Azure / Azure/azure-linux-extensions

VMAccessForLinux "reset" should fix permission problems

Open
#485 0 comments 0 reactions 0 assignees View on GitHub
bug extensions/VMAccess feature request
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

When dropping private keys in /etc/ssh or other places, it's easy to accidentally make them more visible than they should be. The sshd itself is quite picky; if it finds critical files are world-readable, it will ignore them. Example:
```
Starting sshd: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for '/etc/ssh/ssh_host_dsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: /etc/ssh/ssh_host_dsa_key
Could not load host key: /etc/ssh/ssh_host_dsa_key
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Could not load host key: /etc/ssh/ssh_host_ed25519_key
/var/empty/sshd must be owned by root and not group or world-writable.
[FAILED]
```
The VMAccessForLinux extension has a "reset the world" mode. This mode overwrites the existing sshd config file with one which is known valid, but it doesn't do anything to address the ignored keys (and thus blocked accesses) caused by these security problems.

I believe VMA4L should fix this stuff if it can. This might be as simple as fixing permissions in /etc/ssh, or it might go so far as to parse the error message and do something "reasonable" for each detected problem.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the VMAccessForLinux “reset the world” mode and how it rewrites the sshd configuration. Review the permissions of the files and directories shown in /etc/ssh and /var/empty/sshd, then determine which security problems can be fixed reliably. Done means reset addresses the reported ignored host keys and sshd permission failures without relying on an unspecified error parser.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
operating-systems, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.