[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#283377: marked as done (Should not copy installer account to /target if network-console-config not installed)

Your message dated Wed, 1 Dec 2004 14:34:07 -0500
with message-id <20041201193407.GA2467@kitenet.net>
and subject line FWD: Fixed in NMU of network-console 0.0.9
has caused the attached Bug report to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere.  Please contact me immediately.)

Debian bug tracking system administrator
(administrator, Debian Bugs database)

Received: (at submit) by bugs.debian.org; 28 Nov 2004 16:52:11 +0000
>From evilpig@gmail.com Sun Nov 28 08:52:11 2004
Return-path: <evilpig@gmail.com>
Received: from rproxy.gmail.com [] 
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1CYSHS-0000N3-00; Sun, 28 Nov 2004 08:52:10 -0800
Received: by rproxy.gmail.com with SMTP id q1so306508rnf
        for <submit@bugs.debian.org>; Sun, 28 Nov 2004 08:52:10 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
Received: by with SMTP id t16mr1030385rne;
        Sun, 28 Nov 2004 08:52:09 -0800 (PST)
Received: by with HTTP; Sun, 28 Nov 2004 08:52:09 -0800 (PST)
Message-ID: <133ac4eb041128085224083035@mail.gmail.com>
Date: Sun, 28 Nov 2004 10:52:09 -0600
From: Colleen Hatfield <evilpig@gmail.com>
Reply-To: Colleen Hatfield <evilpig@gmail.com>
To: submit@bugs.debian.org
Subject: RC2 install report on Dell SC420, security issue with network-console udeb "installer" user not being removed
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Delivered-To: submit@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE 
	autolearn=no version=2.60-bugs.debian.org_2004_03_25

Package: installation-reports


RC2 netinstall image for i386, downloaded from
on 20041126

uname -a:
Linux chloe 2.6.8-1-386 #1 Thu Nov 25 04:24:08 UTC 2004 i686 GNU/Linux

20041126, ~23:00 UTC

Burnt the netinstall image to CD, using the "expert26" boot parameter.
 Apt sources were unstable over HTTP from mirrors.kernel.org and
ftp.debian.org (no proxy).

Machine: Dell PowerEdge SC420
Processor: 2.8GHz Pentium 4
Memory: 256MB DDR2-400 SDRAM
Root Device: 160GB SATA drive (/dev/sda2)
Root Size/partition table:  
sda1                  Primary   Dell Utility                        57.58 
sda2      Boot        Primary   Linux ext3       [/]             39983.09 
sda3                  Primary   Linux ext3                       39999.54 
sda5                  Logical   Linux swap / Solaris              1003.49 
Debian was installed to /dev/sda2; /dev/sda3 is currently formatted
but unmounted and unused.

Output of lspci and lspci -n:
Note: I took the Aureal Vortex sound card out of another machine; it
didn't come with the SC420 (but it does work nicely in Debian).
0000:00:00.0 Host bridge: Intel Corp. Server Memory Controller Hub (rev 04)
0000:00:01.0 PCI bridge: Intel Corp. Server Memory Controller Hub PCI
Express Port (rev 04)
0000:00:02.0 VGA compatible controller: Intel Corp. Graphics Controller (rev 04)
0000:00:1c.0 PCI bridge: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) PCI Express Port 1 (rev 03)
0000:00:1c.1 PCI bridge: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) PCI Express Port 2 (rev 03)
0000:00:1d.0 USB Controller: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) USB UHCI #1 (rev 03)
0000:00:1d.1 USB Controller: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) USB UHCI #2 (rev 03)
0000:00:1d.2 USB Controller: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) USB UHCI #3 (rev 03)
0000:00:1d.3 USB Controller: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) USB UHCI #4 (rev 03)
0000:00:1d.7 USB Controller: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) USB2 EHCI Controller (rev 03)
0000:00:1e.0 PCI bridge: Intel Corp. 82801 PCI Bridge (rev d3)
0000:00:1f.0 ISA bridge: Intel Corp. 82801FB/FR (ICH6/ICH6R) LPC
Interface Bridge (rev 03)
0000:00:1f.1 IDE interface: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6
Family) IDE Controller (rev 03)
0000:00:1f.2 IDE interface: Intel Corp. 82801FR/FRW (ICH6R/ICH6RW)
SATA Controller (rev 03)
0000:00:1f.3 SMBus: Intel Corp. 82801FB/FBM/FR/FW/FRW (ICH6 Family)
SMBus Controller (rev 03)
0000:02:00.0 Ethernet controller: Broadcom Corporation NetXtreme
BCM5751 Gigabit Ethernet PCI Express (rev 01)
0000:04:02.0 Multimedia audio controller: Aureal Semiconductor Vortex 2 (rev fe)
lspci -n:
0000:00:00.0 0600: 8086:2588 (rev 04)
0000:00:01.0 0604: 8086:2589 (rev 04)
0000:00:02.0 0300: 8086:258a (rev 04)
0000:00:1c.0 0604: 8086:2660 (rev 03)
0000:00:1c.1 0604: 8086:2662 (rev 03)
0000:00:1d.0 0c03: 8086:2658 (rev 03)
0000:00:1d.1 0c03: 8086:2659 (rev 03)
0000:00:1d.2 0c03: 8086:265a (rev 03)
0000:00:1d.3 0c03: 8086:265b (rev 03)
0000:00:1d.7 0c03: 8086:265c (rev 03)
0000:00:1e.0 0604: 8086:244e (rev d3)
0000:00:1f.0 0601: 8086:2640 (rev 03)
0000:00:1f.1 0101: 8086:266f (rev 03)
0000:00:1f.2 0101: 8086:2652 (rev 03)
0000:00:1f.3 0c05: 8086:266a (rev 03)
0000:02:00.0 0200: 14e4:1677 (rev 01)
0000:04:02.0 0401: 12eb:0002 (rev fe)

Base System Installation Checklist:
[O] = OK, [E] = Error (please elaborate below), [ ] = didn't try it

Initial boot worked:    [O]
Configure network HW:   [O]
Config network:         [O]
Detect CD:              [O]
Load installer modules: [O]
Detect hard drives:     [O]
Partition hard drives:  [O]
Create file systems:    [O]
Mount partitions:       [O]
Install base system:    [O]
Install boot loader:    [O]
Reboot:                 [E]


Error with reboot was http://bugs.debian.org/277298.  This problem is
fixed in the latest 2.6.8 kernel package in the unstable tree

A more bothersome (security-related) problem is that when the
network-console udeb is loaded and used to remotely access the install
process via SSH, the "installer" user isn't deleted from the system at
the end of the install process.

Here's what I did:
- Booted from the RC2 netinstall CD for i386 with the expert26 boot option
- Loaded the "network-console" udeb so that I would be able to SSH
into the installer
- When I was given the option to "Continue installation remotely using
SSH", I set a password for the installer user and then used it to SSH
in from another machine.

The screen where you set the "installer" user's password says, "This
password is used only by the Debian installer, and will be discarded
once you finish the installation."  However, this is not the case -
this user persists after completion of the install and rebooting, etc.
>From /etc/passwd:
>From /etc/shadow (password is 'password'):

Although this is mitigated by the fact that
/usr/sbin/base-config-network-console doesn't exist after the install,
an attacker that has gained root via privilege escalation or
exploiting a privileged daemon can just create a symlink from
/usr/sbin/base-config-network-console to /bin/bash.  The "installer"
user's password is most likely easier to crack than the root password,
since the administrator has been told that the installer user will not
persist.  Since the default configuration of the Debian ssh package
includes "PermitRootLogin yes", the attacker can crack the weaker
"installer" password, create the symlink, and thus gain remote root
access via SSH.  The administrator probably won't even realize that
this account exists, and this will also slip past file integrity
checkers watching /etc/passwd and /etc/shadow since modifying these
files is unnecessary if the "installer" password can be cracked.

- Colleen

Received: (at 283377-done) by bugs.debian.org; 1 Dec 2004 19:32:35 +0000
>From joey@kitenet.net Wed Dec 01 11:32:34 2004
Return-path: <joey@kitenet.net>
Received: from kitenet.net [] (postfix)
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1CZaDK-0007dP-00; Wed, 01 Dec 2004 11:32:34 -0800
Received: from dragon.kitenet.net (unknown [])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client CN "Joey Hess", Issuer "Joey Hess" (verified OK))
	by kitenet.net (Postfix) with ESMTP id 513AE17FC1
	for <283377-done@bugs.debian.org>; Wed,  1 Dec 2004 19:32:34 +0000 (GMT)
Received: by dragon.kitenet.net (Postfix, from userid 1000)
	id 2F7236E26E; Wed,  1 Dec 2004 14:34:07 -0500 (EST)
Date: Wed, 1 Dec 2004 14:34:07 -0500
From: Joey Hess <joeyh@debian.org>
To: 283377-done@bugs.debian.org
Subject: FWD: Fixed in NMU of network-console 0.0.9
Message-ID: <20041201193407.GA2467@kitenet.net>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="tThc/1wpZn/ma/RB"
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: 283377-done@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-5.0 required=4.0 tests=BAYES_00,VALID_BTS_CONTROL 
	autolearn=no version=2.60-bugs.debian.org_2004_03_25

Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable


---- Forwarded message from Joey Hess <joeyh@debian.org> -----

=46rom: Joey Hess <joeyh@debian.org>
Date: Wed, 01 Dec 2004 14:17:06 -0500
To: control@bugs.debian.org
Cc: Joey Hess <joeyh@debian.org>,
	Debian Install System Team <debian-boot@lists.debian.org>
Subject: Fixed in NMU of network-console 0.0.9

tag 283377 + fixed


This message was generated automatically in response to a
non-maintainer upload.  The .changes file follows.

Hash: SHA1

Format: 1.7
Date: Wed,  1 Dec 2004 14:09:07 -0500
Source: network-console
Binary: network-console-config network-console
Architecture: source i386 all
Version: 0.0.9
Distribution: unstable
Urgency: low
Maintainer: Debian Install System Team <debian-boot@lists.debian.org>
Changed-By: Joey Hess <joeyh@debian.org>
 network-console - Provides a console via ssh (udeb)
 network-console-config - Debian base system configurator - network console
Closes: 283377
 network-console (0.0.9) unstable; urgency=3Dlow
   * Frans Pop
     - Only copy SSH keys and installer account if network-console-config
       is installed successfully. Closes: #283377.
     - Queue installation of network-console-config in postinst as for
       CD-based installations the CD will already be unmounted when the
       prebaseconfig script is run (tanks to Colin Watson for spotting this=
 f70a92abca1d99736f11ad806e6e9c7a 627 debian-installer optional network-con=
 4a37804280b7e14f6573b63be26e7247 46697 debian-installer optional network-c=
 65a7e571c7f474d8e1eefe22de2d47e9 4196 admin optional network-console-confi=
 58c5e9f9a757d02b2d0a23855ec5f2b4 37414 debian-installer optional network-c=
package-type: udeb

Version: GnuPG v1.2.5 (GNU/Linux)


To UNSUBSCRIBE, email to debian-boot-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.o=

----- End forwarded message -----
see shy jo

Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

Version: GnuPG v1.2.5 (GNU/Linux)



Reply to: