LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   I think i found a bug in Ssh server (https://www.linuxquestions.org/questions/linux-security-4/i-think-i-found-a-bug-in-ssh-server-784095/)

guarapo 01-22-2010 04:12 PM
I think i found a bug in Ssh server
 
Hi folks, first of all i am sorry about my English...

I think i found a bug in Ssh daemon, or maybe it is not a bug and i am wrong, but i need some help to see the light.

When i connect from a client machine to a server machine via Nautilus (ssh://guest@remote-ip-server:22/home/guest). In the server machine, the who command do no show this guest user logged in.

You will need 2 machines running Debian Lenny (stable) amd64 with Gnome to reproduce this bug, probably you don't.

At client machine with Gnome and Nautilus:
You write this url in Nautilus: ssh://guest@remote-ip-server:22/home/guest
Will prompt for password 2 times (i don't know why)
Now you can navigate remotely via Nautilus...

At the remote server machine:
Code:
server:/# who
root    tty1        2010-01-22 21:53
server:/#
server:/# netstat -atn 
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address          Foreign Address        State
tcp        0      0 192.168.1.79:22        192.168.1.69:54745      ESTABLISHED
tcp        0      0 192.168.1.79:22        192.168.1.69:54744      ESTABLISHED
server:/#
As you see, you can't see guest user logged in. Maybe it is not a bug, but i am afraid it can be a security issue.

I am totally sure it is not a bug in Ssh because Nautilus do no open an interactive shell but i need some help how to see this type of connection on the server side.

Thanks

rweaver 01-22-2010 04:22 PM
Type:

Code:
last
Does it list it as having logged in twice?

rkdavies 01-22-2010 05:25 PM
That is because Nautilus is creating an SFTP connection not an SSH session with that method.

Web31337 01-22-2010 05:45 PM
rkdavies is totally right here, sftp connections are not shown in "who" because they actually don't start shell session. That is not debian-specific as well.

Hi and welcome to LinuxQuestions.org, rkdavies!

guarapo 01-23-2010 07:38 AM
Thank you guys for your fast replies.

Yes, and sftp connection do no open an interactive shell... so no user is logged in.


All times are GMT -5. The time now is 02:57 AM.