SSH Only on a Trusted System...

[Jeff Carlin]

I have a system running 11.11 sitting in our DMZ. In the process of hardening this system, I have removed telnet (port 23) and only SSH (slogin) is allowed to this system. All is working fine at this point. Then I did the tsconvert and all users were expired. How can the users signon now and get prompted for their password change when there is no telnet and slogin only states: Permission Denied? What am I missing here??? I can???t be the first person to create a Bastion host, trusted with only SSH access???or am I?

Jeff

[Sridhar Bhaskarla]

Jeff,

Unfortunately SSH cannot handle expired passwords. There is a missing link between ssh and the PAM modules.

However HP's secure shell based on openssh code can handle expired passwords. Install it if you can afford

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA

There may be a patch available for this problem on openssh.org site. But it means recompiling the executables.

-Sri

[Robert-Jan Goossens]

Jeff,

take a look at next link

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x47b87680e012d71190050090279cd0f9,00.html

Hope it helps,

Robert-Jan.

[Jeff Carlin]

Sri, I have installed the HP version of SSH T1471AA. Is there something I need to do to enable the password change feature?

[Sridhar Bhaskarla]

Hi (Again),

No you do not need to. You will probably have to install libpam patches. For 11i, it will be
PHCO_24839 or later.

-Sri

[Donny Jekels · Accepted solution]

Jeff,

I found this document on GIAC (SANS) Unix system hardening.

This was an exam entry that was tested and excepted by SANS.

Hope it helps. Sorry about you not being able to get back in your system. I know the feeling. ;~(
Donny

[Keith Buck]

Jeff,

After installing T1471AA, the old sshd may still be running. You will need to stop that sshd and start the new one. Usually with versions of secure shell, this can be done with

kill -HUP

on the sshd process. Since I don't know what version you had before...no guarantees that the new version will autostart.

The usual cause of the error you are seeing is that sshd wasn't compiled with the correct compile options (having to do with PAM). The version from HP was compiled correctly in this regard, and I have seen it correctly prompt for passwords.

Also, if you're interested, you should check out HP-UX Bastille. It will walk you through the steps of creating a Bastion host, (possibly including steps you missed) and when it converts to trusted mode, it won't immediately expire all your passwords :)

Hope that helps.

-Keith

[Jeff Carlin]

Sri, I will be trying the patch. It looks like it addresses some PAM issues.

BTW - this server has been rebooted several times after the tsconvert. I doubt that the old SSH is running anymore =)

[Sridhar Bhaskarla]

Hi Jeff,

If possible, can you run sshd in debug mode and try connecting to it with an expired user and post the output?. (Run it with sshd -d flag on the server). During the debug mode, users will not be able to connect to the server while the existing connections will keep working.

Also you should be seeing some PAM errors in the syslog.log.

-Sri