Post B6kxy2Hb0Ka9afzAxc by jenesuispersonne@piaille.fr
(DIR) More posts by jenesuispersonne@piaille.fr
(DIR) Post #B6kZZi95pAqvHosQ08 by azonenberg@ioc.exchange
0 likes, 0 repeats
FS switch SSH update: the SSH server appears to advertise RSA, ed25519, and ECDSA host keys.I can change the RSA key with "rsa key NAME generate 4096" and "ip ssh server host-key rsa key NAME".I have so far not figured out how to change the ed25519 or ECDSA keys.
(DIR) Post #B6kZhzRxN5l1GseE7s by azonenberg@ioc.exchange
0 likes, 0 repeats
These are the keys of the other switch that I haven't rekeyed yet (so whatever shipped in the firmware):| ssh-hostkey:| 2048 5b:4b:c3:16:59:b5:96:91:f3:a2:3c:4c:bc:cc:65:a7 (RSA)| 256 ef:d7:50:22:01:ac:4c:25:24:ff:f5:40:b9:1d:db:5d (ECDSA)|_ 256 f3:18:f6:7b:8f:6f:19:83:35:90:26:60:46:66:8c:43 (ED25519)
(DIR) Post #B6kckBY5etaLElFsbw by azonenberg@ioc.exchange
0 likes, 0 repeats
@MrDOS same keys out of the box with no config.i've figured out how to roll the rsa key in config, not the ecdsa/ed25519 yet
(DIR) Post #B6kd8ED3PxgURHsdKC by azonenberg@ioc.exchange
0 likes, 0 repeats
@MrDOS i found out when i logged into the second and openssh already had the fingerprint in known hosts
(DIR) Post #B6kdSnQyADOjTfCFWq by azonenberg@ioc.exchange
0 likes, 0 repeats
@MrDOS nope discovered by accident.it's a closed mgmt network i don't exactly trust switch firmware in general
(DIR) Post #B6kk56pL6nIgLxFPpg by azonenberg@ioc.exchange
0 likes, 0 repeats
There is an undocumented command to break out of the configuration CLI and enter a regular Linux shell.The SSH server is bog-standard OpenSSH. I can see the sshd_config and ssh_host_*_key but I don't think they're writable because / is on the image partitionhttps://gist.github.com/abbbi/e7fbab1c05b1226a035f561e7d3f3028
(DIR) Post #B6kud9IpPSzNQ0uXY0 by azonenberg@ioc.exchange
0 likes, 0 repeats
It looks like PicOS is much better (you can get the full native OS ssh config and poke it directly) so this should be a non-issue there.I knew FSOS was a bit janky so I'm not entirely surprised, and good to know that when I get the PicOS switch down the road it won't be an issue.
(DIR) Post #B6kxy2Hb0Ka9afzAxc by jenesuispersonne@piaille.fr
0 likes, 0 repeats
@azonenberg Isn't there a startup script that load custom keys in writable space and defaults to host keys in / filesystem if not?
(DIR) Post #B6kyBXdVkCRWb1fzpA by azonenberg@ioc.exchange
0 likes, 0 repeats
@jenesuispersonne As far as I can see there is a startup script that loads RSA keys from the config (I haven't found it, but it exists, I can configure an RSA key via the CLI and it's applied on the next reload replacing the RSA key in the image).But the ed25519 and ecdsa keys in the image don't seem to be supported by the same flow, e.g. there is an "ip ssh server host-key rsa" command but no "ip ssh server host-key ed25519" command
(DIR) Post #B6kyoQE1ETcqu9IBJw by azonenberg@ioc.exchange
0 likes, 0 repeats
@jenesuispersonne so basically you end up with the same global immutable ECC keys and you can roll the RSA key.So if you configure your client to only authenticate with RSA, everything is fine. But if you prefer ECC by default (as OpenSSH does) anyone who's dumped the firmware from the same model of switch can MITM you.
(DIR) Post #B6kyvxGemODdPZ7Nlg by jenesuispersonne@piaille.fr
0 likes, 0 repeats
@azonenberg understood at the first sight.
(DIR) Post #B6kz5ROS8rpnS1HuYS by azonenberg@ioc.exchange
0 likes, 0 repeats
@jenesuispersonne Anyway, I am the sole admin, if somebody gets on my management network I have bigger problems, and I only plan to keep these switches in production-ish use for a few months before upgrading (they'll become lab sandboxes after that).So it's not going to be that big a deal to add some ~/.ssh/config lines clientside to force use of the RSA host key.But it does raise questions about the firmware in general to say the least