OpenSSH
[Top] [All Lists]

Re: ssh-agent does not immediately clean timeouted keys from memory

To: openssh@p23q.org
Subject: Re: ssh-agent does not immediately clean timeouted keys from memory
From: Darren Tucker <dtucker@zip.com.au>
Date: Sat, 24 Feb 2007 11:47:40 +1100
Cc: openssh-unix-dev@mindrot.org
Delivered-to: sp-com-lists@consult.net
Delivered-to: openssh-unix-dev-list1@securepoint.com
Delivered-to: openssh-unix-dev-tmda@mindrot.org
Delivered-to: openssh-unix-dev@mindrot.org
In-reply-to: <20070223231838.GA15726@gate.dtucker.net>
List-archive: <http://lists.mindrot.org/pipermail/openssh-unix-dev>
List-help: <mailto:openssh-unix-dev-request@mindrot.org?subject=help>
List-id: Development of portable OpenSSH <openssh-unix-dev.mindrot.org>
List-post: <mailto:openssh-unix-dev@mindrot.org>
List-subscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=subscribe>
List-unsubscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=unsubscribe>
References: <20070223181032.GA13124@ganymede> <20070223231838.GA15726@gate.dtucker.net>
Reply-to: dtucker@zip.com.au
Sender: openssh-unix-dev-bounces+openssh-unix-dev-list1=securepoint.com@mindrot.org
User-agent: Mutt/1.5.11
On Sat, Feb 24, 2007 at 10:18:38AM +1100, Darren Tucker wrote:
> On Fri, Feb 23, 2007 at 06:10:32PM +0000, openssh@p23q.org wrote:
> > during my seminar of advanced exploitation techniques (SEAT, [1]) i
> > developed some methods to crack into system via DMA (e.g. via firewire).
> > as part of this i developed a program that steals loaded ssh private
> > keys from ssh-agents. i was astonished to find that the keys are not
> > immediately removed from the agent when a timeout occurs, but only the
> > next time the agent is queried via its socket. i have written a
> > __rough__ patch that should fix the problem (a timer checks every 10
> > seconds). please take a look at it and, if you like it, incorporate it.
> 
> Overloading the sigalrm handler seems unnecessarily complex when select(2)
> has a perfectly good timeout parameter :-)

A slightly smaller patch that uses the existing loop in the reaper()
function to compute the next timeout.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Attachment: openssh-agent-immediate_expire2.patch
Description: Text document

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
<Prev in Thread] Current Thread [Next in Thread>