Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable weak security options in dropbear build #1161

Closed
shaunmulligan opened this issue Aug 24, 2018 · 1 comment
Closed

Disable weak security options in dropbear build #1161

shaunmulligan opened this issue Aug 24, 2018 · 1 comment
Assignees
@agherzan @afitzek

Comments

@shaunmulligan
Copy link

A Nessus scan of resinOS revealed two low priority findings (SSH Server CBC Mode Ciphers Enabled, SSH Weak MAC Algorithms Enabled) related to the dropbear configuration. Unless deliberately enabled for backward compatibility, the request is to add the following options to the Resin dropbear build.

/* Disable Use of SHA1 hash for HMAC */
#define DROPBEAR_SHA1_96_HMAC 0

/* Disable CBC mode for ciphers */
#define DROPBEAR_ENABLE_CBC_MODE 0

/* Disable X11 Forwarding */

#define DROPBEAR_X11FWD 0
agherzan pushed a commit that referenced this issue Aug 30, 2018
dropbear: Enhanced security options
a53bcb5 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear
Signed-off-by: Andrei Gherzan <andrei@resin.io>
@agherzan agherzan mentioned this issue Aug 30, 2018
Closed
4 tasks
@ghost ghost added the flow/in-review label Aug 30, 2018
agherzan pushed a commit that referenced this issue Aug 31, 2018
dropbear/sumo: Enhanced security options
11a97fc 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Aug 31, 2018
dropbear/sumo: Enhanced security options
ef5e60d 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear - sumo
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Aug 31, 2018
dropbear/krogoth: Enhanced security options
b993e59 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear - krogoth
Signed-off-by: Andrei Gherzan <andrei@resin.io
agherzan pushed a commit that referenced this issue Aug 31, 2018
dropbear/krogoth: Enhanced security options
836dc07 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear - krogoth
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 4, 2018
dropbear/morty: Enhanced security options
492e266 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear - morty
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 4, 2018
dropbear/pyro: Enhanced security options
4207b25 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes #1161

Change-type: minor
Changelog-entry: Enhanced security options for dropbear - pyro
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 4, 2018
dropbear/krogoth: Enhanced security options
3e132c2 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - krogoth
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 4, 2018
dropbear/morty: Enhanced security options
11004be 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - morty
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 4, 2018
dropbear/pyro: Enhanced security options
b15f926 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - pyro
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 4, 2018
dropbear/rocko: Enhanced security options
0a9ad71 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - rocko
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 4, 2018
dropbear/sumo: Enhanced security options
824d45b 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - sumo
Signed-off-by: Andrei Gherzan <andrei@resin.io>
@agherzan agherzan mentioned this issue Sep 4, 2018
Merged
4 tasks
agherzan pushed a commit that referenced this issue Sep 11, 2018
dropbear/krogoth: Enhanced security options
e60be79 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - krogoth
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 11, 2018
dropbear/morty: Enhanced security options
a30f153 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - morty
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 11, 2018
dropbear/pyro: Enhanced security options
0f814a1 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - pyro
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 11, 2018
dropbear/rocko: Enhanced security options
3d21479 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Connected-to: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - rocko
Signed-off-by: Andrei Gherzan <andrei@resin.io>
agherzan pushed a commit that referenced this issue Sep 11, 2018
dropbear/sumo: Enhanced security options
564490a 
We deactivate various configuration knobs which have security concerns:

* DROPBEAR_X11FWD - no need to run X over ssh
* DROPBEAR_SHA1_96_HMAC - HMAC 96 is known to be a weak algorithm. It is
        reported by OpenVAS as a low severity security issue.
* DROPBEAR_ENABLE_CBC_MODE - As reported by OpenVAS, CBC mode can allow
        an attacker to obtain plaintext from a block of cyphertext.
* DROPBEAR_DH_GROUP1 - This is documented as "less secure" while in
        newer versions mentioned as "too small for security".

Fixes: #1161
Change-type: minor
Changelog-entry: Enhanced security options for dropbear - sumo
Signed-off-by: Andrei Gherzan <andrei@resin.io>
@agherzan
Copy link
Contributor

Merged to development branch.

@ghost ghost removed the flow/in-review label Sep 11, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@agherzan agherzan

@afitzek afitzek

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@agherzan @afitzek @shaunmulligan