[question] root access (su, devel-su) and system security

asked 2015-12-12 16:40:56 +0300

Laura
566 ●9 ●14 ●17

updated 2015-12-12 16:48:46 +0300

Hello,

a few days ago I finally got my Jolla Phone. :-)

As I don't have any mentionable experience with linux and never had another smartphone before, I hope someone here will help me to understand the effects of su and devel-su on system security.

Having developer mode enabled and remote access disabled, I cannot use one of those two commands by just clicking "return" when I am asked for the password. Does this mean that somewhere in the system configuration, there is an option like "don't allow empty passwords for local or remote access as root" set to the value "true"? And if this is the case, is it changeable?

Activating remote access and setting a password makes it possible to use the command devel-su. I also found an instruction of how to use "su" instead. But I have read contradictory statements about the question which of those ways is more secure. One person claims devel-su has been developed in order to be more "paranoid" and another one states that remote access will always be enabled, if a password ist set for the root. The third statement in contrast advises people to let remote access be disabled and to use su to avoid connections via SSH. So I am a bit confused now.

The way I would like it to work is that I can get full access to the phone in order to configure it and then set it back to limited access rights before I reconnect to the Internet. So that it is impossible then for anyone to execute code as root.

This leads me to another question concerning this theme: Is it a security risk to have developer mode enabled, but remote access disabled and therefore no password set? Could a malware easily set its own password then?

Thanks in advance for your help!

edit retag flag offensive close delete

6

answered 2015-12-12 17:26:29 +0300

jollailija

4736 ●74 ●115 ●129

https://jollailija.github...

I recommend using devel-su instead of su/sudo. If you have dev mode on but password not set everything is groovy. There is no known malware, and setting root password requires your passcode. If you set a su password, possible malware on your machine can try quessing it.

TL;DR: Developer mode on and remote access off once you log in is it safest way. (after gaining root access you can turn off remote connection without terminating your session)

edit flag offensive delete publish link

Comments

1

There is also SSH Access Confirmation. Not quite as paranoid as turning off remote access but almost and more convenient.

pichlo ( 2015-12-13 12:51:06 +0300 )edit

Thank you both for the helpful information. I think I'll choose the safest way first. It is good to know that there is no need to leave remote access activated during a whole session. I'll probably try the app when I need to get remote access to the phone at a later date and want to prevent others from doing the same then. It seems to be quite useful for that purpose.

Laura ( 2015-12-14 00:27:20 +0300 )edit

1

answered 2015-12-16 17:25:30 +0300

reinob
81 ●2 ●9

You can always enable developer mode and then edit /etc/ssh/sshd_config, set-up passwordless ssh (*) and then edit /etc/ssh/sshd_config and set "PasswordAuthentication no", this will prevent login in using a password.

(*) from your computer do "ssh-copy-id root@jolla-ip", and/or "ssh-copy-id nemo@jolla-ip"

This will allow you to login via ssh (which may save your day someday :) still making it nearly impossible for somebody else to login to your Jolla (brute-forcing ssh keys is still a science-fiction scenario whereas brute-forcing passwords happens every day).

edit flag offensive delete publish link

Comments

Thanks for this tip. I hadn't considered the fact that I don't have a second hard drive/OS on the phone to solve problems. So a solution for emergency situations surely is a good idea before I start playing around with commands. Hence I hope you might be willing to answer me some further questions to your suggestion.

Don't I need to use "keygen" before being able to copy a key? If I disable remote access and then enable it again with an empty password, will the SSH key still be the same? And will the entry "PasswordAuthentication no" remain in the config file or be overwritten by the default value?

Laura ( 2015-12-17 22:06:39 +0300 )edit

1

Re. keygen: you can check in /home/nemo/.ssh if the keys are already generated. Probably not. Then run $ ssh-keygen -t rsa ...

Re. password: When you enable developer mode and set a password this should not affect the ssh keys.

It may happen the the ssh configuration is reset when you enable/disable developer mode or when the ssh package is updated. Normal linux distributions would always ask you before replacing a user-modified configuration. With rpm-based systems I don't know what happens. I seem to remember having seen a "sshd_config.rpmnew" file, which would mean that my settings were not replaced.

I would strongly recommend leaving developer mode always ON, and double checking the ssh config whenever ssh is updated (which is not so often anyway..)

Hope that helps a bit. If not, shout back.

reinob ( 2015-12-23 10:24:18 +0300 )edit

The keys had not already been generated, so I thank you for that additional information.

After having spent some hours in finding out what I had done wrong, I finally managed it to work properly.

There are only two remaining questions:

I needed to import the private key in PuTTY, because I didn't find any possibility to use the public key only. Therefore I do now have both keys on both systems (PC and phone). How could I do that better?
Disabling remote access and restarting the phone after that doesn't prevent me from establishing a connection via ssh using the key. Is this a bug or a feature? Is there any way to change that behaviour?

Laura ( 2015-12-26 23:29:29 +0300 )edit

[question] root access (su, devel-su) and system security

2 Answers

Comments

Comments

Question tools

Stats

Related questions

[question] root access (su, devel-su) and system security

2 Answers

Comments

Comments

Question tools

Public thread

Stats

Related questions