freebsd security - Feb 2020 - Early heads-up: plan to remove local patches for TCP Wrappers support in sshd

On 14 Feb 2020, at 18:18, Ed Maste wrote:

Hi Ed,
> Although the specific deprecation steps aren't yet fleshed out I'm
> sending this as an early notice that I plan to disable libwrap support
> from the base system sshd and that FreeBSD 13 will not support it.
I?ll be sad to run inetd again on systems so that I can run a wrapped 
sshd.
Like others I feel that adding firewalls to a machine simply to filter 
sshd is not an option and whatever else openssh itself has offered in 
the past never sufficed.

I am also worried that the change will make a lot of machines 
unprotected upon updating to 13 if there is no big red warning flag 
before the install.


I do understand the burden of maintaining a local patch (we lost the HA 
patches from base this way already).

Given the port already does maintain the patch I am wondering what 
?security guarantees? we provide for the port compared to the base 
system (ignoring possible security updates) or why the patch cannot be 
included in base?  Compared to the HA patch, this one seems to be 
sillily small..


/bz

On Sat, 15 Feb 2020 at 05:03, Bjoern A. Zeeb
<bzeeb-lists at lists.zabbadoz.net> wrote:
>
> I am also worried that the change will make a lot of machines
> unprotected upon updating to 13 if there is no big red warning flag
> before the install.
At least having sshd emit a warning is a prerequisite, certainly. I
don't yet know if there's a way via libwrap's API to determine if
rules are in place; there's a bit of investigation needed here still.
> I do understand the burden of maintaining a local patch (we lost the HA
> patches from base this way already).
Indeed. As you pointed out the libwrap patch is very small and easy to
review and reason about. My bigger concern is that libwrap is
essentially abandonware, and it has been dropped by just about
everyone else. As far as I know Debian is still patching libwrap
support into sshd but not anyone else.

It seems starting sshd from inetd via tcpd is a reasonable approach
for folks who want to use it; also, have folks using libwrap looked at
sshd's Match blocks to see if they provide the desired functionality?