Keyboard Interactive Attack?

mancha
Wed, 22 Jul 2015 23:03:28 -0000

On Wed, Jul 22, 2015 at 07:41:54PM +0000, Scott Neugroschl
wrote:
> I read an article today about keyboard interactive auth allowing
> bruteforcing.
>
> I'm afraid I have minimal understanding of what keyboard-interactive
> really does.  What does it do, and should I have my clients set it to
> off in sshd_config?

Hi.

A bug in the keyboard-interactive codebase allows querying a
keyboard-interactive device more than once per auth request.

By sending a comma-delimited keyboard-interactive device list with
repeats (e.g. "pam, pam, pam, ..."), one can circumvent an OpenSSH
server's MaxAuthTries restriction.

That's the crux of the issue.

Attached patch fixes.

--mancha
-------------- next part --------------