Bug 971 - keyboard-interactive/pam leaks info about user existence
Summary: keyboard-interactive/pam leaks info about user existence
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: PAM support (show other bugs)
Version: -current
Hardware: All All
: P2 normal
Assignee: OpenSSH Bugzilla mailing list
URL: http://bugs.debian.org/cgi-bin/bugrep...
Keywords:
Depends on:
Blocks: 701 914
  Show dependency treegraph
 
Reported: 2005-01-11 18:06 AEDT by Darren Tucker
Modified: 2005-03-10 09:07 AEDT (History)
0 users

See Also:


Attachments
Make kbdint code call driver even for non-existent users (977 bytes, patch)
2005-01-11 18:08 AEDT, Darren Tucker
no flags Details | Diff
Feed bogus input to PAM for invalid logins (1.35 KB, patch)
2005-01-11 18:12 AEDT, Darren Tucker
no flags Details | Diff
Make kbdint call driver even for invalid logins (1.23 KB, patch)
2005-01-19 16:39 AEDT, Darren Tucker
no flags Details | Diff
Patch for Kerberos timing difference for Valid and Invalid user (813 bytes, patch)
2005-01-20 17:45 AEDT, senthilkumar
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Darren Tucker 2005-01-11 18:06:49 AEDT
During keyboard-interactive authentication, if the PAM stack inserts a delay on
bad logins, the delay will be present for accounts that exist, and not present
for accounts that do not.

One solution for 3.9p1 is to set "ChallengeResponseAuthentication no" and
"PasswordAuthentication yes" in sshd_config, since PasswordAuthentication does
not have this issue.
Comment 1 Darren Tucker 2005-01-11 18:08:05 AEDT
Created attachment 765 [details]
Make kbdint code call driver even for non-existent users
Comment 2 Darren Tucker 2005-01-11 18:12:21 AEDT
Created attachment 766 [details]
Feed bogus input to PAM for invalid logins

Note: you will need to apply *both* patches (#765 and #766) to completely fix
the problem.

Patch #766 partially by Colin Watson.
Comment 3 Darren Tucker 2005-01-19 16:39:34 AEDT
Created attachment 771 [details]
Make kbdint call driver even for invalid logins

Instead of always continuing, this patch now leaves it up to the individual
drivers and adds a authctxt->valid check to bsdauth to maintain the current
behavior for it.
Comment 4 Darren Tucker 2005-01-20 14:29:36 AEDT
This is now fixed in -current and the 3.9 branch:

 - (dtucker) [auth-pam.c] Bug #971: Prevent leaking information about user
   existence via keyboard-interactive/pam, in conjunction with previous
   auth2-chall.c change; with Colin Watson and djm.
Comment 5 senthilkumar 2005-01-20 17:45:38 AEDT
Created attachment 775 [details]
Patch for Kerberos timing difference for Valid and Invalid user

For PAM-Passwd Authentication with KerberosAuthentication being set to yes,
there exists a time difference for valid user and invalid user. The attached
patch fixes that.
Comment 6 Darren Tucker 2005-03-10 09:07:29 AEDT
With the release of OpenSSH 4.0, these bugs are now closed. For details, see:
http://www.openssh.com/txt/release-4.0