 ------------

(press CTRL+C to quit the running SSH daemon)

[root@ssh-client ~]# ssh ssh-server
root@ssh-server: Permission denied (hostbased).

[root@ssh-client ~]# su - sshuser

[sshuser@ssh-client ~]$ ssh ssh-server
sshuser@ssh-server's password: sshpassword
Last login: Tue Apr 14 05:51:42 2020 from 172.29.0.5
[sshuser@ssh-server ~]$ exit

-------------------------------------------
-------------------------------------------

I could not find any documentation snippet declaring that host-based authentication of the root user is blocked. The relevant snippets in "man(1) ssh" and "man(5) sshd_config" are:


-----------------------------------
----------- man(1) ssh ------------

AUTHENTICATION

The OpenSSH SSH client supports SSH protocol 2.

The methods available for authentication are: GSSAPI-based authentication, host-based authentication, public key authentication, challenge-response authentication, and password authentication.  Authentication methods are tried in the order specified above, though PreferredAuthentications can be used to change the default order.

Host-based authentication works as follows: If the machine the user logs in from is listed in /etc/hosts.equiv or /etc/ssh/shosts.equiv on the remote machine, and the user names are the same on both sides, or if the files ~/.rhosts or ~/.shosts exist in the user's home directory on the remote machine and contain a line containing the name of the client machine and the name of the user on that machine, the user is considered for login.  Additionally, the server must be able to verify the client's host key (see the description of /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts, below) for login to be permitted.  This authentication method closes security holes due to IP spoofing, DNS spoofing, and routing spoofing.  [Note to the administrator: /etc/hosts.equiv, ~/.rhosts, and the rlogin/rsh protocol in general, are inherently insecure and should be disabled if security is desired.]

-------------------------------------------
----------- man(5) sshd_config ------------

IgnoreRhosts

Specifies that .rhosts and .shosts files will not be used in HostbasedAuthentication.

/etc/hosts.equiv and /etc/ssh/shosts.equiv are still used.  The default is yes.