I'm using my raspberry pi as a home web server and, whilst I know it's never going to offer up enterprise level security, I would like to make it as secure as possible.

scanmyserver.com has indicated that the current version of OpenSSH included in rasbian is 6.7p1 is insecure and the minimum version that should be used is version 7.

The full detail of the detected problems with this version is:

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.

Is there any way to upgrade to this?

  • You could build it from source but maybe you want to consider the real issues first: openssh.com/security.html V.7+ is not free from various problems either. Stuff like this is more a matter of whether you are exposed to them in context. – goldilocks Mar 3 '17 at 12:29
  • Doesn't that run the risk of me being left unable to connect to my pi at all if it doesn't install properly? Also, whilst V.7.+ isn't free of issues it surely has less than 6? – Persistence Mar 3 '17 at 12:47
  • Sure, ideally speaking each iteration of a software product should be an improvement over others, particularly with something like SSH where the functionality is fairly stable (i.e., there is less of a problem of new features introducing new bugs). However, this is not necessarily the case and by my reading of that not all the issues are "<= v.X", some of them are "X.n -> X.n2". Since it's all out in the open, you can consider how significant the issues that affect your version are to you. – goldilocks Mar 3 '17 at 12:58
  • If it's mostly Greek to you, you might as well rest easy with the fact that Debian is used on a very large number of systems globally, they have a security team, etc. Their policy with versioning of all software is conservative (i.e., never the latest one) precisely because their philosophy is that this is in general the most stable way to go. AFAICT they do respond in a timely manner to security issues when fixes arrive from upstream which do not always amount to a major/minor version upgrade -- they're patch level, and Debian also adds there own patches. – goldilocks Mar 3 '17 at 12:58
  • Hence a number like 6.7p1 -> note the p1. What you should scrutinise first is the online scanner that has you scared. If it is really able to assess stuff like this, it should give you a detailed list of the vulnerabilities present in Debian's 6.7p1 openSSH, not just say "Oh well upgrade to 7+, that's a higher number" -- too reductive, I would take it with a major grain of salt. It's free, it's lazy, it's whatever. I'd trust Debian over them, TBH, if it comes down to trust -- which unless you want to do your own code level audit, it has to. – goldilocks Mar 3 '17 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.