Default auth_key_file is insecure

[nbraud]

A process running as a given user can (in most cases) modify ~/.ssh/authorized_keys, for instance to add a new key they control before invoking whatever is using pam_rssh, subverting the authentication it is supposed to provide.

NixOS/nixpkgs#31611 provides an example (ab)using this to bypass pam_ssh_agent_auth in the context of sudo, which I believe would work similarly against pam_rssh.

[smortex]

That quite depends on your threat model, but make sense if your ssh daemon rely on AuthorizedKeysFile to change the default which allow users to self-service their own authorized keys management.

Following the sshd configuration would make sense: AuthorizedKeysFile may point to another location, AuthorizedKeysCommand may be used to retrieve keys of a user and so on.

Regarding the example in the liked PR, I feel like the provided example is misleading as the user account used to "elevate" privileges is allowed to run any command as root… so it just make it possible without knowing the user password (while a correct sudo config would not have allowed the user to run any command as root in any case).

[nbraud]

@smortex The point is, it turns “user is allowed $thing if they authenticate with a trusted pubkey” into “user is allowed $thing unconditionally.” The PAM module is bypassed, and if the administrator's intent was the later, they wouldn't have used pam_ssh_agent_auth (or pam_rssh or any other PAM module)

[feklee]

It may be good to mention that point explicitly in the Config section of README.md. In the meantime, I put my SSH authorized keys into /etc/ssh/authorized_keys/felix and made sure that file can only be written to by root.

This works if I specify in /etc/pam.d/sudo:

auth            sufficient      pam_rssh.so     auth_key_file=/etc/ssh/authorized_keys/felix

However, when I specify:

auth            sufficient      pam_rssh.so     auth_key_file=/etc/ssh/authorized_keys/${user}

then I get:

Nov 28 04:20:16 linux pam_rssh[181245]: read_authorized_keys: Failed to read `/etc/ssh/authorized_keys/${user}`

I guess I'm doing something wrong here?