Philip Prindeville wrote:


On Feb 13, 2018, at 9:14 PM, Michelle Sullivan <miche...@sorbs.net> wrote:

[snip]
Personally - my thoughts ....

There should be an option to enable passwords (default off...)
A warning should be placed on the checkbox to inform the user it is not a good 
idea to enable them.
SSH should be disabled on external interfaces unless specifically enabled. 
(what constitutes 'external' if there is no 'wan' port? ...i.e. AP only?)
SSH without password in place and no keys should be unconditionally disabled 
(and not enable-able - except by hand editing.)
One could try to do what some manufacturers have done and open ssh for a period 
of time if the WPS button is depressed for a certain length of time  as a 'fool 
proof' command login.... personally though I think anyone using SSH instead of 
the webinterface is more than likely going to know what they are doing and 
therefore it should not be an issue... ie err on the side of 'there is an idiot 
at the controls, lets make it default as secure as possible'...

--
Michelle Sullivan
http://www.mhix.org/


Thanks for the suggestion.  Alas OpenSSH allows one to specify a ListenAddress 
which you could match to the “lan” or “wan” address(es).  Problem is that if 
you’re using DHCP on the “wan”, you’d have to rewrite the file (and restart the 
service) every time DHCP changed the address on the interface.

What would be better is if OpenSSH had a ListenInterface configuration 
parameter instead, and used netlink to listen for address changes… but that 
would be a bit of complexity (although you’d think it would be a common enough 
requirement for applications that someone would have come up with a library to 
do exactly that in a portable fashion).

Your conclusion is spot on: it’s hard to offer good security and make it 
foolproof at the same time because the approaches go in exactly opposite 
directions.  Security requires extreme pessimism, even paranoia, and 
user-friendliness implies being extremely forgiving.

It’s hard to have both.

-Philip

FWIW, I had misunderstood the intent of the original comments... OpenSSH server vs Dropbear - if someone is using OpenSSH server they already went in with advanced config as Dropbear is the default - I'd err on the side of security as they should already know what they are doing.... it should be recoverable by webinterface though (rather than worrying about people 'fixing' by using something not secure.)

--
Michelle Sullivan
http://www.mhix.org/


_______________________________________________
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

Reply via email to