How to make properly secure ssh account with empty password for running trusted binary? I'd like to make a kind of "virtual ssh Kiosk" for random users, while limiting "demo app" behind ssh "pseudo-user".

By "secure", I mean, "secure for server running demo app for random visitors". Basically to serve application behind ssh account as service, in similar manner like https serves websites.

(Let's assume for purpose of this question, that we trust /bin/cat or /usr/bin/cat - depending on server's system, please check yours with which echo)

While working on https://goo.gl/TjhrWd, I've encountered problem with making password empty. PAM rejects it.

how is it configured

Here is configuration I use and works when password is set for user cat - it is also described in https://goo.gl/TjhrWd :

# below configured on Ubuntu Server 14.04 LTS
addgroup catonly
# now let's make pseudo-shell binary, executing your ForceCommand (check source)
# you can use bash as default shell instead, I prefer sth less bloated.
cd /tmp
wget 'https://gist.githubusercontent.com/gwpl/abcbc74c2bf377945a49097237edfb9b/raw/1993e8acc4bd66329959b1a658fcce4296d2a80c/only_exec_command.c'
gcc only_exec_command.c -static -o only_exec_command
mkdir -p "$CHROOT"/{bin,lib,lib64,dev/pts,home/cat}
chown root:root /var/chroot "$CHROOT"
# dependig on distro it might be /usr/bin/cat -> check with `which cat`
useradd -d /home/cat -s /bin/only_exec_command -M -N -g catonly cat
passwd -d cat
# Let's make chroot
cp /tmp/only_exec_command "$CHROOT"/bin/
cp /bin/cat "$CHROOT"/bin/
mknod -m 666 "$CHROOT"/dev/null c 1 3
ldd /bin/cat # tells us which libraries to copy
cp /lib/x86_64-linux-gnu/libc.so.6 "$CHROOT"/lib
cp /lib64/ld-linux-x86-64.so.2 "$CHROOT"/lib64
chown cat:catonly "$CHROOT"/home/cat
chown root:root /var/chroot/cat /var/chroot /var
$ $EDITOR /etc/ssh/sshd_config # add:
Match user cat
       ChrootDirectory /var/chroot/cat
       X11Forwarding no
       AllowTcpForwarding no
       # dependig on distro it might be /usr/bin/cat -> check with `which cat`
       ForceCommand /bin/cat
       PasswordAuthentication yes
       PermitEmptyPasswords yes

symptoms suggest it's PAM

But trying to ssh, results in asking for password, and providing empty results in deny:

ssh echo@
echo@'s password:
Permission denied, please try again.

On server side running in debugging mode, there is nothing interesting in logs, let me quote server side part, during login, after entering empty password:

/usr/sbin/sshd -ddd -p 1234
debug1: userauth-request for user echo service ssh-connection method password [preauth]
debug1: attempt 2 failures 1 [preauth]
debug2: input_userauth_request: try method password [preauth]
debug3: mm_auth_password entering [preauth]
debug3: mm_request_send entering: type 12 [preauth]
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD [preauth]
debug3: mm_request_receive_expect entering: type 13 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 12
debug3: PAM: sshpam_passwd_conv called with 1 messages
debug1: PAM: password authentication failed for echo: Authentication failure
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 13
Failed password for echo from port 43816 ssh2
debug3: mm_auth_password: user not authenticated [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]

You need to tell PAM also that you want to allow empty passwords. There is some outdated tutorial describing that. But in short:

sudo sed -i 's/nullok_secure/nullok/' /etc/pam.d/common-auth

should do the job.

  • Thanks! Looks promising. Now, trying to figure out, how to configure it more elegant in system where common-auth is managed by pam-auth-update : askubuntu.com/q/765773/31300 . – Grzegorz Wierzowiecki May 1 '16 at 8:01
  • 1
    For the reference, you might check sshtron which is trying to achieve similar free-access service, but is not using empty password and real sshd as you are trying to do. – Jakuje May 1 '16 at 8:03
  • 1
    I love sshtron! That's exactly kind of possible applications I am looking for! – Grzegorz Wierzowiecki May 1 '16 at 10:46

To properly secure ssh access, you must not allow authentication free login. Set up an RSA key for authentication, and then the client can use that instead of needing a password.

  • It's against the purpose ! Do we need to download public key to access https site? No! It would be impractical. Anyhow, thanks for pointing this out, thanks to you, I added clarification. I hope that now question is clearer. Clearer that I'd like to serve "demo app" for random users, like http serves websites :). Therefore by "secure", I've meant for server. – Grzegorz Wierzowiecki May 1 '16 at 7:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.