Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sudo credential reuse doesn't work with Cockpit Client #18927

Open
allisonkarlitskaya opened this issue Jun 13, 2023 · 3 comments
Open

sudo credential reuse doesn't work with Cockpit Client #18927

allisonkarlitskaya opened this issue Jun 13, 2023 · 3 comments
Labels
bug

Comments

@allisonkarlitskaya
Copy link
Member

allisonkarlitskaya commented Jun 13, 2023 •
edited
Loading

  1. open Cockpit Client
  2. login somewhere using ssh with a password
  3. become root in the usual way by providing the same password for sudo
  4. logout
  5. login again with the same password
  6. observe that the "Limited access" button is initially invisible. In the background sudo is asking for the password and cockpit-ws is replying, 3 times, with the empty string, which sudo rejects three times. After this dance is complete, the "Limited access" button becomes visible.

This is difficult to fix. The core issue is that ssh passwords are not provided via the usual password prompt on the login screen but rather as part of a separate dialog which comes later. This dialog might have been asking for your passphrase to unlock your local ssh key which we definitely don't want to send to the remote, and we don't have a way to tell the two cases apart.
@allisonkarlitskaya
Copy link
Member Author

Affects both C and Python bridge.

allisonkarlitskaya added a commit to allisonkarlitskaya/cockpit that referenced this issue Jun 13, 2023
@allisonkarlitskaya
cockpit-beiboot: don't try to do explicit-superuser
a4e56fb 
This doesn't currently work in Cockpit Client — cockpit-ws always
returns the empty string as the password.  Don't even attempt it.

That prevents us from having to deal with the resulting transport
control messages and also prevents the delayed appearance of the
"Limited access" as described in cockpit-project#18927.
allisonkarlitskaya added a commit to allisonkarlitskaya/cockpit that referenced this issue Jun 14, 2023
@allisonkarlitskaya
cockpit-beiboot: don't try to do explicit-superuser
2dda9d3 
This doesn't currently work in Cockpit Client — cockpit-ws always
returns the empty string as the password.  Don't even attempt it.

That prevents us from having to deal with the resulting transport
control messages and also prevents the delayed appearance of the
"Limited access" as described in cockpit-project#18927.
martinpitt pushed a commit that referenced this issue Jun 14, 2023
@allisonkarlitskaya @martinpitt
cockpit-beiboot: don't try to do explicit-superuser
82133e7 
This doesn't currently work in Cockpit Client — cockpit-ws always
returns the empty string as the password.  Don't even attempt it.

That prevents us from having to deal with the resulting transport
control messages and also prevents the delayed appearance of the
"Limited access" as described in #18927.
martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 24, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
f42a6bb 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
@martinpitt
Copy link
Member

In beiboot mode this works fine now, I implemented it in #19441. That doesn't apply to Client mode though, as we don't use the "nice" UI for handling user/password. So this continues to be relevant.

martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 24, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
6fca5b7 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 24, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
99567dd 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 25, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
ef0e304 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 25, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
bd06574 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 25, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
3373eac 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
@allisonkarlitskaya
Copy link
Member Author

@martinpitt glad you found this old issue after our conversation about it. I don't even remember having filed it. :)

martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 27, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
5d0bcee 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 27, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
5ec793c 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
martinpitt added a commit to martinpitt/cockpit that referenced this issue Sep 27, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
f161aa8 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
martinpitt added a commit that referenced this issue Sep 30, 2024
@martinpitt
bridge: Implement beiboot superuser handling in bastion mode
a691bc7 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve #18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
garrett pushed a commit to martinpitt/cockpit that referenced this issue Oct 8, 2024
@martinpitt @garrett
bridge: Implement beiboot superuser handling in bastion mode
faffd4a 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
mvollmer pushed a commit to mvollmer/cockpit that referenced this issue Oct 9, 2024
@martinpitt @mvollmer
bridge: Implement beiboot superuser handling in bastion mode
c945779 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
SludgeGirl pushed a commit to Nykseli/cockpit that referenced this issue Nov 12, 2024
@martinpitt @SludgeGirl
bridge: Implement beiboot superuser handling in bastion mode
27779ff 
Now that beiboot explicitly handles Basic authentication, remember the
password for the superuser authorization.

Split `SshPeer.transport_control_received()` into the more fine-grained
`do_*` handlers. This results in cleaner, more separated, and more
robust (no string comparisons any more) code.

Note that this doesn't solve cockpit-project#18927 -- the Client still doesn't have a
proper UI for handling passwords, and thus doesn't remember it for
superuser authentication. This only works in beiboot mode.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@martinpitt @allisonkarlitskaya